As you’re probably aware, I have a (huge!) worry about the way that many landlords are interpreting the requirements for EDI data in the new consumer standard the Transparency, Influence and Accountability Standard.
“2.1 Diverse needs
2.1.1 Registered providers must use relevant information and data to:
a) understand the diverse needs of tenants, including those arising from protected characteristics, language barriers, and additional support needs; and
b) assess whether their housing and landlord services deliver fair and equitable outcomes for tenants.”
Despite the key word “relevant”, some providers seem to be translating this as meaning they must collect information about all protected characteristics of all their tenants.
This is leading to surveys, or plans to survey, asking tenants about their ethnicity, religion, disability and sexuality – and more – without a clear lawful purpose for any of the data collection and use!
When I raise this with landlords, sometimes the response is (and I paraphrase, but only slightly…) “the lawful purpose is the regulator says we have to collect this data”.
But sadly, that’s just not true!
As you know, Processing is only lawful if it’s necessary for one of the purposes listed (Art. 6 GDPR, and Art. 9 as well, for special categories of personal data). This requires clarity on both the purpose and on the necessity of the processing. But the consumer standards don’t provide either.
The word “relevant” in the standard means there’s no clarity on what data is necessary under the standard. Which means it doesn’t provide a legal obligation to collect any specific data types. So “legal obligation” is off the table, and landlords must identify (and communicate) their own lawful purposes.
I’ve been asked if the Regulator is likely to help the sector with identifying those lawful purposes, and I have a clear answer on that now…
Unfortunately, no, the Regulator won’t help identify lawful purposes for collecting and using EDI data; providers are on their own.
I wrote to the Regulator about my concerns, explaining the issues around the lack of clarity, and they have responded, saying “landlords should ensure they are compliant with relevant legislation (including GDPR)”. More details of their response include:
“The issues you have raised were borne in mind when developing the new consumer standards.”
“The Consumer Standards Code of Practice…emphasises that in collecting personal data about tenants, landlords should ensure they are compliant with relevant legislation (including GDPR) and the Information Commissioner’s Office guidance, as well as respect tenant privacy.”
“That has always been the responsibility of each individual landlord and finding lawful and appropriate ways in which to comply with our standards is what we expect when delivering regulatory outcomes, which includes being clear on their purpose for collecting data.”
So there it is, we now know for sure that we have to identify our own lawful purposes for collecting any customer data linked to the Consumer Standards.
And “the Regulator says we have to, so it’s ‘legal obligation’” does not apply!
Consent is a bit messy too, and I wouldn’t recommend it when you don’t need to rely on it. And you don’t need to rely on it here – because there are appropriate lawful purposes available, apart from legal obligation and consent.
As a DiSH member, you have access to useful resources that highlight how to apply them appropriately. In particular, this case study clarifies the difference between collecting and using EDI data for statistics and for making reasonable adjustments to services, which each need their own separate lawful basis.
The headlines are:
- Data collected for EDI statistics (as long as any ‘special categories’ of personal data being used are race/ethnicity, religious/philosophical beliefs, disability, or sexuality) comes under Legitimate Interest (Art. 6 – needs an LIA) and Substantial Public Interest (Art. 9) plus EDI monitoring and maintenance & improvement (DPA 2018 Sch. 1 – needs a policy in place).
- This data can’t be used to make reasonable adjustments, or take any other action, in respect of an individual.
- The data is only lawfully collected if robust plans are already in place for the analysis of the data and how the results will be used to maintain or improve equality of treatment or opportunity.
- Data collected in order to make reasonable adjustments for individuals, so they can access your services or live in their homes in a reasonably similar way as other people (e.g. needs due to disability, or due to language barriers, etc.) comes under both Contract (tenancy agreement) and Legal Obligations ((equality law, housing law, health & safety law) (Art. 6), and Legal Obligations and Rights (equality law, housing law, health & safety law) (Art. 9).
- This data can’t be repurposed to use for EDI monitoring statistics without reviewing the purpose, lawful basis, transparency, and all the rest of the GDPR requirements.
- It’s crucial to differentiate between ‘needs’ which are a legal consideration, and ‘wants’, which are a customer service consideration.
For more details on the lawful bases, and what framework should be in place in order to meet the lawful basis, see the Case Study explaining the difference between using EDI data for statistics vs tailoring services
More support & resources available for purchase include the CPDP Online EDI Data Toolkit, a bespoke EDI Clarity Session, or the newly launched EDI Data Insight Accelerator for more in-depth support.
UPDATE: The EDI Data Toolkit continues to grow, but the price stays the same at just £150. As well as the original EDI data presentation and Board/Exec Paper, it now includes an EDI Data Quick-Start Guide, TWO presentations – one on strategy and one on practice – and a quiz with a certificate, as well as an updated version of the Board/Exec Paper on lawful EDI Data Collection & Use in Social Housing, AND an EDI Data Strategy template ready for your immediate use! Still only £150.
Any comments or questions, as always please just shout! Clare@cpdataprotection.com