Why the housing sector is being urged to make data privacy its priority this year

Data protection is everyday business

It may be a day dedicated to privacy, but the importance of data protection is evergreen. 

Personal information is collected all year round – so prioritising basic steps, such as staff training, double-checking records and restricting access can help to prevent personal data breaches before they happen, hugely reducing the risk of harm to residents.

Last year, UK information commissioner John Edwards spoke about the devastating ripple effects that can occur should someone’s personal information fall into the wrong hands or if they’re a victim of a data breach.

This is particularly poignant in the housing sector, where common issues including inappropriate disclosures of personal information, reluctance to share data and failure to keep accurate records could all result in a data breach.

To an organisation, a data breach might seem like a temporary setback, something that can be patched up with technical fixes and compliance reviews. But from the perspective of residents, who may be in already vulnerable situations, a breach can have far-reaching and damaging effects.

The commissioner reiterated that data protection has never been about computers or robots – it’s about people. People trust that the information they share with the housing sector will be stored safely and used lawfully as this data is not just a set of numbers or details – added together, it could tell their life story.

Transparency is key

As the data protection regulator, we are advocates for data-sharing – where appropriate.

Public services are obliged to be transparent and provide the public with the means to request information. We’re also here to provide necessary support and guidance to organisations to ensure they’re abiding by the law when using, collecting or storing data.

For example, housing associations may occasionally receive requests for information about their current and former residents from third parties, such as utility companies and debt collectors.

There are situations where it may be necessary to share personal information about residents with third parties, and housing associations should have an appropriate system in place to do so. 

This can help reduce the likelihood of data being shared inappropriately. If a housing association decides to share personal information, it should only provide relevant, necessary information and make a record of the decision.

Further resources

We expect all housing providers, no matter the size, to make sure they are handling residents’ personal information responsibly, securely and lawfully.

For further case studies about issues such as data-sharing and accurate record-keeping, we have a blog post specifically on how data protection law can prevent harm in the housing sector.

To further understand the real-world impact of data breaches, organisations can read the Information Commissioner’s call to action and access the new ‘ripple effect’ resources on communicating with empathy.

We also have guidance on our website in relation to reporting a data breach and the 72-hour time frame.

However, organisations can take our self-assessment to help determine whether they need to report to the ICO.

Any housing provider that needs support to process or share personal information can find further guidance on our website or visit our business advice services.

We are also here to support the public and ensure their data protection rights are respected. If anyone is concerned about how their data is being handled by an organisation, they can make a complaint to us.

What’s next?

This year we’re also celebrating the ICO’s 40th anniversary. Throughout the past 40 years, we have remained committed to protecting individuals and working alongside organisations to help them improve their data protection practices.

We have witnessed a lot of change over the past four decades, from the launch of social media to new laws giving you the right to access information.

We continue to look to the future and recognise the ever-evolving data privacy landscape, and encourage anyone who wants to learn more about the ICO’s 40th anniversary to visit our ICO at 40 digital exhibition. For those who would rather see it in person, the exhibition will open at the Manchester Central Library in April.

Emma Wright, group manager – public advice and data protection complaints services, Information Commissioner’s Office