Personal data, Commissioner investigation offices of real estate broker

2024-04-01 08:26:50, Aktualitet CNA

Real estate brokerage offices have become the object of investigation by the Office of the Commissioner for the Right to Information and Protection of Personal Data.

In a recently issued recommendation, this office requests that they be taken into account by Controllers in the real estate administration and brokerage sector.

"The Commissioner's Office, during its monitoring activity on the implementation of the obligations of the Law by the Controllers, has noticed a concern regarding the legality of the processing, security and preservation of the confidentiality of personal data.

This concern has been ascertained from various sources, but also with the institution's own indications regarding the processing processes of the Controllers operating in this sector, this is due to the increase in their activity and at the same time the amount of personal data they process", it is stated in the document.

According to the Commissioner, the monitoring of personal data processing processes of Controllers in the real estate brokerage sector, based on the importance of this data, but also from the fact that there is a very high number of Controllers operating in this field, who process personal data in large quantities, in fulfillment of legal obligations according to the provisions of specific legislation, has brought the need for increased attention in the framework of guaranteeing legal processing, security, maintaining confidentiality and respecting the principles of legal processing of personal data, as well as guaranteeing the rights of data subjects.

Problems after administrative investigations

The commissioner's office has listed some problems encountered during the administrative investigation of real estate brokers.

- In the framework of the activity they perform, Controllers process personal data for the categories "customers", "employees", "agents", "visitors", "job candidates", etc., manually and electronically. It turns out that, in many cases, the Controllers have not provided deadlines for the storage of personal data that are processed (eg, of agents and customers) in excess of the purpose of the processing, contrary to one of the principles on which data protection is based personal, provided for in letter "d", point 1, article 5 of the Law.

- It is established that, on the official website of the Controllers, as well as on the platforms "Facebook" and "Instagram", administered by them, among others, the data of the agents such as: "name", "surname", "No. phone", "photo of the agent", etc. The controllers have not been able to document that they have received the consent of the data subjects "franchise network agents", for the publication of their data, contrary to the principles of personal data protection and legal criteria for data processing, provided for in articles 5 and 6 of the Law

- It turns out that the Controllers have published on the official website "Privacy Policies", however they refer to the standard privacy policy model of the "Franchise" provider (parent company), as well as data subjects (customers, visitors, employees, agents, etc.) are not informed in the Albanian language about the scope and purpose for which the personal data will be processed, about the method of processing, the right to access, the right to delete and/or correct his data, etc., contrary to the provisions of Article 18 of the Law

Likewise, the Commissioner assesses that the Controllers have not taken concrete measures within the framework of the training of employees who have access to and process personal data in relation to the legislation in force for the protection of personal data. Also, non-fulfillment of the obligations related to the establishment, administration and maintenance of the Information Security Management System (ISMS) regarding the protection of personal data, provided for in Instruction no. 47 of the Commissioner.

Recommendations from the Commissioner:

1. Controllers, to pay attention to the processing of personal data, in accordance with the provisions provided in Chapter II of the Law;

2. Controllers, pursuant to articles 5 and 6 of the Law, take measures to destroy data stored/collected in excess of the processing purpose for which they were collected, as well as guarantee the consent of data subjects "Agents" for publishing their data on websites;

3. Controllers to take measures to determine the time limits for data storage, for all processing processes, in accordance with letter "d", point 1, article 5 of the Law;

4. Controllers, to take measures to fully inform data subjects, regarding the purpose and method of data processing, according to the provisions of Article 18 of the Law;

5. Controllers, to take measures to review cooperation agreements with processors, specifying the obligations between the parties, and to continuously monitor their implementation, according to the provisions provided in Article 20 of the Law and Instruction no. 19 of the Commissioner;

6. Pursuant to Articles 21 and 22 of the Law, to fulfill the obligation for notification by the Controllers, who have not implemented this obligation for the first time, as well as to continue to be careful in updating the notification for the change in the status of notification of previously notified processing;

7. Controllers, pursuant to Article 27 of the Law, draft Regulations "On the protection, processing, storage and security of personal data", providing for concrete technical and organizational measures for the protection of personal data, methods of data processing , rights of data subjects, etc.;

8. Controllers, in order to guarantee the security of personal data, must implement the obligations defined in Instruction no. 47 of the Commissioner, regarding the training of employees who have access to personal data and the creation, maintenance and administration of the Information Security Management System (ISMS) for the protection of personal data;

9. The Ministry of Justice, in the capacity of the authority responsible for the supervision of the general activity of real estate brokers, must take measures to address to all Controllers and Processors of this sector, the recommendatory obligations arising from this act of the Commissioner , within the time limit of 90 (ninety) days, starting from the date of receipt of this act;

10. In case of non-fulfillment of these obligations, the Commissioner acts according to article 30, point 2 of law no. 9887, dated 10.03.2008 "On the protection of personal data", amended. The Commissioner, in case of serious, repeated or intentional violations of the Law by a controller or processor, especially in repeated cases of non-implementation of his recommendations, imposes a fine sanction for administrative offenses and publicly denounces or reports the case to the Assembly and to Council of Ministers./ Monitor.al