Landlords and the Coronavirus Emergency – GDPR and Data Protection

This article is written by David Smith.  David is a specialist in residential landlord and tenant law and regulation. He was formerly a partner with Anthony Gold Solicitors and has recently joined JMW Solicitors

Parts of this article are adapted from GDPR for Property Lawyers propertylawyer.  To be published by Law Brief Publishing in June 2020.

GDPR and renting

The current coronavirus outbreak has changed many aspects of the relationship between landlords, agents, and tenants. One area which has also changed, but is not so often considered, is the data processing relationship between them.

Landlords and agents process a great deal of personal data about their tenants. From more basic data such as their name and address through to more detailed and sensitive data such as their credit rating and rent payment history.

This is all governed by the General Data Protection Regulations, as enforced in the UK by the Data Protection Act 2018.

While all personal data is sensitive some of it is especially so and is subject to special processing rules and limitations. This type of data is referred to as Special Category Data.

Normally, letting agents and landlords would not find themselves dealing with Special Category Data. While financial data is important and sensitive it does not fall within the definition of Special Category Data. However, data referring to a person’s health certainly does fall within the definition.

Why is this an issue?

The reason this is an issue is that government guidance on repairs and maintenance explicitly encourages landlords and agents to collect health data. It does so because it tells landlords and agents that they need to consider whether tenants are self-isolating or shielding when they are considering repair and maintenance work and to seek to delay any but the most critical work if that is the case.

However, to collect data on which tenants have self-isolated or are being shielded is implicitly to collect data on health because it will tend to identify tenants who have had coronavirus or who have shown coronavirus symptoms and tenants who have health conditions which make them particularly sensitive to coronavirus.

Therefore landlords and agents who are engaged in managing their properties are implicitly going to be dealing with Special Category Data if they are to do so effectively.

If Special Category Data is to be collected then there are special rules that apply to that collection and these must be complied with.

Special Category Data rules

• First, there must be a specific processing basis that justifies the collection of the Special Category Data. A list of these is set out in the Data Protection Act 2018. The processing basis that applies, in this case, is one of a group of public interest bases and specifically is the processing basis which allows collection for the purpose of safeguarding individuals at risk.
• Second, Special Category Data can only be collected if the party collecting it has an appropriate written policy which allows for this to be done. The ICO provides an outline policy document for this purpose which gives a checklist of information and items that can be completed to create a satisfactory written policy.
• Third, appropriate security must be in place. Special Category Data is far more sensitive than ordinary personal data and should have greater security applied to it. For larger organisations, it is important to consider whether this type of data needs to be available to everyone. For example, accounts staff will need to know about rent payment data but will have little need to be acquainted with health data and so should not routinely have access to this.

When should the data be deleted?

Finally, consideration will need to be given to deleting this data. Once the current emergency is over there is no need to maintain records on who did or did not have coronavirus symptoms and so it is important to be clear about how this data will be deleted and ensure that there is a process to allow this to be done easily and securely.

There is a lot for landlords and agents to consider at this time. However, this is not a justification for ignoring rules on personal data and its management.

Collection of data on tenant health and coronavirus is important for effective and safe property management but this data needs to be handled carefully and sensitively and within the confines of the law.