BC privacy commissioner to decide whether to tell Airbnb hosts about requests for their data

The British Columbia Information and Privacy Commissioner can decide whether to notify Vancouver Airbnb owners that it plans to reconsider a public information request for the names, addresses, and license numbers of about 20,000 short-term rental operators, the BC Court of Appeal ruled.

A lower court had previously found that the IPC had a duty to notify affected Airbnb hosts of the information request, stating that one of the hosts had been stalked before, and it was reasonable to assume that other hosts might provide evidence that they faced similar risks.

However, the appellate court said the commissioner never explicitly decided whether to notify Airbnb hosts of the information request and “it is for the IPC at first instance to determine and give reasons for its decision whether notice is appropriate.”

Justice Ronald Skolrood authored last week’s decision. Justices Gregory James Fitch and Janet Winteringham concurred.

In 2018, the city of Vancouver amended bylaws related to short-term rentals to preserve housing stock for the city’s renters. The amendments required short-term rental hosts to obtain a license and only allowed such rentals to be operated from a host’s principal residence. Airbnb agreed to give the city data on local hosts’ names, license numbers, addresses, and email addresses to help with enforcement.

The following year, the city received public requests for information, including the names of about 20,000 Airbnb hosts, their short-term rental license numbers, and the addresses of their short-term rentals. The same requester also asked for the same information related to short-term rental operators in Vancouver who weren’t using Airbnb.

The city denied the request, citing provisions of the Freedom of Information and Protection of Privacy Act that empowered it to refuse disclosure of information that could threaten anyone’s life or safety and a clause that banned the city from providing information that “would be an unreasonable invasion of a third party's personal privacy.” The requester asked the IPC to review the matter.

An IPC adjudicator disagreed with the city’s decision, finding that the requested information was not exempt from disclosure under FIPPA.

Airbnb then applied for judicial review. While the court agreed with the IPC that disclosing the requested information would generally not result in threats to anyone’s life or safety, the court rejected the IPC’s reasoning that Airbnb addresses lose their “character as personal information” because they were being used as places of business.

The lower court also said the IPC had a duty to notify the 20,000 Airbnb hosts of the information requests. One of the hosts had previously been stalked by an individual who found their personal information through online databases, making her an exception to the finding that disclosing the requested information would not threaten anyone’s life or physical safety, the court said. “It was reasonable to infer that analogous evidence may have come from other hosts had they been notified,” the court added.

The IPC appealed the lower court’s ruling, challenging the notice requirement and the judge’s finding that Airbnb addresses qualify as personal information.

The court of appeal set aside the portion of the lower court ruling that ordered the IPC to provide notice to the Airbnb hosts. “Given the absence of an explicit decision of the IPC on the issue of notice to hosts and the lack of any supporting evidentiary record, it is my respectful view that the judge erred in determining that notice to the approximately 20,000 hosts was required in advance of the IPC reconsideration that he also ordered,” the appeals court said.

However, the appeals court said it would not interfere with the lower court’s finding that Airbnb addresses count as personal information under FIPPA. The appeals court noted a previous decision the IPC had released on the subject. That IPC decision “discussed the careful balance that must be struck in respect of persons working from their homes,” the appeals court said.

The IPC decision said, “In such cases, public bodies must carefully balance the rights of an applicant to obtain information about the sole proprietor’s business activities with the sole proprietor’s right to privacy of his or her personal information.”

In this scenario, however, the IPC did not explicitly consider "how to strike the appropriate balance,” the appeals court noted.

Counsel for the parties did not respond to requests for comment.