The following is the advice received from the Information Commissioner:
With regards to whether Resident Management Companies (RMCs) need to notify, this would depend on the individual circumstances of each case and, in particular, whether the resident management company does any processing of personal data itself that the professional management agent does not. Therefore, in a clear-cut case where all processing of personal data is carried out by the Managing Agent and the RMC does not process any information itself, it is unlikely that the RMC would need to notify as well. However, if the RMC also does some processing of personal data that goes beyond that carried out by the Managing Agent (e.g. a number of residents are unhappy with the behaviour of one of the other residents, and so convene a meeting to decide what to do about it), then the RMC may need to notify as well. The ICO would consider such activities to go beyond the exempt “core business purposes”.
ICO’s advice would therefore be that RMC’s should speak with the ICO or use their online self-assessment to decide whether they need to notify or not. They do not need to notify with ICO for the activities of any professional Managing Agent that they have contracted (i.e. there is no need for the same processing to e ectively be noticed twice by two different companies). However, if the RMC carries out its own data processing, it may need to notify for this.
It is also worth noting that the requirement to notify only applies to electronic processing of personal data. Nowadays, it is increasingly common for all processing to be carried out electronically (e.g. notes taken on a laptop, tablet or smartphone). However if all personal data is recorded and held manually and is not put onto a computer or other device at any point (e.g. handwritten meeting minutes stored in a ling cabinet), then there would be no requirement to notify.
RMCs as not-for-profit organisations
According to ICO, organisations which are established for not-for-profit making purposes can be exempt from registration. A not-for-profit organisation can make a profit for its own purposes but the profit should not be used to enrich others. Any money that is raised should be used for the organisation’s own activities. As RMCs are not-for-profit organisations they can be exempt. The exemption is narrow and further conditions do apply. The exemption applies to processing which is only for the purposes of:
• establishing or maintaining membership;
• supporting a not-for-profit body;
• providing or administering activities for either the members or those who have regular contact with it
This article is not intended to offer legal advice and no responsibility is accepted for any actions taken from this guidance. If you are uncertain, always seek legal advice.
Further Reading
ARMA Guidance Note 03 General Data Protection Regulation
Still not answered your question? We love questions so fire it at us using the contact details here
Please rate this article so we know how well it answered your question…
