Why Data Protection Legislation Is Failing Private Tenants – Part 1

Data protection private tenants

On 25 May 2022, the General Data Protection Regulation (GDPR) will have been in force for three years. Whilst significant fines for breaching the GDPR have been issued in the UK and the EU, when it comes to the protection of tenants, particularly those who rent from a private landlord (or through letting agents), data protection legislation is failing to increase access to justice and in some cases acts as a hindrance.

In this, the first of three articles, we will outline data protection law and how it should work in terms of providing tenants and their legal representatives with access to the data they need to bring a claim for disrepair and/or a statutory breach. We will then discuss why data protection law is failing tenants, particularly concerning Subject Access Requests (SARs). Part two will examine how overseas jurisdictions are dealing with similar challenges and outline an argument for change. Finally, in part three, we will set out how Veriwise is using its legal knowledge to disrupt the status quo and bring about legislative and regulatory change.

What is the UK GDPR ?

The three main objectives governing the background and text of the UK GDPR are:

i. establish and protect the data protection and privacy rights of people

ii. harmonising privacy laws across the EU/EEA (before 11pm on 31 December 2020 the UK was an EU member state).

iii. ensure privacy and data protection legislation is broad enough to be effective with early 21st-century technology

There are six GDPR principles listed under Article 5(1) which states that personal data must be processed:

• lawfully, fairly, and in a transparent manner

• for specified, explicit, and legitimate purposes only

• in a manner that is adequate, relevant, and limited to what is necessary

• accurately and where required, kept up-to-date

• regarding storage, data should only be kept as long as necessary

• in a way that protects it from unlawful or unauthorised processing, loss, damage, or destruction

Under Article 5(2) controllers and processors must also demonstrate accountability when it comes to complying with the principles set out in Article 5(1). This involves actions such as keeping accurate records, implementing a ‘data protection by design and default’ approach, and carrying out data protection impact assessments in situations where the use of personal data could compromise the interests of data subjects.

Article 15 of the UK GDPR provides that data subjects have the right to access and receive a copy of their personal data. SARs can be received verbally, on paper, or electronically and must be complied with one month after receipt. In most cases, no fee can be charged.

Unfortunately, in far too many cases, private landlords are ignoring SARs from tenants.

Why are private landlords/letting agents refusing to comply with SARs?

When tenants come to Veriwise seeking legal advice on a matter such as disrepair or a health and safety concern, we always seek to look deeper into the tenancy and in most cases we subsequently uncover a statutory breach by the landlord/letting agent. The breach could be related to a wide range of issues, such as not putting the tenant’s deposit in an approved government-backed scheme, failing to carry out gas safety checks, and/or not providing a copy of the certificate to the tenant(s) before the start of the tenancy.

Letting agents and landlords sometimes argue that they have provided the information required under the pre-action protocol letter. Greater information regarding the tenancy, however, is normally present within what must be disclosed via a SAR. Therefore, tenants must have access to this data – which under the UK GDPR they are fully entitled to. Problems occur, however, when elements related to the tenancy do not fall under the definition of ‘personal data’. Personal data is defined as data that relates to an identified or identifiable person. Let us look at the example of a Gas Safety Certificate. This must include the landlord or letting agent’s name and address and the address of the property being checked. It does not require the tenant’s name. Therefore, it can be argued that this is not personal data so does not fall under the information which must be provided under a SAR. This can be contrasted with a Right to Rent check, which will include the tenant’s name and details of identifying documents such as their passport number. Documents related to a Right to Rent check are therefore encapsulated by the definition of personal data and must be included in a SAR.

Personal data concerning the information relating to a tenancy is a grey area. It could be argued that because the address of the property is included in a gas safety certificate, the document contains data that is identifiable in relation to the tenant and therefore must be included in a SAR response. Landlords and letting agents often present a counter-argument to this, stating that the tenant should have received a copy of the gas safety document (or other documents related to the tenancy) and it is not the letting agent/landlord’s responsibility if these documents have been misplaced. Unfortunately, many tenants, especially those who rent sub-standard properties, do not understand the importance of retaining tenancy-related documents. Furthermore, many people rent properties long term and their original tenancy documents become lost or discarded.

Wrapping up

This brief overview highlights an overlooked problem in terms of tenants, especially those renting from a private landlord, obtaining access to justice concerning disrepair and breaches of landlords’ statutory duties. Concerning commercial letting agents, it is important to mention that they should be registered with the ICO as they fall under the definition of data processors. Therefore, letting agents should be scrupulous about complying with SARs. Unfortunately, many are simply failing their data protection duties and responsibilities.

Given that the EU and certain US States, particularly California, also have strict data protection laws, it is useful to examine the extent of similar problems in these jurisdictions and how they are being managed. This will be the focus of our next article.

Veriwise helps all tenants get access to justice. If you have an issue with your rented property and your landlord is refusing to fix the problem or is ignoring you, please contact us at contact@veriwise.co.uk and we will resolve the issue directly with your landlord/agent so you don’t have to.