3

If Tim the tenant and Larry the landlord enter into a tenancy, then do either of them become a data controller of the others name and address? Does the landlord as the "provider" of the housing have greater burdens of propriety in handling tenants' personal data than vice versa? More broadly, do any two parties entering into mutual contract assume compliance burdens under the GDPR, and is the case especially so with respect to something so ubiquitous as tenancies?

Improve this question

1 Answer 1

Reset to default
3

Anyone who processes personal data using electronic means or with some filing system is a data controller, as long as

  • they fall within the GDPR's territorial scope,
  • they're not doing the processing on behalf of another data controller, and
  • they're not only doing the processing for purely personal or household purposes.

In todays world, it's almost certain that electronic means are involved. And establishing a rental contract generally involves some personal data. We can also assume that both parties are in the UK, and that both are acting on their own behalf.

So this leaves the household exception.

  • Larry the landlord will not be covered by the household exception since they're using the personal data for a business purpose. Larry is a data controller.
  • If Tim the tenant is renting a place to live in himself, he's probably acting for purely personal or household purposes and would not be a data controller.
  • If Tim the tenant is renting space for his office, for a church, or for a chessclub in which he is a member, he's no longer acting for purely personal or household means. Depending on context, Tim or Tim's organization may be a data controller.

The ICO's guidance on controllers and processors has a checklist “Are we a controller?” that lists common factors establishing controllership. On another page, they write:

Wherever personal data is used for purposes other than personal or household processing, the organisation behind it is a controller. Personal or household processing means the personal data you’d usually have in your home, such as family photo albums, friends’ addresses and notes on the fridge, none of which would be covered by data protection laws unless there was another connection to a professional or commercial activity.

Improve this answer
4
  • What if Larry the landlord is either: a) renting out his own house while he lives abroad (would this be personal or business purposes?) or: b) letting out a room in his own current home?
    – JosephCorrectEnglishPronouns
    Aug 7, 2022 at 22:37
  • What I mainly mean is if they aren't doing it as a professional business but rather letting out one investment property casually as an extra stream of income for the household does this exempt them from data controller status?
    – JosephCorrectEnglishPronouns
    Aug 7, 2022 at 22:58
  • 1
    @JosephP. There is no distinction made between a landlord who's doing it to earn a bit of money on the side, and one who's living off the proceeds - nor indeed is there a difference in terms of responsibilities between a landlord who is a person vs one who is a company (though there are minor tax differences). Their responsibilities are the same regardless, and so it's a business regardless.
    – Steve Melnikoff
    Aug 8, 2022 at 8:14
  • 1
    @JosephP. The question is if this is a “purely personal or household” activity. Precedent suggest that the word “purely” requires this exception to be interpreted narrowly. So I would expect neither of your examples to be covered by this exception. While the scope of the GDPR is often simplified as “it applies to businesses” that is not the criterion the GDPR itself uses.
    – amon
    Aug 8, 2022 at 9:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .