Loading Guild Resources
Loading Guild Resources
Loading Guild Resources
A data security crackdown has started on landlords who collect, store and use the personal information of tenants without registering with the data protection watchdog. Warning letters are winging their way to thousands of property letting businesses.
The letters urge every property rental business processing personal information to pay a data protection fee unless exempt. Most businesses pay £55 a year, discounted to £35 for landlords setting up a direct debit.
The UK has an estimated 2.5 million landlords renting out 4.5 million homes. However, few are aware that they must register with the Information Commissioner's Office (ICO) even if the only data collected is CCTV for crime prevention.
The ICO letters encourage landlords holding, storing or processing tenant data to register with the watchdog. For example, landlords must pay a data protection fee if they process personal data to produce tenancy agreements or contracts, perform credit checks on prospective tenants or obtain references. If landlords do not register and pay the fee, they risk tenants complaining about the misuse of their data, resulting in an investigation and penalties from the ICO.
Suppose a letting agent manages property for a landlord and carries out data protection processing activities, like sending out a monthly statement and paying rent. In that case, the accounts and records exemption may apply. This exemption covers personal data processed in electronic formats to provide invoicing and accounts.
Use this easy self-assessment link to find out if you need to register and find out your fee level.
Before deciding whether to pay the ICO fee, it’s a good idea to conduct a general data protection audit to determine whether you process personal information when dealing with tenants.
Asking for, storing and using information during trading as a landlord is processing data. Landlords need to register with ICO if they keep information about tenants like:
A landlord must show one of three interests to process data lawfully:
Landlords need not register with ICO if they process personal data for:
The ICO can impose huge fines on businesses that fail to register and pay the yearly fee. The maximum the ICO can fine an offending business is £17.5 million, or 4 percent of its total annual global turnover. This penalty level is for the most severe data breaches and wrongdoings.
A ‘standard maximum’ applies to less serious offences but still is a hefty £8.7 million maximum or 2 per cent of global turnover. Property rental businesses can expect much lower fines, but lawyers report ICO issuing fines to landlords of up to £4,350.
Landlords can confirm registration with ICO by following the online self-assessment pages.
ICO stands for the Information Commissioner's Office, the British government agency tasked with regulating data protection.
Every landlord flagged as processing personal data should register with ICO regardless of their trading status. The law covers companies, charities, not-for-profits, partnerships, and sole traders.
Whether you should register depends on who processes tenant data. Landlords simply receiving a monthly rental statement and payment from a letting agent do not need to register as the letting agent handles the data processing. If the letting agent only finds a tenant, the landlord should register if drafting a tenancy agreement and arranging deposit protection.
No. The responsibility to register for data protection lies with the landlord and not the ICO requesting a property business to sign up.