Airbnb succeeds in quashing IPC’s order concerning public disclosure of Vancouver hosts’ personal addresses as potential risks of disclosure not reasonably considered

Administrative law – Decisions reviewed – Privacy Commissioner – Freedom of information and protection of privacy – Disclosure of records – Public bodies – Judicial review – Procedural requirements and fairness – Standard of review – Unreasonableness

Airbnb Ireland UC v. Vancouver (City), [2023] B.C.J. No. 1294, 2023 BCSC 1137, British Columbia Supreme Court, July 4, 2023, J.S. Basran J.

Pursuant to a memorandum of agreement (“MOU”) between the City of Vancouver and Airbnb, Airbnb agreed to send the City information about each of its hosts, including their name, business license number, email address and address of the short-term rental (“STR”) property, which was the hosts’ principal residences as only principal residences can be used as STRs in Vancouver. While the City publishes some STR information on its Open Data Portal, it does not include the hosts’ names or addresses. The City had decided to stop disclosing addresses for home-based businesses (such as STRs) after several reports of safety risks related to such disclosures (e.g., a stalker locating the victim’s address through the Portal). An individual applicant requested that the City provide him with all STR hosts’ names, license numbers and addresses, both from Airbnb and from other platforms. Relying on ss. 15 and 19 of the Freedom of Information and Protection of Privacy Act, the City refused to produce the information as doing so could reasonably be expected to threaten an individual’s safety or mental or physical health or harm the security of the property. Part of the reasoning for this was that STRs are a point of contention in Vancouver, and there have been active “vigilantes” who will harass STR hosts and/or vandalize their homes to discourage STRs in the community. The City also relied upon ss. 21 and 22 of FIPPA, which requires a public body to withhold information if its disclosure could reasonably be expected to harm the business interests of a third party or involves personal information, the release of which would unreasonably invade a person’s privacy.

The applicant brought the matter forward to the OIPC, arguing that citizens should be able to access the information to “understand and potentially mitigate” risks associated with STRs in their neighborhood, including rental shortages, increased rents, noisy party-houses and increased neighborhood violence. The IPC overturned the City’s decision, in part. It ordered the City to disclose the Airbnb hosts’ license numbers which had been collected pursuant to the MOU, but not the hosts’ names and addresses that were collected as part of the MOU, as that information was protected under s. 21(1)(c)(iii). However, the City was required to disclose its other document listing all STR addresses and license numbers in the City (which was not provided pursuant to the MOU), including, but not limited to, those operated by Airbnb hosts. The IPC said s. 22(1) did not apply to the STR addresses because they were “contact information” and not “personal information” and were required to be provided in order to obtain a STR license in any event. With respect to the business license numbers, it said while they were “personal information,” s. 22(4)(i) applied to permit their disclosure as “information in respect of a license”. It concluded that ss. 15 and 19 of FIPPA did not apply because, with the exception of the one stalking victim, the City and Airbnb had not shown a reasonable expectation that releasing the information could threaten anyone’s life, physical safety and physical or mental health, or result in harm to property, sufficient to engage these provisions of FIPPA.

On Airbnb’s application for judicial review, it argued that the IPC’s decision was unreasonable and that it breached its duty of procedural fairness by not notifying the STR hosts of the applicant’s request for their information. The court upheld the IPC’s decision regarding the applicability of ss. 15 and 19, noting the IPC had tried to find a middle ground between mere possibility and probability for purposes of considering if the harm-based exceptions to the right of access in FIPPA applied. However, the court considered the IPC’s decision that the hosts’ addresses outside of the MOU should be disclosed to be unreasonable, because the IPC failed to consider the context in which their personal addresses were required to be disclosed. The finding that the information lost its character as personal information merely because its disclosure was required in order to obtain a STR license, and was therefore “contact information”, was not reasonable. The IPC’s analysis was too binary and failed to consider the relevant context and risks of the disclosure. The court also agreed that, as the IPC had reason to believe that the hosts’ information might be excepted from disclosure, it was under a duty to provide notice to all hosts of the information request, and an opportunity to participate, before making its decision on the disclosure of the records. The IPC decision was quashed, and the matter remitted back for reconsideration based on the reasons and after proper notice of the information request was provided to the hosts.

This case was digested by Kara Hill, and first published in the LexisNexis® Harper Grey Administrative Law Netletter and the Harper Grey Administrative Law Newsletter.  If you would like to discuss this case further, please contact Kara Hill at [email protected].

To stay current with the new case law and emerging legal issues in this area, subscribe here.