Processing Tenant Data in the Context of a Rental Agreement

Datum

18.10.2024

Številka

5424-1/2024/100

Kategorije

EMŠO in davčna, Informiranje posameznika, Stanovanjsko in nepremičninsko pravo, Uradni postopki

The Information Commissioner (hereinafter referred to as "the IC") received your inquiry via email regarding the question whether the request made by the owner of a rental property to provide your tax identification number, a photo of the first page of your passport, and your EMŠO number (unique personal identification number) is justified?

Based on the information you provided, in accordance with point 5 of the first paragraph of Article 55 of the Personal Data Protection Act (Zakon o varstvu osebnih podatkov, Official Gazette of the RS, No. 163/22, ZVOP-2), Article 58 of Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), and Article 2 of the Information Commissioner Act (Zakon o informacijskem pooblaščencu, Official Gazette of the RS, No. 113/05 and 51/07 – ZUstS-A), we are issuing this non-binding opinion regarding your inquiry.

For processing personal data related to the rental agreement, the most likely legal grounds are contract performance (Article 6(1)(b) GDPR) or fulfilling legal obligations, such as tax reporting (Article 6(1)(c) GDPR).

Based on the data minimisation principle, only the data strictly necessary for conducting the rental agreement or fulfilling the legal obligation may be processed. This means the landlord must limit their request to what is relevant and necessary, provided that they initially have an appropriate and lawful legal basis for such data processing.

While it may be reasonable to collect additional identification data such as your address, date of birth, or EMŠO for identification purposes, these requests should be proportionate and necessary.

The property owner can verify your identity by reviewing official identification documents, but retaining a copy of your passport’s front page may not be necessary.

The landlord is legally required to collect and submit your tax identification number for tax reporting purposes.

The landlord must inform you, in accordance with Article 13 of the GDPR, of the legal basis for collecting your data, the purposes of processing, data retention periods, your rights etc.

You have the right to decide whether to provide the requested personal data. If you choose not to, the landlord may decide not to proceed with the rental agreement.

Explanation

The IC initially clarifies that, within the scope of non-binding opinions, we cannot and must not assess specific data processing activities. The IC could only verify the legality of personal data processing through conducting a concrete inspection or other administrative procedure. Accordingly, we are providing you with our general opinion on the matter addressed in your inquiry.

We emphasize that any processing of personal data (such as providing data to a landlord) must be based on an appropriate and lawful legal basis. These legal bases are stipulated in Article 6(1) of the GDPR:

-Consent of the data subject;

-Necessity for contract performance;

-Compliance with a legal obligation;

-Protection of vital interests;

-Public interest or official authority;

-Legitimate interests, except where overridden by the rights of the data subject.

You can read more about the legal bases at: https://upravljavec.si/kako-uporabljate-te-podatke/kratko-o-pravnih-podlagah/.

In any case, provided there is an appropriate legal basis, only the personal data necessary for the specific purpose may be processed (i.e., shared with the landlord). Every data controller must comply with the principle of data minimization, which requires that personal data be adequate, relevant, and limited to what is necessary for the purposes for which they are processed.

In cases where the data subject is a tenant, the most appropriate legal basis for processing their personal data by the landlord, for purposes of conducting a rental agreement, is typically the rental contract in accordance with Article 6(1)(b) of the GDPR, or legal obligations under Article 6(1)(c) of the GDPR (such as obligations related to income tax from rental income). Only the personal data necessary for the execution of the rental contract or for fulfilling a specific legal obligation may be processed.

For instance, Article 91 of the Housing Act (Stanovanjski zakon, Official Gazette of the RS, No. 69/03 with amendments) outlines the essential elements of a rental agreement, including the names of the tenant and the individuals who will be residing in the rental unit. For identification purposes, it is common to collect not only the tenant’s name but also additional personal data, such as the tenant’s address, date of birth, or even EMŠO.

Furthermore, Article 94(1) of the Personal Data Protection Act (ZVOP-2) authorizes the data controller (landlord) to verify the accuracy of personal data by examining official identification documents. However, personal data must not be used for any other purposes without a lawful basis.

Regarding the collection of a copy of the front page of a passport, Article 4 of the Identity Card Act (Zakon o osebni izkaznici, Official Gazette of the RS, No. 35/11 with amendments) and Article 4a of the Travel Documents Act (Zakon o potnih listinah, Official Gazette of the RS, No. 29/11) both stipulate that the duplication of identity documents is only permissible in cases explicitly provided by law. Since the copying of personal data is allowed solely when the controller is performing a task prescribed by law (Article 94(2) ZVOP-2), requesting a scanned copy of the passport's front page by the landlord conducting a rental agreement may be deemed unnecessary. For further information, please refer to: https://www.ip-rs.si/varstvo-osebnih-podatkov/in%C5%A1pekcijski-nadzor/najbolj-pogoste-kr%C5%A1itve/kopiranje-osebnih-dokumentov-in-prepisovanje-podatkov-iz-osebnih-dokumentov.

In addition, to comply with tax obligations under the Income Tax Act (Zakon o dohodnini, Official Gazette of the RS, No. 13/11 with amendments), the landlord is required to collect and submit the tenant’s name, surname, address, nationality, and tax number, which are necessary for declaring income from property rentals. This is stipulated in the Rules on Forms for Declaring Income Tax Advances and Forms for Declaring Income from Capital and Rental Income (Pravilnik o obrazcih za napovedi za odmero akontacije dohodnine ter obrazcih za napovedi za odmero dohodnine od dohodka iz kapitala in dohodka iz oddajanja premoženja v najem, Official Gazette of the RS, No. 80/19 with amendments). The collection and processing of these personal data by the landlord is therefore legally mandated to fulfill their statutory obligation.

In addition to other obligations, the data controller (landlord) must inform individuals, prior to the collection of personal data, in accordance with Article 13 of the GDPR, about the purposes for which the data will be processed, the legal basis for the processing, the recipients of the data, the storage period, the individual's rights, and other relevant details. More information on informing individuals is available at: https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/ključna-področja-uredbe/obveščanje-posameznikov-o-obdelavi-osebnih-podatkov.

Based on the provided information, individuals can decide whether to share their personal data. If however, the data is not provided, the landlord may decide not to enter into a rental agreement with the individual.

Considering your question, we recommend that you first contact your landlord and request information about the intended processing of your personal data, including which data is required, the purposes for processing, the legal basis for such processing, and how long your data will be stored.

If, after receiving a response from the data controller, you believe your data protection rights have been violated, you may submit a complaint to the IC by email at gp.ip@ip-rs.si, or by regular mail at “Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana”. You can also file a complaint using the form available on the IC's website: https://www.ip-rs.si/varstvo-osebnih-podatkov/pravice-posameznika/vlozitev-prijave.

We hope this response has addressed your question. Best regards,

Prepared by

Grega Rudolf, mag., International Relations Advisor

dr. Jelena Virant Burnik, Information Commissioner of the Republic of Slovenia