Landlords and their agents should not seek photographs and PPS numbers from prospective tenants in advance of a lease being signed, the Data Protection Commission has warned.
The commission said the collection of photo identities in the lettings process prior to a lease being agreed was raised as a concern by a number of individuals contacting the office.
The issue is among many raised in the annual report of the Data Protection Commissioner from January 1st to May 24th, the date on which the office ceased to exist ahead of the EU general data protection regulation and new Irish legislation taking effect on May 25th.
The new Data Protection Commission (DPC) came into being on May 25th.
LinkedIn processed 18 million email addresses of non-users for targeted advertising
Rights of direct provision resident breached after CCTV footage allegedly disclosed to radio station
CSO ‘continues to explore’ plan to use phone data for tourism statistics
Facebook lodges appeal against £500,000 Cambridge Analytica fine
“The DPC can see no basis for requiring photo identity at application stage (pre-tenancy) in the absence of any legitimate business reason requiring same,” it said.
It considered, however, that landlords and lettings agents “may cite legitimate reasons for requesting and retaining the photo identity of a tenant renting their property, once the contract is signed”.
The commission added that landlords, or their agents, should not seek PPS numbers during the initial phase of the lettings process and should only do so when the lease was being agreed.
‘Confidential’
It said there was a statutory basis for a landlord or lettings agent to use the PPS numbers of tenants only for the purposes of registration with the Private Residential Tenancies Board.
“No other use should be made of the PPSNs and they must be kept confidential.”
The commission also said it considered it “reasonable for a landlord or letting agent to request supporting documentation to confirm a prospective tenant’s capacity to pay rent”.
With regard to the provision of bank statements, it said removing the narrative of statements and providing running balances on an account was sufficient to demonstrate a tenant’s capacity to pay rent.
“Requests for details in relation to employment/salary may also be reasonable to confirm capacity to pay rent. However, requesting the bank details of a prospective tenant for the purpose of lodging the rent payment, or putting utility bills into the tenant’s name, prior to a lease being agreed, is a practice of concern from a data protection perspective.”
The DPC advised that the personal data of all unsuccessful applicants for rental properties “should be disposed of securely”.
Shredded
Manual application forms should be shredded shortly after the letting had closed, such as on a weekly basis.
“In respect of email or online applications, these should be permanently deleted shortly after the letting has been closed.”
The commission said that in relation to successful applicants who become tenants, it was “cognisant that personal data submitted in connection with their application is required to be held for the duration of the tenancy”.
“It is recommended that a retention period is drawn up by landlords/lettings agents to ensure personal data in relation to a tenancy is disposed of in a secure manner after a specified time period once a tenancy has ceased.”