GDPR and renting out a flat

The General Data Protection Regulation (GDPR, known in Poland as RODO) came into force on 25 May 2018 and applies to practically everyone. In view of the rules now in force, a person renting out a flat may wonder – does this concern me? In today's post we outline how the EU rules have changed the situation for owners letting their properties.

• WHO IS SUBJECT TO THE GDPR?
• GDPR OBLIGATIONS FOR LANDLORDS
• APPLYING THE GDPR TO FLAT RENTAL AGREEMENTS

Who is subject to the GDPR?

The text of the regulation clearly states that its provisions apply to practically all kinds of business activity in which we process clients' personal data in any way. The definition in Article 4 of the GDPR sets out clearly what is meant by the word "processing":

"processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

As landlords, we therefore come into contact with the data of the person renting the property from us, and we always process it in some way. However, the GDPR states that its provisions do not apply if the entity processing the data is a natural person and does so in the course of a purely personal or household activity.
What does this mean for landlords? Well, if we run a business – we must meet the requirements set out in the GDPR. We are, to a degree, "exempt" from this obligation if we do not run a business and process personal data as part of activities of a purely personal nature.

FLATS IN KATOWICE LIGOTA – CHECK THE LISTINGS

GDPR obligations for landlords

Failing to meet the obligations arising from the regulation can have very severe consequences (including financial penalties). It is the landlord who must demonstrate to the authority that they have grounds for processing data, such as the need to issue an invoice, draw up an agreement or settle accounts.

Under the regulation, we must take care of the confidentiality and correctness of data processing. If we have a website on whose server we store client data, we must obtain consent from each client for such processing of their data. The property owner is obliged to select trustworthy entities to process clients' data. Hosting or accounting firms that have access to clients' data should be chosen on the basis of trust and compliance with data storage standards.

A landlord should also state the purpose of storing the data (settling invoices, sending new offers, etc.), what data is processed and to what extent, and what rights the client has. This information may be provided in a document attached to the tenancy agreement or as a clause forming part of it.

Tenant's rights:

• the right to information about the processing of their data,
• the right of access to their data,
• the right to rectification of incorrect data,
• the right to transfer data to another controller (an entity processing data),
• the right to object to the processing of data for direct marketing purposes (including profiling, newsletter correspondence, etc.),
• the right to be forgotten (erasure of data – a contact channel for this purpose must be indicated).

READ ALSO – RENTING OUT A FLAT AND THE RESIDENCE REGISTRATION OBLIGATION

Applying the GDPR to flat rental agreements

The GDPR is a very complex subject, and we should analyse its principles carefully and then adapt them to the specifics of our business. It is not enough to put a notice on our website. We need to analyse our activity and, on the basis of what we learn, adapt the way personal data is processed so that it meets the conditions set by the European Union.

Remember also to inform your clients clearly which data is processed and what rights they have. Also make use of the advice of the professional estate agency REMAX Gold. Our specialists will help you organise your knowledge and introduce the necessary elements required by the GDPR.