The Key Things Commercial Agents Need To Know About The GDPR

As of the 25th of May 2018 all companies will have to conform to the General Data Protection Regulation when operating within the E.U. You can ignore Brexit on this one (as in GDPR will go ahead whether we are in or out of the E.U.) If you are in the UK you need to comply. If you don't conform you can receive a big fine.

The issue is particularly relevant to property agents because you can be fined (up to 4% of turnover) if you send a marketing email to someone who has not 'opted in'. You need to be able to prove that they have consented to being sent marketing information. Clearly this is something that you need a 'smart' system for (hint hint.)

For example, lets say you go to MIPIM UK (See Caldes.com stand C36 18-19 October, London Olympia) and someone gives you a business card. At that point you need to ask them if you can send them marketing material. If you don't ask them then you can't send them anything at all. If you do you will be in breach. What if you add their information to your database and then someone else sends them some marketing material? As you can see, this is already sounding quite complicated, but this is just the tip of the iceberg.

Here are the key things that you need to know:

Everyone is affected. Whether your company is big or small, everyone from Directors through to part-time employees need to know about GDPR and they need to be aware of your internal data security policies.
Personal data. The significance of this will become apparent later, but lets start by defining what personal data is. This is anything that identifies or belongs to an individual. e.g. jo.bloggs@cbre.com would identify an individual at CBRE and therefore would be classified as personal data. So if someone gives you their business card, although it is business information it does identify them as an individual and therefore can be classed as personal data.
Processing of data. If you email someone then you are 'processing' data. This means that if you are in marketing properties then you are processing data. Property agents will therefore be processing personal information.
The Data Controller. "Data controller" means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed. In the case of a property CRM database this will usually mean the company using the software.
The Data Processor. "Data processor", in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller. Put simply this will usually be your CRM software provider (hopefully Caldes.com)
Security Breach Notification. 72 hours. That's how long you have to notify your supervisory authority. Lets say you have a cloud based database and someone leaves the company. If they then access the information in an unauthorised way and the information that they access is personal data (see above) then this will be seen as a security breach. Another breach might be someone who is with your company downloading a list of contacts and taking them out of the office, perhaps for personal use. If you find that such a breach has occurred then you need to make a security breach notification. There will be levels of data breach. For instance data that is sensitive, protected or confidential will hold more importance than perhaps an email address or a phone number.
Security Policy. This will include a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. It will define who has access to what and who can do what with that information. For instance, who can send out mail outs? Who can export data and under what situations? All staff will need to be fully aware of the policy and regularly reminded. Systems should help with that policy.
System Security. Your data needs to be secure obviously, although most data breaches will most likely be from staff and users than via insecure technology. Data processors and Controllers will jointly need to agree on security measures to make the data as secure as possible and the type of security will also depend on the sensitivity of the data. Most agency information is not that sensitive, but when it comes to transactions that changes. Continuity is also important. Data should be backed up off-site and there should be a plan to restore that should the worse happen.
The Right to be Forgotten. You need to be able to purge data. This might be automated (e.g. delete data after 3 years) or it might be manual (e.g. a delete button.)
Data Visibility. It is important to know where data is stored and be able to access all your information regarding an individual as quickly as possible, in case an individual puts in a 'Subject Access Request' to your firm, asking for information that you have on them. In reality this is not likely to be a big issue for Agents compared to say insurance companies or solicitors.
Permission to Process / Opt in. This is the big one for estate agents, commercial agents and surveyors. As discussed right at the beginning, you need to ask someone for their permission to process their information, such as email them property marketing details. You need to be able to show that this information was obtained. In other words, they need to opt in and you need to explain to them what they are opting in to. But what about client data? This is still a bit of a grey area. In theory you will need to delete all client data or anonymise it if you have not asked your clients if and how you intend to process their data.
Fines. It is unlikely that you will be fined if there is an issue but you have shown to have taken all the right steps and then you fix any issues once found. The fines will probably only apply to companies that do nothing. Whilst we cannot confirm this, that is the expected outcome.

If you are a Caldes.com customer, rest assured you are in goods hands and will receive an all encompassing solution to meet the GDPR in full.

Follow us on Twitter: https://twitter.com/Virallocation

The Key Things Property Agents and Estate Agents Need To Know About The GDPR

Stuart Bell