Required Outcome 1.3 of the Safety and Quality Standard requires registered providers (RPs), when acting as landlords, to take all reasonable steps to ensure the health and safety of tenants in their homes. This can sometimes require personal data to be shared between landlords and contractors, with contractors often being more likely to witness first hand when tenants require additional support. Landlords and contractors are often concerned about the intersection of this data sharing and tenant privacy, but there are a number of ways to stay compliant while gathering and sharing data to ensure tenant safety.
Top tips for sharing personal data
1. Ensure you have a lawful basis for sharing personal data.
Landlords and contractors must have a lawful basis for sharing personal data under Article 6 of the UK GDPR. Sharing data can usually be justified where it is necessary for the legitimate interests of the landlord, and this basis will negate the need to obtain the tenant's consent to the data sharing. The caveat to that relates to the sharing of special category data such as health data. To share special category data, explicit consent from the tenant may be required. This consent must be confirmed in a clear statement (whether made orally or written) and clearly specify the nature of the special category data being shared. Where there is a safeguarding risk, special category data can be shared without consent.
2. Make sure you have an appropriate data sharing agreement in place.
Data sharing agreements between landlords and third parties (such as contractors) should set out the purpose of any data sharing, what will happen to the data at each stage and each parties' role in the sharing of data. Having an appropriate data sharing agreement in place helps to justify any data sharing required and demonstrate that landlords have been mindful of, and have documented, relevant compliance issues.
3. Be transparent about what you are doing with your tenants' personal data in your privacy notice.
Privacy notices should set out why you are sharing personal data, who you may share personal data with, your lawful basis for sharing data and how long you will hold tenant's personal data before disposing of it securely. Privacy notices should also provide information about tenants' rights regarding their personal data, such as their right to access their data, correct their data, or ask for their data to be deleted. Landlords should ensure that this information is provided in a way that is easy for your tenants to find and understand.
4. Practice good records management.
Be sure to maintain an accurate record of the personal data that has been shared, relevant retention schedules and a description of the organisational security measures in place to protect your tenants' personal data.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
