GDPR and Real Estate Companies
Most real estate companies also provide rental services : they search for tenants, get the paperwork done and in some cases make sure the rent is collected each month. In these cases the owner/landlord is the client of the real estate agent, and the tenant is a third party.
Still, the tenant has rights under GDPR!
A tenant filed a complaint before the Spanish DPA against a real estate company that had allegedly not provided the information required by GDPR when they formalised the first payment for an apartment, for which the tenant had provided personal data.
The Spanish DPA determined that the collection of data for entering a real estate contract entails processing of personal data. Therefore, the real estate company had the obligation to provide a compliant privacy policy to the tenant. However, they had not provided the tenant with such information. The real estate company only mentioned the old local Data Protection Act and did not inform about the rights that the data subject is entitled to under the GDPR. The DPA found that the real estate agent was in breach of GDPR and fined them 1.200 €.
Now what if you are the owner of the house and you rent it out yourself without the help of a real estate agent? Do you still have to comply with GDPR and provide the tenant with an accurate privacy policy and keep a GDPR register?
GDPR and “household exemption”
GDPR accepts the principle of the so-called “household exemption” : article 2 (2) (c) of the General Data Protection Regulation (GDPR) states that it does not apply to the processing of personal data “by a natural person in the course of a purely personal or household activity”.
It can be argued that renting out a house by a natural person is an activity that relates to the management of personal assets and is a personal activity. In that case the household exemption will apply.
At the same time, you need to be cautious! In order to fall within the scope of the household exemption there can be no connection to a professional or commercial activity. So as the size of your rental activity gets larger, so do your GDPR obligations.
GDPR and Real Estate
Simply put : if you rent out one apartment, you might be able to invoke the household exemption. If you rent out 10 apartments you are engaging in a professional and/or commercial activity and GDPR will apply.
In any case : it is better to be safe than sorry. When you only rent out 1 or 2 apartments, your GDPR effort will be minimal, so why not put in that little bit of work and get your GDPR in order. You can use our easy-to-use GPRWise compliance tool to get your privacy policy and register ready in no time.
