BAILII is celebrating 24 years of free online access to the law! Would you consider making a contribution?
No donation is too small. If every visitor before 31 December gives just £1, it will have a significant impact on BAILII's ability to continue providing free access to the law.
Thank you very much for your support!

In April 2013 we received a complaint from a tenant of an apartment complex who stated that the management company of the complex was in the process of introducing a new key pad access system to resolve serious security issues in the complex. The complainant stated that he considered that the management company was requesting excessive information in order for tenants to have access to this new system. The complainant supplied us with a copy of a letter which had been issued by the management company. The information sought in order to access the new system included a copy of passport/driving licence, PPS Number, emergency contact details, vehicle details, employment details and a copy of a current lease/tenancy agreement.

 

We contacted the management company asking that it outline the legal basis for the requesting of this level of personal information. In response, the management company explained that the complex was fully tenanted with no owner occupiers. It asserted that the request for the information was based on the fact that it had found in the past that information supplied by landlords did not always tally with who was actually living in the complex. We stressed to the company that any personal information sought should be adequate, relevant and not excessive in relation to the purpose for which it was obtained and held. We said that we considered that the level of personal information being sought was excessive in relation to the introduction of a new access system to an apartment complex.

 

In response to our intervention the management company drafted a revised letter for issue to the tenants of the complex and it submitted it to us for consideration. This letter limited the personal data sought to emergency contact details, vehicle details and a copy of a current lease/tenancy agreement.

 

We informed the management company that we considered the information now requested to be fair and reasonable for the purpose for which it was sought. However, we informed it that, as a data controller, it has obligations in relation to the processing of the information such as ensuring that all personal information collected be kept safe and secure, not be disclosed to a third party and that arrangements be put in place to have all personal data deleted when a tenant moved out of the complex. In addition, we stated that tenants should be informed that they could redact the rent amount from the copy of the lease/tenancy agreement submitted to the management company. The management company confirmed that it would comply with these obligations.

 

The complainant subsequently notified us that the management company had issued the revised letter to tenants. As a result of this complaint to the Office, the management company significantly reduced the amount of personal information it required from tenants in order to register for the new access system.

 

The Data Protection Acts require that an appropriate balance be struck between the privacy considerations of the service user, in this case the apartment tenants, and the legitimate interests of a data controller to protect its business, in this case the management company. We considered that the revised letter issued to tenants by the management company struck the appropriate balance in this case.