The right to erasure

It goes without saying that a good database is essential for estate agency, as is keeping in touch with past customers or those who have made enquiries to your business; however, The Guild of Property Professionals Compliance Officer, Paul Offley, has been reminding their network on some important points to consider and especially about ‘Erasure’. 

A buyer, seller, landlord or tenant may think that once they have completed the relevant transaction with an estate or letting agent, their business with the agency has concluded and they no longer have ties with them. Therefore, they may be surprised to receive communication from the agent several months, or potentially years later and wonder why. 

“Important to remember that data protection laws put the ownership of data with the data subject, so they must dictate how you can use their data. They have a right to know what you are going to do with their data, and how long you are going to retain their data, amongst other data information rights,” Offley comments. 

He adds that it is therefore important that an agent’s privacy policy sets out some key aspects, such as how long they wish to retain data. If the agent wishes to retain the information over the long term, then this should be stated. The agent should inform the client of their intention and include a brief statement along the lines: ‘we would like to keep in contact with you from time to time on property related matters and services, which we believe may be of interest to you, however if you no longer wish to hear from us then please let us know.’

Offley emphasises that it is vital that agents are always able to demonstrate a lawful basis for processing any data, so they either have consent to do so or use legitimate interest. “So, it’s worth reviewing your own privacy policy to ensure your retention policy sets out your actual processing requirements but also gives your customers information on their data rights,” he adds.

So, what happens if someone issues an agent with a ‘right to erasure’ request? Offley says that the right to erasure, also referred to as the right to be forgotten, is a data protection right that allows individuals to request the deletion of personal data.  He notes that a data subject can request this verbally or in writing and is something which should be responded to within one month. 

“Important to remember that a ‘right to erasure’ is not the same as ‘archiving personal data’. The potential issue when you archive data is that the record still exists, and it can sometimes be picked up on automated prospecting emails and would be available if your data was subject to any cybercrime or hacking incident,” comments Offley.  

“In summary data protection legislation does not prevent agents from marketing to their database, but put simply, they should be transparent with those customers who have entrusted them with their personal data and act promptly with any right to erasure request,” he concludes.