The General Data Protection Regulation legislation coming into effect in the UK on 25th May has undergone some subtle changes which may also affect the property sector.
Firstly, the definition of ‘personal data’ has been clarified by the authorities to suggest that it not only covers names, addresses and telephone numbers, but also IP addresses and other online identifiers. This could include free wifi provided to a building if IP addresses are included in the process.
Secondly, it was previously thought that GDPR particularly applied to ‘data controllers’ but it is now clear that ‘data processors’ are affected too - in other words, those individuals who process the data. This means property managers who record the details of all people living or working in a building could be affected by the GDPR.
The good news is that is looks as though an estate agent instructed to sell a property can process data relating to people looking to buy properties without expressly obtaining their consent. Most importantly, they might have a legitimate interest in processing the data, which is not outweighed by the individual's data rights.
However, it is important to note that consent is required for direct email and SMS marketing – unless a limited exemption applies. That limited exemption is where a business has collected personal contact details in the course of a sale of goods or services, it may send electronic marketing to that person for its same or similar goods or services. That is known as the 'soft opt-in’.
There is an additional myth surrounding the penalties related to GDPR which concerns the level of fines, which have been described as being as high as €20m. This is theoretically true but the Information Commissioner’s Office (the UK’s data regulator) has tried to dampen down that fear, and these could possibly be estimated at closer to £1m or £2m for really serious breaches.
The main thing to note is that nothing is certain but the team at Rickman Properties are going on a GDPR training course next week so that they are fully equipped for these changed to how we treat personal data well ahead of schedule… Watch this space for further news!