A warning shot has been fired towards property professionals as the largest GDPR fine has been issued to a company in the sector.
German property company, Deutsche Wohnen, is reported to have retained old customer data, which is a breach of administrative obligations rather than a data breach which is a loss or misuse of customer data. This has resulted in a fine of more than €14.5m (£12.4m).
Under GDPR, Deutsche Wohnen was found to have breached obligations to keep personal data for “no longer than is necessary for the purposes for which the personal data are processed”, to ensure that personal data is adequate, relevant and limited to what is necessary; and to provide appropriate technical and organisational measures designed to implement data protection principles.
Despite the regulator’s request that it revise these activities, Deutsche Wohnen’s improvements did not go far enough. The fine could have been millions of pounds higher, but Deutsche Wohnen is co-operating with the investigation and took steps to address its failure.
The sector is now urging industry professionals to have a look at their own procedures regarding data collection and retention, so a similar fine doesn’t befall another organisation.
Although a fine like this has never hit the UK property sector, the UK Information Commission, will certainly look at this as a precedent for fines in the future.
