This article is written by David Smith. David is a specialist in residential landlord and tenant law and regulation. He was formerly a partner with Anthony Gold Solicitors and has recently joined JMW Solicitors
Parts of this article are adapted from GDPR for Property Lawyers propertylawyer. To be published by Law Brief Publishing in June 2020.
GDPR and renting
The current coronavirus outbreak has changed many aspects of the relationship between landlords, agents, and tenants. One area which has also changed, but is not so often considered, is the data processing relationship between them.
Landlords and agents process a great deal of personal data about their tenants. From more basic data such as their name and address through to more detailed and sensitive data such as their credit rating and rent payment history.
This is all governed by the General Data Protection Regulations, as enforced in the UK by the Data Protection Act 2018.
While all personal data is sensitive some of it is especially so and is subject to special processing rules and limitations. This type of data is referred to as Special Category Data.
Normally, letting agents and landlords would not find themselves dealing with Special Category Data. While financial data is important and sensitive it does not fall within the definition of Special Category Data. However, data referring to a person’s health certainly does fall within the definition.
Why is this an issue?
The reason this is an issue is that government guidance on repairs and maintenance explicitly encourages landlords and agents to collect health data. It does so because it tells landlords and agents that they need to consider whether tenants are self-isolating or shielding when they are considering repair and maintenance work and to seek to delay any but the most critical work if that is the case.
However, to collect data on which tenants have self-isolated or are being shielded is implicitly to collect data on health because it will tend to identify tenants who have had coronavirus or who have shown coronavirus symptoms and tenants who have health conditions which make them particularly sensitive to coronavirus.
Therefore landlords and agents who are engaged in managing their properties are implicitly going to be dealing with Special Category Data if they are to do so effectively.
If Special Category Data is to be collected then there are special rules that apply to that collection and these must be complied with.
Special Category Data rules
- First, there must be a specific processing basis that justifies the collection of the Special Category Data. A list of these is set out in the Data Protection Act 2018. The processing basis that applies, in this case, is one of a group of public interest bases and specifically is the processing basis which allows collection for the purpose of safeguarding individuals at risk.
- Second, Special Category Data can only be collected if the party collecting it has an appropriate written policy which allows for this to be done. The ICO provides an outline policy document for this purpose which gives a checklist of information and items that can be completed to create a satisfactory written policy.
- Third, appropriate security must be in place. Special Category Data is far more sensitive than ordinary personal data and should have greater security applied to it. For larger organisations, it is important to consider whether this type of data needs to be available to everyone. For example, accounts staff will need to know about rent payment data but will have little need to be acquainted with health data and so should not routinely have access to this.
When should the data be deleted?
Finally, consideration will need to be given to deleting this data. Once the current emergency is over there is no need to maintain records on who did or did not have coronavirus symptoms and so it is important to be clear about how this data will be deleted and ensure that there is a process to allow this to be done easily and securely.
There is a lot for landlords and agents to consider at this time. However, this is not a justification for ignoring rules on personal data and its management.
Collection of data on tenant health and coronavirus is important for effective and safe property management but this data needs to be handled carefully and sensitively and within the confines of the law.
David – I would suggest that maybe landlords and agents should not be too quick to delete the coronavirus related data. At least during the tenancy.
For example if the landlord later seeks to evict the tenant for non-payment of rent and the tenant tries to counterclaim for damages for disrepair because the landlord failed to, for example, repair the boiler for a period of time, the landlord will need to have his records so he can tell the court that this was because the tenant was self-isolating with coronavirus symptoms and he was unable to gain access.
That’s a fair point but would need to be objectively justified in each case. For example, if there was no disrepair reported then this would not be grounds for retention of the data
Why keep a record of the tenant’s situation?
When the tenant reports to you about their situation tell them you are unable to record this information and they will need to refuse you permission to enter the property every time you ask them to do so. Normal logging of this will be sufficient for any court case (this logging wouldn’t include the reason for refusal as otherwise your normal logging could include health information).
What’s the situation where the tenant gives information to the landlord or agent that has not been sought and was not expected. Would it be sufficient to just delete the information.
Yes it would be acceptable to simply not collect this information even when it was offered
Do you seriously think anyone cares or will do any of this?