Legitimate Interests - Balancing Test
Where you rely on the legitimate interests legal gateway to allow you to handle (process) personal data, e.g. about a tenant you have to specify in your privacy notice what these legitimate interest are. They can be your own interests or those of a third party, e.g. a utility company. Your interests can include running your own business and managing tenancies and properties. There may be others.
The next requirement is that the legitimate interests of you as Landlord/Data Controller or a third party must be balanced to ensure that they are not outweighed by the interests/rights/freedoms of the data subject (this is the individual to whom the information relates). This is a three part exercise -
- Identify the legitimate interests concerned - the relevant RLA model privacy notice does this for you.
- Apply the necessity test to evaluate whether the processing is necessary.
- In the light of the outcome of the necessary test apply the balancing test.
In reality if the information is something that the tenant etc., would expect you to handle/process or share that the test is likely to be satisfied.
Necessity to process
If the processing is not necessary then legitimate interests cannot be relied upon in any event. In particular, you have to consider whether or not there is another way of working without using the data. These include looking at the nature of the interests, and the impact of processing the data subject.
Balancing test - factors to consider - tenants, residents and guarantors
When carrying out the balancing test there are various factors to consider.
You have to ask if there are any safeguards which could be put in place (including an opt out).
To start with there is more likely to be a legitimate interest where there is a relationship between you as data controller and the data subject. This will apply when dealing with tenants, prospective tenants or guarantors.
The nature of the interests include -
- The reasonable expectations of the data subject.
- Type of data and how intrusive it is.
- The nature of the Data Controller's/third party interests.
When it comes to the impact of processing this includes -
- Any positive or negative impact on the individual, any prejudice to the Data Controller or third party (or Society generally) of not conducting the processing.
- The likely impact on the data subject and the severity of any impacts.
- The status of the individual (a stronger case can be made out when there is a relationship, e.g. the landlord/tenant relationship).
- The way in which the data is processed.
Safeguards include -
- Any compensating controls/measures, e.g. data minimisation, anonymization, extra transparency, restricting access to data and opt out.
Questions to ask
Questions to be asked under the balancing test:
Log into your RLA Account
Join the RLA
Get full access to over 130 Documents and Guides
No Guest Access
This content is available to RLA Members only, not Guests.