Social Housing Speed Read – the GDPR

What is GDPR?

The GDPR will come into force throughout the EU from May 2018, and will replace the UK’s Data Protection Act.

The Information Commissioner’s Office (ICO) guidance on the GDPR, which includes an overview available online, explains that whilst the principles regarding information sharing are similar to those of the Data Protection Act there are new requirements, too.

One new requirement is that of “accountability” – requiring organisations to show the way in which they are complying with data protection principles.

What’s the guidance on consent?

We are all asked, very often, whether we consent to the sharing of our personal information with third parties. For this reason, you would be forgiven for thinking that the issue of consenting to information sharing was straightforward; however the GDPR is somewhat more complex.

The key consent principles in the GDPR will include:

• Building customer trust and engagement;
• Making sure that the consents you ask individuals for match your consent practices;
• Offering individuals “genuine choice and control”;
• Making statements of consent very clear and specific;
• Being “granular” in the consent you’re asking for – a “blanket” consent under a generic statement isn’t good enough;
• Naming the third parties who will rely on the consent;
• Allowing people to withdraw their consent; and
• Keeping consent practices under review.

Emphasis of the principles is clear enough – manage personal information responsibility, make clear requests for what you require and offer people a genuine choice over whether to actually give their consent.

A further aim of the GDPR is to prompt a cultural shift in the way that consent to sharing information is given.

Consent should be separate from main terms and conditions, and it should require “clear affirmative action” from the individual giving it.

Consent should only be asked for if there’s a “genuine choice” – if you are likely to process the personal data anyway, then there might well be a more appropriate, lawful alternative basis to do this.

How might this affect the social housing sector?

The Consultation recognises that gaining consent to data processing isn’t always appropriate, and that public authorities and employers will, by virtue of holding positions of power, face challenges when those who depend on the service or employment have little choice but to agree to have their data processed.

A practical example used in the Consultation paper is a housing association which makes consent to a criminal records check a prerequisite to granting a tenancy.

Could such consent be freely given? It is likely that a tenant in need of social housing will be prepared to sign anything put in front of them.

A better course of action would be to rely on an alternative document to provide that consent, (perhaps outside of the tenancy agreement itself) where the data processing can be shown to be necessary for entering into a contract with an individual.

The GDPR will set a new, and higher standard for data sharing in the UK, and will come into direct effect next year without requiring Parliament to pass a new Act. Whilst Brexit is on-going, this new approach to data protection will become a reality.

At this stage the social housing sector needs to be aware of the changes, may want to respond to the consultation and it might be timely to start reviewing documentation, and whether your processes will comply with the new regime.

Ward Hadaway have specialist Data Protection experts, who have provided training and guidance to the Social Housing sector. We can provide affordable and practical guidance, to help you get things right, first time.

If you have any questions on the above and how it will affect social housing providers, or any other questions as a social housing provider, please do not hesitate to contact John Murray or a member of our expert Social Housing Team.