An investigation by LandlordZONE into data privacy within the private rental sector has revealed how many letting agents and landlords are sharing information about tenants' referencing information in contravention of GDPR regulations.

In particular, many agents are getting caught out when there's a problem with a tenancy and the landlord wants to see the referencing information on which an agent has based their decision.

In theory, they can only share what has been agreed between all parties and within their contracted agreement, usually just a copy of the reference summary confirming the check's outcome. But when tenancies get into trouble, landlords often then ask to see more detail about a tenant's background when they challenge the agency's initial decision to approve a tenant.

Data protection law

Landlords and letting agents are likely to be data controllers under the UK data protection law and should be registered with the Information Commissioner's Office (ICO), which advises they must be clear with tenants about what data they will collect, why they are collecting it, what they will do with it, who they will share it with, when it will be destroyed, and what the tenant's rights are in relation to that data.

Vouch founder Simon Tillyer tells LandlordZONE that agents also need to make sure they're not sharing the name and contact details of a referee as this is personal identifiable information of another individual ' - not the tenant - which they don't have grounds for sharing with the landlord. Publicly available information relating to court judgements and bankruptcies would be ok to share.

Legitimate interest

For anything else, an agent must ensure they have a reason to share that information by making a legitimate interest assessment. Adds Tillyer: 'Should there be a challenge, they will be able to demonstrate their justification to support the action they have taken.'

He says it is best to have clear T&Cs between agent and tenant which set out that any information used in their application for the property, including the tenant referencing, may be shared with the landlord.

In the case of rent guarantee insurance, it's often a condition of the policy that satisfactory referencing has taken place; sharing a copy of the reference would be under the 'performance of a contract' lawful basis and therefore acceptable, says Tillyer.

'However, best practice would be to extend T&Cs wording to include that sharing the information with the landlord may include for the purposes of insurance.'

Sensible view

Angharad Trueman (pictured), vice president of ARLA Propertymark, believes agents and landlords must take a sensible view about reference requests.

'The information is of legitimate interest to the landlord and the legal contract is between the tenant and the landlord," says Trueman. "However, in practice, when information is requested I would always recommend reaching out to the tenant to inform them and have that conversation.'

As many agents may not be completely aware of their responsibilities, Ahmed Gamal, founder of Rentd, advises that one way to negate any breach of GDPR regulations is to allow technology to do the heavy lifting.

'With Rentd, the tenant shares information directly with the landlord and only the landlord,' he says. 'Once their offer is accepted, the applicants are referenced based on the information provided with their offer.'

The ICO's data protection self-assessment checklist is here.