Data Protection

We often get asked whether and in what circumstances landlords, tenants, agents and contractors can give out each other’s details of and those of other third parties. The main concern is not to breach the Data Protection Act 1998. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure
• Not transferred to other countries without adequate protection

Unlawfully obtaining or accessing personal data is a criminal offence under s55 of the Date Protection Act 1998. Organisations processing personal information are required to register with the ICO. Failure to notify is a criminal offence. The ICO provides a checklist to organisations to check if they need to register. However lettings agents do generally process personal data ( e.g. tenants’ financial information) and if so should register.

There is a useful guide on the Information Commissioner’s website here.
Below is a list of the most common queries we get, and our answers
(with reasons).

1. Can an agent give out tenant referencing details to a landlord?
We say: Yes, the agent has collected the information as agent of the landlord, on behalf of the landlord. The Information Commission adds that the agent should make it clear to the tenants/guarantors that this will happen when the information is taken.

2. Can an agent give out landlord’s details to the tenant?
We say: It depends. If the tenant requests the landlord’s name and address in writing from the agent, section 1 of the Landlord and Tenant Act 1985 requires that the agent must supply the tenant with that information within 21 days of receipt. Criminal sanctions apply for failure to comply. There is a duty to disclose the name and address of all directors and company secretary to a corporate landlord. However where not required by statute, an agent should get the landlord’s permission before handing information to the tenant.

3. Can an agent/landlord give out tenant details to utility companies where there are unpaid bills?
We say: Yes the utility company may need the forwarding address of the former tenant to recover unpaid bills, or to return funds. The information commissioner adds that there should be a clause in the tenancy agreement setting out that this may happen.

4. Can landlords give former tenants details to enquiry agents/tracing agents in order to recover unpaid rent/ issue debt proceedings?
We say: yes – but again the ICO says it is good practice to notify the tenants in the tenancy agreement that this might happen.

5. Can landlords/agents give tenant’s details to guarantors?
We say: only to the extent that it relates to the guarantee. So you need to see whether the information you are passing on relates to the guarantee (e.g. it would probably be relevant to say there are rental arrears but not to notify the guarantor that the tenants have had a baby and the date of birth and name of that baby, for example).

6. Can landlords/agents give tenant’s information to the Local Authority/ Police?
We say: again, it depends. Local Authorities do have powers to request personal information, and so do the Police. However they should be able to provide authority – to demonstrate that they have authority to ask, and that a landlord/agent has the duty to disclose.

7. If the tenant requests to see the tenancy file, does the agent have to disclose the entire file?
We say: No. The tenant should make a subject access request. The file belongs to the landlord. You do not have to supply information about other people. The agent should send a redacted copy and even then only needs to provide personal information. This does not mean the agent’s management log for example.

What are the sanctions for breaching the Data Protection Act? The Information Commission can order the offender to stop the breach. For serious breaches monetary penalties can be given and criminal prosecutions brought. See here: http://www.ico.org.uk/enforcement/prosecutions

In general the best place to go for those concerned about Data Protection is the ICO website. They have useful guides and checklists, as well as news and updates.