Yes, the Regulator of Social Housing Sector Risk Profile 2024 states that data breaches and cyber attacks are risks but it goes on to ramp up the risk level, with its reference to collecting “sensitive data on protected characteristics” about tenants, which is included as a given, that landlords *will* be doing.
“Delivering fair and equitable outcomes for tenants will involve collecting data to understand tenants’ diverse needs, including sensitive data on protected characteristics, making the impact of any data breach more significant.”
Collecting this data based only on the consumer standards means landlords are more likely to breach the very first principle of the (UK)GDPR.
It requires:
“Personal data shall be:
(a)processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”
Processing is only lawful if it’s necessary for one of the purposes listed (Art. 6 GDPR). This requires clarity on both the purpose and on the necessity of the processing.
But the consumer standards don’t provide either. The Transparency, Influence and Accountability Standard states:
“2.1.1 Registered providers must use relevant information and data to:
a) understand the diverse needs of tenants, including those arising from protected characteristics, language barriers, and additional support needs”
The word “relevant” means we don’t know what data’s considered necessary under the standard. There is a steer, saying “diverse needs…including those arising from protected characteristics, language barriers, and additional support needs” but it’s still vague, so no clarity on necessity.
Which means it doesn’t provide a legal obligation to collect any and all data that could come under “diverse needs…including those arising from protected characteristics, language barriers, and additional support needs”.
Every purpose for which data is used needs a separate lawful basis.
Lawful bases *do* exist, but landlords need to understand the circumstances in which lawful bases can apply, and what controls are needed.
In particular, data collected for the purposes of EDI statistics, can’t lawfully be used to make adjustments for an individual.
And vice versa, data collected in order to make reasonable adjustments for an individual can’t automatically be included in EDI statistics data.
To help landlords navigate the legal perspective, I’ve developed tools that help you unravel all the complexities, and ensure your EDI data collection plans are clear, practical and lawful:
• The EDI Data Toolkit for Social Housing.
• And for more support and the chance to ask all your and your colleagues’ questions, you can book an online EDI Strategy Workshop, to help develop your EDI data strategy.
I’m interested to hear how conversations are going in your organisations, about the collection and use of EDI data. The more we can talk about this tricky topic, the better.