S.D.N.Y.: AirBnB can’t block all discovery of customer’s third-party records

In AirBnB’s case against NYC, the city gets discovery of some of AirBnB’s customer records because it is third-party information subject to disclosure at least to determine the extent of an expectation of privacy. AirBnB, Inc. v. City of New York, 2019 U.S. Dist. LEXIS 48245 (S.D. N.Y. Mar. 23, 2019):

Airbnb Disclosure of Host Information to Third Parties: The City seeks an order compelling Airbnb to comply with requests to identify witnesses and documents that address “what information Airbnb gathers, how Airbnb stores host information, who Airbnb discloses host information to, what categories of host information Airbnb discloses to third parties, and the basis on which Airbnb discloses that host information.” City Letter at 2. Airbnb responds that it has agreed to produce information “concerning the selection and vetting of third parties to whom New York City user data may be disclosed and concerning information security as applicable to Airbnb.” Airbnb Reply at 2. It represents that it has further offered to provide the templates it uses to prepare agreements with third parties, which reflect the data security provisions “to which third parties generally must agree.” Id. It otherwise objects to the City’s requests.

Airbnb’s objections are overruled. The information the City seeks is fairly sought in discovery, as such information is potentially significant to Airbnb’s Fourth Amendment challenge to Local Law 146. As the City notes, in general, a party does not have a reasonable expectation of privacy in information it voluntarily provides to a third party. See, e.g., Smith v. Maryland, 442 U.S. 735, 743-44 (1979); United States v. Miller, 425 U.S. 435, 443 (1976); but see Carpenter v. United States, 138 S. Ct. 2206, 2220 (2018) (third-party doctrine inapplicable to collection of cell-site location information). Here, as the Court observed in its decision granting Airbnb’s and HomeAway’s requests for a preliminary injunction, plaintiffs’ Fourth Amendment claims are grounded in their “right to claim a reasonable expectation of privacy in their business records chronicling their dealings with customers.” Dkt. 92 at 23. It follows that the information the City seeks regarding Airbnb’s disclosure practices with respect to host information to third parties has the potential to inform the Court’s judgment whether, in fact, Airbnb has a reasonable expectation of privacy in the business records and data it seeks to withhold. Airbnb does not argue that it would be unduly burdensome to comply with the City’s request. Instead, it argues only that it has offered to provide certain pieces of information, including Airbnb’s policies and procedures concerning the selection of third parties and template third-party agreements reflecting data security provisions. While these materials likely bear on the issue at hand, the Court is unpersuaded that these materials are sufficient to enable the City to probe adequately Airbnb’s claim to maintain a reasonable expectation of privacy as to such host information.