GDPR for landlords – Part I Data protection must also be observed in the rental relationship

Collect and use only necessary data

In most cases, rental contracts are concluded for an indefinite period of time or leases with a term of several years are quite common, especially in the area of ​​residential rental. Against this background, it is understandable that landlords would like to obtain extensive information about potential tenants. In particular, information on the financial situation is often part of the query from the landlord in order to reduce financial risks from the tenancy.

However, landlords must not disregard the potential tenants’ right to informational self-determination. Therefore, with each requested information, it is important to pay attention to whether the knowledge is necessary for the landlord.

Note the voluntary nature of a declaration of consent

In the tenancy, too, as explained above, the necessity of data processing must be strictly observed. Especially with regard to the legal bases Art. 6 Para. 1 lit b GDPR (initiation and fulfillment of the lease) and Art. 6 Para. 1 lit. f GDPR (legitimate interest of the landlord) there are narrow limits here.

It could therefore make sense to base some data processing operations on the consent of the (potential) tenant under data protection law.

But caution is advised here. The voluntary consent of the person concerned is also important in the tenancy. Especially when applying for a rental apartment, this voluntariness can be disputed if tenants are urgently dependent on a rental apartment for personal reasons.

The obligation of Art. 13 and Art. 14 GDPR to inform the (potential) tenant about data processing also applies to landlords. It should be noted that, depending on the point in time, different information must be given to the persons concerned. E.g. In the context of the application for a rental property, different data may be processed than during the term of the rental agreement.

As already mentioned above, a lot of personal data is processed in the context of a tenancy. This also affects some particularly sensitive information, such as B. shows the credit check of potential tenants. This also has an impact on the security precautions to be taken for data processing in accordance with Art. 32. It is important to ensure that the security precautions are also appropriate in relation to the sensitivity of the data being processed.

A strict rights and role concept with regard to tenant data should be singled out here. This is the only way to ensure that only authorized persons can take note of the tenant data.

For more information, please also see Part II of the blog series “GDPR for landlords” soon.

Do you need competent advice on data protection and information security in your company? We are glad to be here for you. Simply contact us using our contact form, info@aigner-business-solutions.com or by phone on +49 (0) 8505 91927-0.