GDPR confusion and misinformation

Reply to the comment left by Mick Roberts at 15/05/2018 - 06:28This Article from ICO website tells us that we can tame our own Privacy Policy to suit our type of business, blend it with different choices to form a best suited privacy statement or policy.
There isn't a single comprehensive policy that can cover everyone's needs and requirements as we are all different and operate in a different way and circumstances, e.g. not all landlords are Licensed, and most operate on one to one bases with their tenants, so they don't normally have to share sensitive data with anyone unless problems arises with tenants when their behaviour changes, they stop complying with the terms of your Tenancy agreement, stop paying you rent, so now you will of course have to exchange their details with lawyers and solicitors and so on.
The document clearly says that you need to use a very plain simple to understand language, and keeping it as short as possible as no one has the time to read lengthy policy terms.
even if you just make a start and and show that you made an effort and you are still compiling the best solution for your own privacy document, no one is going to hang you, I mean how the hell can they fine any individual landlord £20,000,000.00, and of course to even suggest that they can impose such fines, then for a start they must be down right stupid and crazy! I will have to sell my arse for the next 50 years to pay a fine of £20,000,000.00, the world we live in is getting stupid day by day, common sense is evaporating so fast.

Sorry I forgot to put ther link to the guide how to start forming your own Policy document:
Reply to the comment left by Mike at 15/05/2018 - 10:45https://ico.org.uk/for-organisations/guide-to-data-protection/privacy-notices-transparency-and-control/

Reply to the comment left by Mike at 15/05/2018 - 10:45
Well said Mike!

I agree, the policy documents etc need to be tailored to suit your own individual landlording situation, so any template can only be a sample, something that will need to be amended to suit your own business, but even the one property one tenant scenario has many possible interactions of personal data.

I agree, the whole GDPR requirements are stupid and crazy when applied to smaller businesses (landlords or otherwise), but we are being required to comply with them. It is indeed a crazy world.

All you can do is CYA and hope for the best.

For me
- Register with ICO
- Move email onshore (hostinguk.net labours the point 🙂 ).
- including restoring historic data to a live system so I can delete it!
- Delete cloud backups on gdrive and onedrive.
- Join RLA
- fill in audit for each property
- fill in privacy notice for each property
- serve on each existing tenant.

Document the above.

I think that amounts to due diligence, others may need to do more, I had looked at ICO information a few years ago, so already had data encrypted locally, in flight and at backup (hint veracrypt and backblaze).

Done until the first SAR!

Reply to the comment left by Mike at 15/05/2018 - 10:45
Very well said.

this is what I think best suits me, as my own privacy policy, there may be a few things that I cannot put in as they may contravene tenants rights, but if those items are pointed out to me by ICO or others, i may amend my privacy document to comply legality

Mark Alexander can delete this post if he finds it is not appropriate.

MY DATA PROTECTION AND GDPR COMPLIANCE PRIVICY POLICY
Dear Tenant
Under the new EU rules on Data Protection, known as General Data Protection Requirement) or for short GDPR, this new legislation comes into force on 25th May 2018. That means any Landlord who holds personal data on his Tenant must now register with the Information Commissioners’ Office (ICO) and strictly follow proper and recommended procedures to protect your personal data and other sensitive information held by your Landlord (known as data Controller) and you are known as the “subject. “
Therefore as being your landlord I am also your data controller, my Name_
My Address_Telephone Contact__
I am therefore now fully compliant with GDPR legislation and I have also registered my name and address with the ICO, as a data controller as required by law.
My objectives are to fully comply with this new GDPR legislation. If you need in depth information regarding GDPR and about your personal data being held by anyone or any organisations, please visit ICO website at
http://www.ico.org.uk and you will find in depth details of all about GDPR that you need to know.

As a responsible landlord, I hold your personal data or information, such as a copy of your passport (to determine your right to live in UK, under right to rent check. Your latest bank statements (to confirm your previous address and your income being paid directly into your bank account, conversely your ability to pay your rent on a regular bases) Your employment status & your employers reference (to determine your employment stability, conversely your ability to afford and pay rent regularly. Your previous tenancy agreements and a reference from your previous landlord. (to determine your past conduct & suitability as a responsible tenant) or any other information on you that I may request from you as a landlord or that you may have provided voluntarily.

