Is the PRS database illegal?

The government want to roll out a database for all private rental properties in the UK. They have stated that they will be publishing all or some of this data on the internet (euphemistically referred to as ‘making the data public-facing ’).

However, they have not stated at this point in time exactly how much of your and your tenant’s private data they intend to put out onto the internet. Although many people are addressing the £65 annual fee this will cost (which will go up), few people seem to have mentioned the safeguarding, privacy, safety, liability, data protection and related legal aspects of this scheme.

All of us, including tenants & landlords, have the right to privacy under the Human Rights Act. From a landlord’s point of view: why should any of your private data be published on the internet? The government want your full ID including your date of birth & address. Your private data will be on view for the whole world to see. Does every landlord want their date of birth to be published? Personally, I never ask a woman their age, but we will not need to ask, since we could just look it up.

Also, your privacy is breached in that the world can look you up and see how many rental properties you might have, their addresses and how much rent you receive. This information will be available to any criminals, any stalkers you might have or might get attached to you in the future, any nosey work colleagues or people who enjoy spying on you & your life, any envious spiteful ex partners, etc. People are advised not to put their personal information on social media for reasons of safety & privacy, yet the government thinks they should do this to private citizens? Tenants also have the right to privacy.

Not all tenants want their address to be known as rental nor do they all want the amount of rent they pay to be known, how many bedrooms they have, etc. People, tenants & landlords included, are entitled to privacy. This is a right that is protected by law.

There are also laws relating to the requesting of data and its usage and publication: GDPR, the Data Protection Act, etc. It is likely that these proposals breach various aspects of these laws. Any breaches raise the prospect of criminal prosecutions and also of civil liabilities.

One such potential breach is that the government are asking landlords to give this data on themselves, their tenants & their properties without stating how much of this personal data they will publish online in the future. They have stated that at least some of this personal data will be published online, and possibly all of it.

According to data protection laws a person has to consent to the manner in which the data they give will be used or published at the point in time that this data is requested and collected. This is the principle of informed consent. It is unlawful to collect data without telling the person from whom you collect it what you are going to do with it, & that information has to be given at the point of collection.

One cannot collect data and then decide later how much you will publish on the internet. If your wife buys a pair of shoes online and gives her name and address and credit card details to purchase and have them delivered, it would be unlawful for the shoe seller to decide in a few months time to publish her data on the internet. They would have had to inform her at the point in time of taking her data that they were going to publish all their customers’ data online.

This point is also relevant to landlords who took data from their tenants to set up the tenancy (e.g. to run a right to rent check). Did you inform your tenant that any of their personal data was going to be given to a body who would publish their data on the internet? Did your tenant consent to this? It is possible that you would be breaching data laws by passing your tenant’s data on to a body who then publishes that data on the internet. If you had a tenant who had for example escaped a domestic abuse situation and then their name and address is published online, this would not only be a data protection breach, but also presents safety issues.

Landlords could possibly be sued for such breaches, & also possibly prosecuted for breaching data protection laws. There could be a lot of liability involved if this causes problems for vulnerable people.

There are many safety issues presented by this proposed database. This database puts landlords & their homes & families at risk, & also puts tenants & their homes & families at risk.

Putting a landlord’s ID online and that being linked to a rental property (or more than 1) is useful information for fraudsters. Every criminal has a smart phone in his pocket, and they could access all this useful data. Just having your ID published per se is putting you at risk form criminals for ID theft, etc. The risks are more serious for certain vulnerable people who are landlords.

Female landlords who have escaped abusive partners or stalkers are put at particular risk by this. Not only is the female landlord put at risk from a stalker who would only need to search her name online (as such stalkers regularly do), but her home & family would also be at risk. Not only that, some of these stalkers could pose a risk to her tenants & rental property too, harassing or attacking there as a means to get at her. Some such females would have to stop being landlords.

I know 1 such lady who has escaped a very dangerous situation, moved house & stays completely off the internet for safety reasons. These proposals would have a disparate impact on women in this manner, and hence could be illegal in that sense. & even people who have never experienced attacks nor stalkers nor abusive partners, etc. could do so in the future. People can become mentally ill, as is frequent these days. Spiteful ex partners can cause all sorts of problems to people. There are so many safety issues that pertain to these proposals.

Other safe guarding issues are relevant. By publishing which addresses are rentals, one could be marking such homes a targets for various criminals. When one advertises a property to let, the full address is never published online for this very reason. There have been many cases in which criminals have turned up at rentals & gained access to the home by knocking on the door & pretending that the landlord sent them for some essential check or other reason. Once access has been gained, people have been robbed, assaulted, etc. If these sort of ‘gaining access to rentals’ criminals have not only the full address, but also the landlord’s name, this makes it a lot easier for them.

The more data they have, such as the landlord’s name, the more easily they can convince a tenant that they are genuine. This will particularly impact more vulnerable tenants such as those with mental impairments, the elderly, women, recently arrived immigrants, etc.

There are so many potential safety issues that putting any of this data online will present that these proposals really need re-examining. Has the government conduct a full safe guarding assessment on the consequences of these proposals? If so, can we see a copy to judge its adequacy? Even if some of the data is not published, can anyone be sure that there will never be a hacking incident or such data breach?

Has the government conducted a full legal assessment as to the breaches to the right of privacy and the data protection GDPR breaches involved with these proposals? Again, if so, then can we see the legal opinion on all this? I do not believe that this is wholly legal. I also believe that this will result in various law suits in the future if these proposals are allowed to go ahead.

The data legislation included the principle of data minimisation: that only necessary data should be collected; under UK GDPR & EU GDPR, where Article 5(1)(c) states that personal data must be “adequate, relevant & limited to what is necessary in relation to the purposes for which they are processed”. How is the landlord’s date of birth in accordance with data minimisation? Why would that be necessary for anything? & the number of bedrooms a tenant has? To what ‘purpose’ is any of this anyway? What is the purpose meant to be?

Other than the benefit of the government taking £65 a year, what benefits are there to any of this? They are only allowed to take data that is relevant for a stated purpose & I cannot see what the purpose is? Considering the breaches to privacy (to tenants & landlords) and the data protection breaches involved, how could any benefits be outweighed by these drawbacks? Has the government conducted a benefit vs harm analysis on this; and also stated the purpose of them requesting this data?

To summarise: I do believe that this proposal could be illegal in many ways. It breaches human rights legislation in that it breaches people’s right to privacy. It almost certainly also is illegal in relation to various GDPR & data protection laws. Not only could the government be acting in an illegal manner, but landlords also could possibly be breaking the law too. These proposals will put people & properties at risk. We have seen no stated purpose to this database & this in itself is problematic & breaches data legislation. Any purpose later stated must be outweighed by the safety, privacy, legality, & safeguarding issues involved.

I think all these legal and safety issues need to be addressed before anyone gives any data to the government for this database. I strongly advise people to check with a specialist lawyer before giving any data to the government for this database. You could end up being liable & also you could be putting yourself, your family, your home, your tenants & their home, at risk.

I also advise you to request that the government share their assessments on these proposals: the legality of all of this; the safety and safe guarding issues assessment; the stated purpose of this database; the benefit vs harm analysis of these proposals.

Thanks,

James