Data Protection

What is the difference between data controller / data controller agreements and data controller / data processor agreements? 

There are two ways for organisations to share personal data.  The appropriate type of agreement will depend upon the relationship between the organisations.

Data Controller / Data Controller agreements

The relationship between TPO and its Members is classified as a data sharing arrangement between data controllers.  This means that both organisations determine the purposes for which and the manner in which the personal data is processed.  This relationship has been documented in our Data Sharing Agreement with Members.

Data Controller / Data Processor agreements

The other form of data sharing arises where a data controller shares data with another party that processes personal data on its behalf. Under data protection legislation, those organisations are known as ‘data processors’.

We recommend that if you have not done so already, you should be reviewing your data sharing arrangements with third party suppliers and service providers.

For more information, please see the ICO website:

What do I do if an individual asks to be forgotten?

Individuals have the right to request for their personal data to be deleted, also known as the right to be forgotten.  An individual has the right to request to be forgotten data if one of the following applies:

  • The personal data is no longer necessary for the purpose you originally collected it for.
  • The individual withdrew their consent to the data processing activities and there is no other legal justification for processing applies.
  • The data subject objects to processing for direct marketing purposes.
  • You unlawfully processed the personal data.

Steps to follow:

If you receive a request to be forgotten, you will need to consider whether you can agree to “forget” the individual by deleting their personal data from your organisation (both in electronic and paper format).   The answer will depend upon your relationship with that individual. 

For example:

  • Former client

    If the request is received from a former client, you will need to consider whether you can comply with their request or not.  When handling their request, you will need to consider why you hold their personal data and whether you have a legal justification for retaining their personal data.  It may be that you need to retain the personal data for the purposes of your data retention policy.  For example, it is not uncommon for organisations to retain certain information about a transaction with an individual on the basis that the information may need to be maintained due to regulatory requirements (eg: health and safety / as required by HMRC).   

    Commonly, organisations will want to retain personal data in order to defend future legal claims being brought against them – for example breach of contract / negligence.  Accordingly, the organisation would be entitled to rely on the statutory limitation period as the reason for refusing a request to be forgotten.

    Meanwhile, when considering the request, you may be able to reduce (but not delete completely) the amount of personal data that you hold about the individual.

  • Existing client

    Where the request is received from an existing client, you will be able to explain to the client the consequences of agreeing to comply with their request. In this case, you need to process their personal data in order to perform the contract with them to provide the services.  You would need to explain that if you were to exercise their request, you would no longer be able to continue to act for them. 

    It will then be up to the individual to decide whether or not they wish to continue to instruct you.  Nevertheless, in the event that you have provided a service to an existing client, you may not be able to agree to exercise the request to be forgotten entirely, based on the potentially legitimate purposes of defending future claims (as set out above).

  • Current / prospective / former employees

    A similar rationale will apply in the case of employees who seek to exercise their right to be forgotten – whether current, prospective or former.

  • An individual you send marketing materials to

    In the event that the request to be forgotten relates to marketing activities, we anticipate that the individual’s personal data will need to be deleted from your marketing mailing lists (“forgotten”).

    However, it might be that the individual is an existing / former client and therefore you will need to apply the above tests to establish whether you can agree to forget the individual in their entirety or whether in fact you have legitimate interests in retaining some of their personal data relating to the services delivered and the statutory limitation period.


For more information, please see the ICO website:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/  

Establishing a retention policy - what do I need to do?

It is advisable to implement a document retention policy that determines the reason and period of retention for the personal data that you process within your organisation.

You need to:

  • Establish and adhere to standard retention times for categories of information held on the records of individuals (e.g: employees (former / current / prospective)); customers (former / current / prospective); suppliers (former / current / prospective) etc.

In doing so:

  • Base the retention times on business need taking into account relevant professional guidelines and a risk analysis approach;
  • Assess who in the organisation is responsible for the retention of the records;
  • Make sure no one retains information beyond the standard retention times unless there is a sound business reason for doing so;
  • If possible establish a computerised system which flags information retained for more than a certain time as due for review or deletion.

For more information, please see the ICO website:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/documentation/how-do-we-document-our-processing-activities/

Further things to consider

How long does the review process take?

Our aim is to provide a proposed decision within 16-18 weeks of a complaint being accepted for review. However, these timeframes may differ depending on the number of complaints we are dealing with.

Can I request an oral hearing?

In the majority of cases we will resolve complaints on the basis of the written evidence submitted. However, we will consider requests for oral hearings made in writing, setting out the issues you wish to raise, so that we can consider whether they are material to the final decision.

The request for an oral hearing will be considered by reference to the nature of the issues to be determined and, in particular, to the extent which the complaint raises issues of credibility or contested facts that cannot be fairly determined by reference to documentary evidence and written submissions.

An oral hearing is not like a court hearing. We cannot treat evidence like a judge would. For example, we can’t question or cross examine people under oath. So we take what each party says as their version of events. This means you need to be able to back up what you say at the hearing with the evidence you send us, so it is not just one person’s word against another’s.

We use the European Convention on Human Rights to decide whether the hearing should be public or private.

If you would like an oral hearing, please write to The Property Ombudsman, Milford House, 43-55 Milford Street, Salisbury, Wiltshire SP1 2BP. Please explain your reasons so we can decide whether or not they could affect the final decision. If we don’t agree to an oral hearing, we’ll write to let you know why.