It will be my duty under GDPR to protect all your personal data or information to the best of my ability and as recommended by GDPR recommendation, and not to allow it to fall into wrong hands or exchange it with anyone not authorised by law to receive it. Therefore you are rest assured that I intend to fully comply with GDPR requirements and meet all my obligations under this new legislation and protect your personal information from falling into wrong hands.
ICO website will explain you in full details what rights you have as a subject and what my obligations are as a data controller, and what happens if I breach conditions set out under GDPR, and what action you can take if you discover that I have breached your personal data security.
Any Information held on you will not be given to anyone not authorised by law to receive it or without your prior written consent. However I may not need your consent to share your personal information with the following bodies if they make a request for it:
1. Police and other law Enforcement Authorities
2. Benefit fraud investigation agencies
3. Utility companies whom you may still be owing money for unpaid utility bills
4. Electoral register enquiry
5. Banks and credit card companies investigating fraud.
6. Hire Purchase and other money lenders chasing debts and debt collectors.
7. Any other companies you owe money to and tracing your ware abouts
8. Local Council requesting your personal information
9. Notify Home Office if you had limited rights to stay in UK and your right to stay has expired
10. Your next of kin in case of any medical emergencies
11. Courts or bailiffs
12. TV licensing authorities
13. My Mortgage lender
14. My Insurance provider
15. Any builders or workers carrying out maintenance or repairs authorised by me
16. Any one legally entitled to receive it.
17. My right as a landlord to pass your details to law enforcement agencies or solicitors if I am to serve you any notices or to file court cases against you for non-payment of rent or other breaches of tenancy agreement.
18. My tax advisors for accountancy and tax purposes
I must not share your information with anyone else who does not have a right to your information.
I will only provide your references to those whom you have given your written consent for example when you may move to another accommodation and your new landlord requires from you a reference. Or if anyone else requires it for your benefit, I will only provide it with your written consent.
I must not hold back any information from being given out if requested by those who are legally entitled to receive it by law as holding it back or not cooperating with the authorities may go against me, and I may well be committing an offence by withholding your personal information.

You may also exercise your rights to know what information I hold on you, you can request this and I must provide you full details of all the information I hold on you, including any conduct and behavioural reports or general notes on you or your visitors, saved on my filing system whilst you are or were being my tenant.
I will hold your personal data for as long as I am allowed by GDPR regulations, or by law, after which your personal data shall be destroyed as required by GDPR legislation using appropriate means such as shredding or incinerating or deleting your computer files. Your data or information will not be simply put in trash bins for disposal as it could come into the wrong hands.
You are rest assured that I will take all the necessary steps to highly safeguard your personal information that
I hold on you as part of my obligation as a landlord and to comply with latest rules on various Housing Acts,
Selective or Additional Licensing Conditions and GDPR and not to allow it to be shared with anyone not entitled to receive it or without your signed consent.

As a licensed Landlord under the Selective or Additional License scheme, I am also obliged to keep your personal information for a certain amount of time safely even after you have moved out and your tenancy has come to an end, Please sign below that you understand my GDRP privacy policy, and that you give me your consent to hold this information on my files and on my computers, and I can only share it with those bodies that I have mentioned above without your further consent.
Any other organisations that are not legally authorised by law to obtain your information will not be given your personal information without your written consent. All your personal information will be destroyed and removed from my computers once it is no longer needed and I am no longer allowed to keep it on my filing system, so that it does not come into any unauthorised access.
I, the tenant (subject) hereby agree and consent to the above privacy policy document.
Signature….Date…
Your full Name……
Current Address…

Reply to the comment left by Mike at 15/05/2018 - 23:07Not bad for a first attempt, but you need to try harder.
For instance:
"Therefore as being your landlord I am also your data controller"
is incorrect.
You are not their data controller, you are data controller for your lettings business, and as such you hold personal data about them.

You also do not want their consent, you want them to confirm that they have received a copy.

Reply to the comment left by Michael Barnes at 16/05/2018 - 00:12Micheal, many thanks for pointing out this error. Original corrected now.
But for those landlords who own one to a few properties, privacy notice does not need be too complicated other than a few simple English statements.

Similar to tenancy agreement, this takes two A4 pages. It explains to tenants in simplest language they can understand without legal jargon. not that they would care much for GDPR.

GDPR from a different perspective.
Landlords have to supply tenants with their name and address, this is information by which a person could be identified. Surely the tenants have an obligation under GDPR to keep this information secure and as such each tenant should have a privacy policy?

Reply to the comment left by David Price at 16/05/2018 - 08:17
Interesting idea David, but the ICO website states:
"The GDPR does not apply to certain activities including processing covered by the Law Enforcement Directive, processing for national security purposes and processing carried out by individuals purely for personal/household activities."
so in view of this I don't think the GDPR applies to tenants.

It does however apply to Councils, contractors, letting agents, DWP, and virtually all suppliers of goods and services, HMRC Tax Office, to name but a few.