The implications of EU General Data Protection Regulation ("GDPR") are significant and far reaching – we've all had the emails flood our inboxes – but these implications also extend to managing property assets.
For example, in anticipation of the sale of an asset that is subject to leases, it's common practice to set-up up a data room containing all relevant documents identifying the tenants and terms of the leases. GDPR will apply to the data room to the extent that it contains the name and address of tenants who are individuals, and potentially details of any arrears they owe. This will be their personal data, albeit that it is not sensitive data (which would include things such as health, ethnicity etc.).
Landlords therefore need to ensure that any "processing" of such personal data is compliant with GDPR (collating such information about individuals for the data room would be treated as data processing). Key obligations for the processing of this type of data are:
- There is an appropriate and lawful basis under GDPR for processing the data;
- That the individuals concerned have been given the appropriate information about the processing (the "right to be informed"). This is usually in the form of a landlord's privacy notice; and
- That appropriate internal policies and procedures are in place to govern the processing of all personal data.
As such, now may be a good time for you to provide tenants with an updated privacy notice. This must include reference to:
- The collection and processing of the tenant's data whilst they are tenant and/or in occupation;
- The purposes for which data is processed (e.g. in connection with valuations, refinancing and disposals of the landlord's assets, collection of rents, conduct of rent reviews or other matters arising under the relevant lease) and the lawful basis on which you rely;
- Retention periods for such data;
- Details of third parties the data may be shared with, including managing agents, professional advisers, lenders, purchasers and valuers; and
- How individuals can exercise their rights.