GDPR - Such a wonderful thing
I have had several landlords asking about the PCC HMO Licence Conditions which will force them to share details such as credit referencing information which does not seem to be an appropriate thing to ask for and may breach the landlords GDPR obligations. If it helps, some comments from the ICO and my thoughts on what I do when the police ask for similar information.
When The Police Ask For Personal Tenant Info
If PCC ever did ask me, I would deal with it same as I do the police as council have no higher powers than them and they have to abide by the same GDPR rules.
The police have to give you precise reasons (and a notice from them) as to why they need tenant or even applicant information so that you can make a reasonable decision as to whether you should give it up or not and more importantly, what information is necessary to give up due to the important principle of "data minimisation". What info I give to police may be different depending on whether it is a welfare concern or a valid criminal investigation and the type of criminal activity etc. If I don't think it justifiable, it would need to be court ordered before I provide them with anything. The police are fully aware they can't order us to submit it to them in most cases, they just hope you'll be willing to help them - especially if for the welfare of the tenant.
The council would have to tell me precisely why they need such info/paperwork so they would have to inform me what they are specifically investigating in detail so that I could consider what information should or could be provided. I would imagine that at least initially, they won't be open enough to tell you precisely what they want specific information for so that would likely lead to a stalemate? I would find it hard to believe they can justify the need to have to give them credit checks and so on as no real legal implication whether you have done them or not so it isn't something they can really criminalise you over (I would hope). They certainly have no need for any information obtained from any 3rd parties such as guarantors or work place /landlord references. The only legal obligation when moving someone in is right to rent checks so I could see that being something they need if it's suspected that you are renting to illegal immigrants? Antisocial behaviour impacting others - perhaps? If something criminal is happening, I would have expected police or other parties to be involved at this point anyway.
Also, as mentioned previously, I don't see why it's necessary to have to give them the tenants data in order to comply in most cases. If they asked me for tenancy agreements/references and so on to check us/landlord out, which is their primary role (rather than the tenants whom they do not take action against), there's no need for them to have the tenants data so simply cross out any tenant's identifiable info with a black marker and submit it to them redacted. I do this all the time with solicitors as they are always asking me for tenancy paperwork and proof of this, that and the other - it is always accepted and you've still complied to the HMO licence condition as written so what could they do about it thereafter? This way there's no breach of GDPR nor licence conditions.
If they give me a specific and justifiable reason as to why they need the tenant's info, I would maybe have to consider it - just not sure what that reason could be right now?
Just in case, here's a page explaining what you should consider when a law enforcement authority ask you for data in case it's helpful:
What The ICO Said
For completeness - the PDPLA asked the ICO for guidance on the PCC Licence Conditions and here is what they said;
You must process your tenants' personal data lawfully fairly and transparently. All the lawful bases, aside from consent, expect your processing to be 'necessary'. This means you must consider the purpose for supplying the data to the Council and decide whether the sharing is objectively fair. You must also inform the tenant (usually within your privacy notice) that their data may be shared, or alternatively rely on an exemption - which may release you from some of your obligations under the rights and principles.
It's important to note that the exemptions aren't a replacement for consent. Consent is a lawful basis in itself. Some of the exemptions exist to release you from your obligation to inform the tenant about the sharing, but this is separate to the requirement to have a lawful basis.
The lawful basis of legal obligation applies when "processing is necessary for compliance with a legal obligation to which the controller is subject". It may be appropriate to rely on this lawful basis, but you must document and justify your reasoning and be able to identify the specific legal provision that you need to comply with.
Perhaps the Council could provide you information to help you conclude whether the sharing is necessary, clarify the legal provision and/or help with the identification of another more appropriate lawful basis to use in the circumstances.
If you do share the data with them, the Council will have to choose their own lawful basis to process the data (which may be public task) and comply with all the principles to ensure their own processing complies with the data laws.
Ultimately, unless you are served with a court order, it will be your decision whether to share the tenants' data. But failing to comply may risk your licence.
id you know, most companies need to pay a data protection fee? Don't fall short of data protection compliance – our online fee checker will help you figure out if you need to pay, or if you're exempt
What PCC Said
And in their defence, we had this from PCC:
Portsmouth City Council does not use licence conditions to obtain personal information about tenants. The Council only requests copies of tenancy agreements, or evidence that the licence holder has obtained references, if it is investigating specific problems with the management of the property. Even then, the Council is only permitted to request information that specifically relates to the issue it is investigating
So In Summary
You are the 'Data Controller' for any personal information you hold, so if you are asked to share any of it with any authority do make sure they make the reason they want it clear and either check that the tenant is happy for you to share this or be very careful that you have sufficient written evidence to justify sharing and that you only share what is absolutely necessary, redacting everything else.