Lease and let live - Safeguarding tenant data

The relationship between property rental and data protection can often be overlooked or misunderstood. The Bailiwick’s Deputy Data Protection Commissioner, Rachel Masterton, sheds light on this interplay and what data protection means for landlords and property agencies. 

We are all familiar with organisations that process personal data being responsible for that processing and for ensuring compliance with data protection legislation. We know that the businesses we work for are obligated to do certain things and that we as individuals have certain rights when it comes to information about people, about us. 

The data protection law has a very broad remit and as such applies to groups of entities we may not expect. Property landlords are one group, and they are responsible for ensuring the information about their tenants is treated well, in compliance with the law.   

Now I am often reminded by our excellent communications team not to fill these articles with lots of jargon and legalese. And I really try to take that on board. But to properly address what data protection means to landlords and the property management agencies, I need to bring up two terms: controllers and processors. 

Controllers decide the purpose for which personal data will be used, in this case everything connected with letting out the rental property and managing the tenancy. Processors do things with personal data on behalf of controllers for that purpose. Therefore, when it comes to property rental, the landlord or owner of the property is the controller and any property management agency the landlord uses is the processor. 

This means landlords are responsible for the information about their tenants and for ensuring compliance. This is the case even if they outsource the management of their property to a third party, to a property management company. This is the case even if they do not hold much, if any, personal data themselves as the agency that does is doing so on their behalf. 

So what types of personal information are we talking about?  Well there are the obvious – documents and records relating to names, addresses, banking information, and probably reference check performed on tenants.  Remember, opinions about individuals can represent their personal information.  Clearly, much of this information is sensitive and should be protected accordingly.  Brought together, it could represent a convenient little package for identity theft.  But also think about information that as a landlord you might passively collect when performing duties such as a house inspection.  Are you or your agent taking photos and do those photos capture sensitive information that may be present, such as mail or medication in a cabinet?  Keep these things in mind throughout your journey as a landlord and you will go a long way in fulfilling your data protection obligations! 

As a result, there are certain things landlords need to be aware of, in order to meet their compliance obligations. Firstly, they should be registered with the ODPA, as it is a requirement for all controllers and processors to be registered and to pay an annual levy. Failing to do this is an offence under the Law. This can be done by visiting the ODPA’s website, where both general and landlord-specific guidance is available. 

Landlords should also have a privacy notice or data processing notice that explains how the information of their tenants will be handled. You may be familiar with these from interactions with other organisations and again there is guidance on our website that can help draft such a document. 

Where a landlord is using a property management agency, there should be a contract in place explaining the role each party plays and outlining how tenants’ information is to be used by the agency. Often the property management agency will have such agreements and they will form part of the engagement process. This document will explain the outsourcing of the tasks involving personal data, but importantly, overall responsibility for data protection compliance will remain with the landlord. 

We recognise that data protection compliance can be a daunting prospect or seen as just another thing on a list of tasks to tick off. However, just as you would expect a shop to take care of your payment or order information, a landlord should take care of their tenants’ information. Both scenarios have people and their information at their heart.  

To help, as mentioned above, there is comprehensive information on our website. We also hold fortnightly drop-ins at our office just off the High Street. These are usually Tuesday mornings but please check the website for the next date. This is your opportunity to speak with one of our staff who can answer your questions, review any documents and provide assistance to help you get it right.