Agents warned on GDPR compliance after huge £12.4m fine

The National Association of Estate Agents is warning UK agents to take stock of their data collection and retention procedures following a controversial German law case.

The Berlin property company Deutsche Wohnen has been fined more than €14.5m or £12.4m due to a GDPR breach.

The company is reported to have retained old customer data, which is a breach of administrative obligations, rather than a data breach which is loss or misuse of customer data.

The NAEA, in a statement on its website, says this is reportedly the first GDPR fine in response to a company’s data retention activity and the largest fine received by a property company.

The association also says that although an incident taking place in Germany, the punishment will be viewed by other regulators - including the UK’s Information Commission - as an indicator of fines.

Deutsche Wohnen was found to have breached obligations to keep personal data for “no longer than is necessary for the purposes for which the personal data are processed”, to ensure that personal data is adequate, relevant and limited to what is necessary; and to provide appropriate technical and organisational measures designed to implement data protection principles.

Despite the regulator's request that it revise these activities, Deutsche Wohnen's improvements did not go far enough.

The NAEA says the fine could have been millions of pounds higher, but Deutsche Wohnen is co-operating with the investigation and took steps to address its failure.

“This case highlights to property companies the need to regularly review their data processes and the data which is kept” says the NAEA.