How is personal data protected?

This article was written with Kumudithe Perera, a lawyer specialising in new technologies and a data protection officer.

What is the RGPD?

The GDPR (General Data Protection Regulation) is a European law that applies to all organisations and professionals who use personal data: companies, associations, public services, institutions, etc.

What is the purpose of this regulation?

It imposes strict rules on the organisations that collect and dispose of this data. It serves to protect the privacy of every individual living in Europe. Instead of talking about protection of privacy, the legislator preferred the term "personal data", i.e. any direct or indirect information relating to a person: surname, first name, age, address, personal e-mail, professional e-mail, telephone number, etc.

How does the RGPD apply to real estate?

All data provided by a client is protected by the RGPD, whether he or she is a seller, buyer, owner or future tenant. Apart from the real estate agent handling the transaction, no one is allowed to arbitrarily consult the file and the sensitive information it may contain: salaries, assets, etc. In the case of a real estate transaction, a lot of private information is required.

How are they protected?

The RGPD obliges agencies to put in place technical measures to guarantee the security of this data: password, storage in a locked cabinet, etc. In the case of a real estate transaction you must provide the information required by law and necessary to prove your eligibility to rent or buy a property. To personalize your search, you can also indicate other criteria: lifestyle, work habits, children, taste for contemporary or old stones, etc. There is no law requiring you to provide this information, but it is useful and legitimate in order to obtain a quality service.

How long is this data protected?

The retention period varies according to the case: tenant, buyer or seller. In the case of a rental, for example, the agency may keep the data for up to three years after the end of the lease. After this period set by the RGPD, it is obliged to delete this information. Individuals can ask to check that their data has been destroyed. In the case of a sale or purchase, the information provided can be kept for up to five years after the transaction.

How does BARNES secure exchanges with its customers?

BARNES has put in place several solutions to ensure maximum security for its customers' data. Externally, BARNES has selected subcontractors who are experts in the protection of stored information. Internally, the company has called on a DPO (Data Protection Officer) to put in place the technical and organisational measures to comply with the RGPD. Finally, all staff are regularly made aware of the rules on personal data protection and measures against cyber-malware. Employees who have access to a company's internal network are the first "firewalls", they must be trained and involved, which is essential today.