The Information Commissioner’s Office (ICO) recent report highlights a general lack of awareness of data protection issues within the property industry.
Following visits to residential sales and lettings agents, the ICO has published a report highlighting concerns over the way in which agents are handling their customers’ personal information. Specifically, the ICO visits (in conjunction with an online survey completed by lettings and sales organisations) were undertaken to analyse compliance with the terms of the Data Protection Act 1998 (DPA 1998) in the course of sales and lettings businesses processing personal information.
The ICO’s report highlighted a lack of awareness and training generally in relation to obligations under DPA 1998. It found that there were few formal procedures for complying with obligations under DPA 1998, and in many organisations staff had little training on data protection.
Additionally, there was also a perceived lack of awareness regarding IT systems containing personal data (including security controls such as encryption), as well as in relation to the processing of manual records containing personal data. The ICO highlighted that customers were not informed of policies relating to the storage and process of their personal information, and that often information was kept for longer than is required.
In light of the ICO’s findings, users of residential lettings and estate agents should consider the type of information they are being asked to provide, and may wish to query why certain pieces of information are required and seek clarification as to how the information will be processed and stored. Customers may wish to ask what their agent’s policies are in relation to the use and retention of personal information, including whether some of their agent’s functions – such as referencing – are to be carried out by third parties (and, in turn, what information will be handed over to those third parties, and for what purpose). Similarly, customers should ensure that their agent seek prior permission to use/share their personal information with third parties.