Tenant making subject access request direct to referencing company

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

    Tenant making subject access request direct to referencing company

    Prospective tenant (Data Subject) fails referencing so makes a subject access request direct to the referencing company. My understanding is that a subject access request is made by a Data Subject on the Data Controller (in this scenario landlord) and subject access requests are not for Data Processors such as the referencing company and so the Data Subject cannot make a valid subject access request to the referencing company and as a Data Processor the referencing company should advise the Data Subject the request is invalid and should be directed to the Data Controller - thoughts please?

    #2
    What makes you think a person can't ask (in this case) a referencing company what date they hold on the person? The person isn't concerned with what data you gave the referencing company, but what else the referencing company holds on them.
    I am not a lawyer, nor am I licensed to provide any regulated advice. None of my posts should be treated as legal or financial advice.

    I do not answer questions through private messages which should be posted publicly on the forum.

    Comment


      #3
      Section 45 of the DPA states 'A data subject is entitled to obtain from the controller' a referencing company is not the Data Controller in this instance they are Data Processors processing data on behalf of a Data Controller so the Data Subject can only make access requests to Data Controllers?

      Comment


        #4
        Where in the DPA legislation does it say Data Subjects can make access requests to data processors?

        Comment


          #5
          If they are only data processors, why would they have retained any data that could be used to satisfy the request?

          Comment


            #6
            The reference company isn't just processing the data you gave them. The whole point of their existance and what you paid them for is that they also hold or have access to other data on the subject. You are after all asking them to tell you information about the prospective tenant that you don't already know, are you not?

            The company may only be a data processor for the data you provide in the application, but they are almost certainly a data controller for other data it holds on the prospective tenant.
            I am not a lawyer, nor am I licensed to provide any regulated advice. None of my posts should be treated as legal or financial advice.

            I do not answer questions through private messages which should be posted publicly on the forum.

            Comment


              #7
              Thank you KTC for your responses. I think I am struggling to see that in this context that the referencing company is the Data Controller for the reference report (and data therein) as they are processing data on behalf of 'the' Data Controller. I have checked the definitions to help bring clarity to my understanding:

              “data controller” means a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be processed

              “data processor”, in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller.

              Comment


                #8
                This is an extract from a document (A guide to data protection and privacy for landlords and tenants) produced by Anthony Collins solicitors: a third-party company, procured by a landlord to help it analyse, store or securely dispose of personal data would be classifed as a data processor in respect of such services if they are acting only on the landlord’s instructions.

                Comment


                  #9
                  That's because you keep focusing on "in this instance" / "in this context". So you're thinking effectively the SAR is "give me a copy of the report you sent the landlord", when a SAR could be as general as "what data do you hold on me".

                  In the end, why does it matter? The subject is still entitled to a copy of the data held. Whether you're the referencing company or the landlord, verify the identity, respond and move on.
                  I am not a lawyer, nor am I licensed to provide any regulated advice. None of my posts should be treated as legal or financial advice.

                  I do not answer questions through private messages which should be posted publicly on the forum.

                  Comment


                    #10
                    Originally posted by cymro123 View Post
                    a third-party company, procured by a landlord to help it analyse, store or securely dispose of personal data would be classifed as a data processor in respect of such services if they are acting only on the landlord’s instructions.
                    How do you fit a referencing company into that definition?
                    I am not a lawyer, nor am I licensed to provide any regulated advice. None of my posts should be treated as legal or financial advice.

                    I do not answer questions through private messages which should be posted publicly on the forum.

                    Comment


                      #11
                      Again, does it mater? They hold data... let them work out who/what they are. To a LL they are just a 3rd party company supplying specific information. As you said, Tenant is legally entitled to the information so make a 'reasonable' check that they are who they say they are, hand it over, move on!

                      Comment


                        #12
                        A data subject asks an organisation to advise what personal data they hold on the subject.
                        The organisation is obliged to respond.

                        It's remotely possible that the organisation will confirm that it holds data that it can only release with the consent of someone else, in which case you make the request to the someone else.
                        What they can't do is pretend that they don't have the data.

                        Alternatively, you make the request to the landlord, who should include data held by their processors.

                        The likelihood of either a landlord or their agent understanding any of this is remote.
                        When I post, I am expressing an opinion - feel free to disagree, I have been wrong before.
                        Please don't act on my suggestions without checking with a grown-up (ideally some kind of expert).

                        Comment


                          #13
                          I fail to see why a right of access request to a referencing company should be of any concern to a landlord anyway?

                          The LL has a right to act on what the reference report says.

                          If the subject thinks that the referencing company may have the wrong information then he has a right to know what information they hold about him, or if they don't hold it themselves where they accessed it from.

                          Comment


                            #14
                            Where in the DPA legislation does it say Data Subjects can make access requests to data processors?

                            In GDPR it was reinforced that people have the right to know what information is being held on them, and the right to be forgotten, It doesn't matter whether the 'person' holding information is a processor, ticket inspector, insomniac, tinker, tailor or Uncle Tom Cobbley.

                            Comment

                            Latest Activity

                            Collapse

                            Working...
                            X