Publication of the decision

Our case reviews and decisions remain confidential between you, the complainant and us. Details of complaints may (in accordance with the requirements of the Consumers, Estate Agents and Redress Act 2007 and the Enterprise and Regulatory Reform Act 2013) be provided to other consumer redress schemes or any person/organisation exercising a regulatory function. No personal details or specific aspects of the complaint will be given to anyone outside of TPO without your consent.

We do, however, publish abridged and anonymised case summaries on our website and in our interim and annual reports and via other sources to assist agents to understand the common pitfalls and mistakes and encourage best practice.

Outcome of the complaint

What happens when a proposed decision is made?

We will send the proposed decision to you and the complainant at the same time. You will be given 14 days to either accept or appeal the decision.

If you represent, there is no guarantee it will affect the final decision. In fact, representations normally only affect the final decision if:

  • You can prove we have made a significant mistake that makes a difference to the outcome – for example if we missed a complaint letter or misinterpreted the facts.
  • You have significant new evidence that will affect the decision.

If you provide a representation it will be necessary to allow the other party the opportunity to comment on the representation (within 14 days) and such decision will be taken into account before issuing a Final Decision to both parties at the same time.

What awards will the Ombudsman make?

If we support the complaint, we can make an award of compensation under the TPO scheme (to be paid by the agent).

Although we can make awards up to £25,000 (£5,000 for search providers), this amount is rare and only in cases where it is established beyond doubt that significant financial loss has been incurred. Most awards are for aggravation and are modest (so as not to be punishment of an agent).

Awards will be made if we are persuaded that the complainant has suffered:

•  Actual, proven financial loss as a direct result of the actions or inactions of the agent
•  And/or avoidable aggravation, distress and inconvenience.

Information on average awards can be found in our Annual Reports.

What if I do not agree with the Ombudsman’s decision?

If you do not agree with our proposed decision you are able to appeal if you can show that there is a significant error in fact or where you can produce significant new evidence that will have a material effect on the decision.

Having considered any representation, we will respond to you advising accordingly. At this stage, and having provided both parties with the opportunity to represent, we will be in a position to send a copy of our decision to both parties for their consideration and response.

Following on from this, should the complainant accept the decision, it will then become binding on you.

What if the complainant does not respond to the proposed decision?

If we have not heard from the complainant by the due date, we shall assume their non-acceptance and advise you accordingly. Any award will then lapse and the case will be closed. If you submitted an original company file this will be returned to you.

By not responding and effectively not accepting our decision, the complainant’s legal rights are not affected and they will be free to pursue their complaint elsewhere.

Having not been accepted, our decision will no longer be valid and cannot be used to support any further action.

What if the complainant does not accept the decision?

If the complainant does not accept the decision, we will write to you advising accordingly and the case will be closed. If you submitted an original company file this will be returned to you.

By choosing not to accept our decision the complainant’s legal rights are not affected and they will be free to pursue their complaint elsewhere.

Having not been accepted, our decision will no longer be valid and cannot be used to support any further action.

Awards

What to expect when an award is accepted

Upon receipt of a complainant's acceptance we will write to advise you accordingly. In accordance with the Ombudsman’s Terms of Reference we will ask that you make payment within 28 days. If the complainant has asked that the award be paid by bank transfer, we will ask that they contact you direct to provide their account details (for data protection reasons we are unable to pass these on for them).

We will request that you inform us when the award has been paid, so that we may close the case.

If there are outstanding fees or invoices, the award will only become payable if these have been settled in full within 14 days of the complainant's acceptance of the Ombudsman’s decision and award. Alternatively, they are able to offset the award against the monies owed.

How should the award be paid?

Unless we have received any specific instruction from the complainant regarding payment of the award, then this should be sent directly to them within 28 days.

What if I do not pay the award?

Failure to make payment will be reported to The Compliance Committee of the Property Ombudsman Board. They will consider your non-compliance and determine any disciplinary action in accordance with its terms of reference.

Can the complainant accept the award and still go to court?

If the complainant accepts our decision, they do so in full and final settlement of all the complaints upon which we have made a formal judgement. Therefore, we would not then expect them to pursue the matter any further. 

However, the complainant is free to pursue their complaint through the courts if they have rejected our findings or if we were unable to come to a judgment on the matters alleged within the complaint that they considered.

When the complaint is allocated

What if I have further evidence?

You have a responsibility to provide all documentation relevant to your defence, at the time of submitting your company file.

If you have further evidence which has not been submitted at this stage, you should contact us at the earliest opportunity.

Please be aware, after we have issued our proposed decision they will not usually consider any documents at the representation stage that you could have submitted at the review stage, as this would not constitute ‘new’ evidence. It is therefore within your interests to provide all relevant documentation at the outset.

How will the Ombudsman judge the complaint?

We will carry out our review based on evidence presented to us. We arrive at our decisions by taking into account legal principles, the relevant Code of Practice and what in our opinion is fair and reasonable in the circumstances.

For agents who do not follow a TPO Code of Practice, we will make a decision based on our best practice guidance and TPO’s general membership obligations.

More Articles ...

  1. When we receive a complaint
  2. Your final response
  3. Investigating and dealing with a complaint
  4. TPO Conference 2018