The arrival of the General Data Protection Regulation (“GDPR”) almost two years ago on 25 May 2018 was a significant development in how the handling of personal data was to be properly managed in the interaction between different members of our society. One such area is the relationship of landlords and tenants.
Landlords must ensure that they are fulfilling the obligations imposed on them under data protection principles when requesting certain information and documentation from individuals. This is particularly important at the initial phase of contact of assessing potential tenants before entering in a letting arrangement or agreement.
When a landlord is provided with personal data from an individual, they are said to be a controller of that personal information. They have a legal obligation to ensure that in performing this role, they do so in the most appropriate and lawful way in light of the fundamental principles of the GDPR. These principles are:
- Data Minimisation
- Storage Limitation
In order to do this, a landlord should ensure that any request made to an individual for personal information is:
- Relevant; and
- Not unreasonably excessive for that purpose.
A practice that appears to be becoming increasingly apparent is that of landlords (or letting agencies on their behalf) requesting very detailed information from prospective tenants at the earliest point of communication. Where a prospective tenant is asked as part of their initial application to provide information outside of what is reasonable, landlords should be mindful of the underlying GDPR principles in obtaining such information.
This can result in a disproportionate amount of an individual’s information being exchanged between unknown parties – of which the majority are unlikely to be accepted as a tenant by the landlord.
The Office of the Data Protection Commissioner has recommended that landlords and letting agencies can satisfy the data protection principles by ensuring that requesting and obtaining specific personal information from individuals for the purpose of considering them as likely tenants would be more appropriately confined to those who will be entering into the actual letting agreement, rather than requesting all information at the start of the process. Personal data should not be requested, collected, or stored by landlords for some undefined or undeclared future purpose.
How we can help
This article is for general information purposes. Legal advice must be obtained for individual circumstances. Whilst every effort has been made to ensure the accuracy of this article, no liability is accepted by the author for any inaccuracies.
GDPR for Startups and Early-Stage Companies
From the earliest stages of project development, businesses engaged in the processing of individuals’ personal data...
6 Oct 2020