Do you, as a landlord, need to register with the Information Commissioner's Office to deal with your tenant's data? Well, it depends on who's actually managing the data. In the article below, Foxtons Director of Legal & Compliance, Manjit Kataora, will explain what you need to know about data protection.
Key Takeaways
Click a number to jump to that topic in the article.
- 1 Handling personal data legally. To process large amounts of personal information, agents must register with the Information Commissioner's Office (ICO).
- 2 Unregistered agent? Could be a red flag. It's worthwhile to confirm your agent is ICO-registered and dealing with your personal information appropriately.
- 3 If you use a managing agent... If you simply receive rental statements from us without handling tenant data directly, you likely fall under the 'accounts and records exemption,' so might not need to register.
- 4 Self-managing? You may need to register. Landlords who manage properties themselves or maintain their own tenant filing systems will likely need to register as data controllers and comply with data protection regulations.
- 5 It could be that simple. Our systems are already set up for data protection compliance, saving you time, money, and potential legal complications.
Data Protection legislation is nothing new. But it came into fresh focus when, on 25 May 2018, the General Data Protection Regulation came into force.
In terms of estate and letting agency work, agents will process large amounts of personal data (broadly speaking defined as information that allows you to identify a living individual) belonging to their customers and employees. This means they must be registered as data controllers with the UK regulator the Information Commissioner’s Office (ICO) and must also comply with all that is required under data protection law. Obligations include holding information securely and accurately, and being able to comply with customer data protection requests. Anyone can check whether any organisation that holds their personal data (known as a ‘data controller’) is registered by checking the relevant register on the ICO’s website.
No estate or letting agent should process personal data without first being registered. Those who do will be in breach of data protection legislation and this should serve as a red flag to any potential customer. After all, if an agent cannot be bothered to understand even their basic data protection obligations, there is a fair risk they are probably non-compliant elsewhere as well.
As for landlords themselves, it is not necessarily the case that they will need to register as data controllers with the ICO. Those who retain a managing agent and do not handle any tenant personal data but merely receive a monthly rental statement from their agent would according to the ICO’s guidance fall under the accounts and records exemption and so need not register.
But landlords who either do not have a managing agent or do have one but choose to create their own ‘structured filing system’ (as the term is known in data protection circles) containing tenant records and background information will more than likely find themselves processing personal data about their tenants and will therefore need to register with the ICO and comply with all the various (and numerous) obligations and responsibilities that flow from such status.
Even those landlords who manage to avoid processing information about their tenants, may find there comes a point at which it becomes necessary to register because they simply cannot avoid collecting details about their tenant. This might happen after the end of the landlord / tenant relationship where, if for example, the tenant vacated but in arrears, and the landlord now needs certain information from their agent in order to trace them, take proceedings against them or enforce a judgment. Where such information is collected by the landlord they would be well-advised to ensure they are registered with the ICO before processing it. This requirement could still be avoided if all the information is passed directly from the agent to the landlord’s solicitor (who will already be registered as a data controller) and does not pass through the landlord’s control but it means the landlord has to consciously avoid processing any of the information at all, which might be easier said than done.
There is then, quite an incentive to avoid being caught up in the need to register. The work required to be a competent data controller is something that few landlords are actually aware of (or would want to take on if they were) but the cost of time and money in complying means that it can and does make a managing agent – whose systems are set up for compliance in this area - look like good value, particularly when you consider the various rights tenants have other their personal data, not least subject access rights. The My Foxtons portal affords landlords visibility of tenant information using the Foxtons platform without the need to process personal data themselves. Even so, there might come a point in the relationship where it is just not possible to avoid processing tenant personal data and to that extent, landlords are well advised to consider, as a precaution, registering with the ICO and taking steps to comply with their obligations.
More information is available from the ICO.
Your data protection, sorted.
You don't have to become a registered Data Controller - our ICO-registered and experienced Lettings team will ensure all data is handled correctly and complies with data protection laws. Get started with a rental valuation. Or, if you want help with an existing tenancy, look into Foxtons Property Management.
Source: This piece was authored by Foxtons Director – Legal & Compliance, Manjit Kataora, who has been working with Foxtons on the intricacies of legislation affecting London landlords for more than 16 years. If you have a question on letting your property in London, ask a Foxtons expert