Agents urged to prepare for introduction of new data protection legislation

It might not be something you’ve given much consideration to, but new data protection legislation is coming into effect from next year that will have a significant bearing on your estate or letting agency business. As such, you need to be aware of what exactly is being introduced and what your rights, responsibilities and obligations are.

There are, however, concerns that the new legislation is largely unheard of in the industry.

So what is actually being brought in? The General Data Protection Regulation (or GDPR) will replace the Data Protection Act 1998 when it comes into force in May 2018. It will apply to any organisation handling personal data – which, of course, is something that concerns estate and letting agents more than most.

The main ambition of the GDPR is to protect individuals and organisations against data breaches. To do this, it will try and ensure there are no weak spots or vulnerability in data management which could be left open to exploitation by hackers or internal organisation abuse. The law will apply to all countries in the EU and, as it will come into effect in only 10 months’ time, it will not be affected by Brexit. In May 2018 Britain will still be part of the EU as it continues negotiations with Brussels over its exit.

Given the significant volume of data held by agencies, property companies and trade bodies, a leading expert has urged agents across the industry to act urgently to ensure data is being protected adequately.

Kristina Russell, who works for document and information management specialist Kefron, said: “This data is used in a number of ways which all need protecting - one example is CRM. As an industry that relies on CRM data for sales and marketing you need to be aware that GDPR means that you have to inform and seek permission from the ‘data subjects’”.

In other words, existing or prospective clients will need to give full consent for their information to be held and used. Those who process information in the CRM system will need to be given full training to ensure that they, and the company in question, are being fully compliant.

If you outsource your marketing to a PR agency or company, and you pass on personal data to said companies, you also need to be aware that data processors will now be regulated under the GDPR as well. As a result, the marketing or PR agency will be required to have an official written contract to make sure they are fully GDPR compliant or you risk being in breach of the new legislation when it comes into force.

In February 2016, a warning was given to the estate agent industry by the Information Commissioner’s Office (ICO), the official data protection watchdog, after a number of visits to estate and letting agents’ offices set alarm bells ringing.

The ICO’s findings at the time suggested that estate and letting agents often had little formal training in data protection. In addition, the watchdog found that sellers, landlords and tenants were not always being informed about how their personal information would be used and that customer data was often being kept for longer than necessary. Lastly, it was also revealed that there was a lack of awareness about the importance of using technical security measures such as encryption and that paper records containing personal data were often not kept securely enough.

With next May’s legislation redefining what exactly constitutes personal data (or Personal Identifiable Information), it’s more important than ever that agents are fully up to speed. Once the new legislation has been enforced, personal information won’t merely include telephone numbers and email addresses, it will also include “online identifiers” such as IP addresses, cookies and tags. Consequently, businesses will need to make sure that data is being protected across many levels.

The new legislation will also allow customers the “right to be forgotten”, which is something that is particularly relevant to letting agents. Once a tenancy contract ends, the information included in it should be purged unless it is needed for further processing. To ensure there is no data misuse, the info will need to be securely and carefully got rid of.

Under the GDPR law, any company that is found to have processed data unlawfully will be at risk of compensation claims from those individuals whose details were involved. Furthermore, companies that are not GDPR-ready by May face being hit with a fine of up to 4% of global yearly turnover. Meanwhile, if a breach occurs and an estate or letting agency neglects to inform the ICO within 72 hours, it would face a fine of 2% of global annual turnover.

As things stand, the ICO can only fine businesses up to a maximum of £500,000. Once GDPR has been introduced, however, this will change significantly, with risk mitigation firm NCC Group suggesting that under GDPR law the ICO’s total fines of £880,500 in 2016 could soar to £69 million.

In preparation for the new legislation, there are a number of measures agencies can take to ensure full compliance. This includes creating a personal data inventory, obtaining appropriate consents, implementing appropriate privacy notices, using privacy impact assessments, creating a breach reporting mechanism which can report any breaches within the 72 hours timeframe, and using appropriate organisation and technical measures to ensure compliance with the data protection principles.

As an agency owner, you will need to ensure you are fully compliant – or risk fines being levied on you – by 25 May 2018. That still leaves you plenty of time to get your house in order, assuming it isn’t already, with advice and support out there from specialist data companies and the likes of the ICO – which offers a thorough overview of GDPR, who it applies to and how organisations can be fully compliant on its website.

What helps, of course, is if the rest of your business is already functioning flawlessly, with streamlined processes and everything from your marketing strategy to your staff management working in complete harmony.

Luckily, our all-in-one, cloud-based property software provides exactly that, enabling you to manage your staff, office, customers and multi-channel marketing in one place, from anywhere in the world.

If that wasn’t enough, we also provide an innovative, contemporary website design service, creating websites that look beautiful and work beautifully.

If you want to keep on top of your diary and call-backs and keep your customers informed, engaged and protected at all times, look no further than Gnomen.

For more information about what we do, please get in touch with us on 0208 123 9019 or book a free demo here.

Share this article

Montana H

Business Development Director