Amsterdam housing crisis – your privacy at stake!

Not only those who are trying to find their living place in Amsterdam are aware of the ongoing crisis – looking for an apartment in the city is an exhausting journey. Protests in September gathered more than 15.000 people together with organisations, political parties, trade unions, and housing corporations. The situation is especially hard for those without a permanent work contract such as international students. Most of the real estate agents, explicitly exclude those groups from the possibility to even apply for a viewing, stating on their websites that the “4 times rent salary requirement” applies, without any exceptions. Some of them accept guarantors (for example parents). Sadly, a minority of them agree on the guarantors who live abroad. In this uneven battle, several business practices raise legal concerns. But does the dependent position of a people who will do anything to sign a dream contract could affect their rights and freedoms, such as the right to privacy? In this article, I would like to present some common customs, used by real estate agencies in Amsterdam, which are not only unethical - but to some extent not compliant (!) with, for example, the GDPR. So, how does this uneven fight look like in light of current legislation?

Show me your payslip - and I'll tell you who you are

Wednesday evening in the nice area of green Oosterpark in Amsterdam. Arrived on time to see a 1-bedroom apartment with my boyfriend. This was not my first viewing, so I was not surprised by the crowd of people who came to do the same. Together with another 20 (?) couples, we took some pictures and expressed our interest. A weary woman presented clear conditions. The interested parties must provide the required documents within 3 working days. To be provided: work contract, 3 payslips, 3 bank statements. No questions about a short introduction or any other information. Just clear data about how much you earn. Both of you. Despite the cosmic rental price - each of the couples declared to provide relevant documentation. Hypothetically, in one evening, the agent received 40 work contracts, 120 payslips, and 120 bank statements. All this was sent to an email address, without the use of any security software - from people desperately looking for a place to live, without being aware of possible (data protection-related) dangers. Naively, my papers were sent as well. Unfortunately, as expected - my candidacy was declined. No feedback whatsoever, silence from the agency and a red banner on their website: 'apartment rented’.

Common procedure

I have experienced such situations several times in the following weeks. Only a few (2/10) agencies asked for documents to be submitted using the proposed software. The amount of personal data required, however, remained unchanged. One of the companies requested statements from the Dutch website ‘UWV’. Out of curiosity, I downloaded the required document, and to my surprise, it contained 8 (!) pages of my financial history, starting from 2012. Is it really necessary to see where and for how much per hour I worked several years ago? Does it make me a worse candidate if I had fast-food experience in my early career? Who has access to this data? Where is it stored? Penalty for refusing to disclose this type of information: no chance to consider the application for renting an apartment. And (in extreme cases) even a rejection to view the apartment. As a person interested in the issues related to the protection of personal data, I decided to analyse the practices used by Amsterdam agencies. At the end of the day, we are five years after the GDPR came into force, and the topic of privacy is more important than ever. By observing the fines imposed around Europe, even for the smallest offences, I was shocked about these practices. The situation seems very suspicious. But what specific legal principles are being violated?

What about the rules on processing personal data?

Based on the GDPR, processing of personal data includes the collection thereof. To make processing compliant, it should be carried out according to clearly defined principles (Article 5 GDPR). The processing should, above all, have a legal basis. In the case of sending the documents voluntarily to the person offering the apartment – a legal basis could be ‘consent’. The law, however, clearly indicates that consent must be ‘freely given’. But considering the relation between a real estate agent and a desperate potential tenant, is the consent still given ‘freely’? During the viewings I met several people who were currently living in hostels, desperately looking for accommodation. Taking into account the ongoing housing crisis, we can clearly see that our will is not independent. Contrary – we are pushed to give up our privacy – otherwise, we might end up living in a hotel. Another possibility is that reliance may be placed on the ‘legitimate interests’ legal basis. Indeed, it is in the interest of the landlord to rent out the place to those who can afford it. But after collecting data from 40 candidates, only two or one of them are actually chosen. ‘Legitimate interests’ could be seen as a legal basis, only when the data is being collected after choosing the right person – just before signing the contract, to confirm the tenant's financial stability - not when it is collected from a crowd, just to choose the person who earns the most.

Other issues are connected to the principles of data minimisation, principle of integrity and confidentiality. According to the principle of data minimisation, processing must be limited to what is necessary for the original purposes of collection. If the purpose of the collection is to assure the rent is going to be paid on time, why do we need to provide the agent with 3 payslips and 3 bank statements? Is the mere job contract not sufficient to prove we can afford the rent? It clearly states our income plus the duration of the work agreement. In extreme cases: the statement from the UWV containing financial history of the past few years (!) – does it really fulfil this principle? Do we really have to disclose how much we were earning two years ago? If it comes to the principle of integrity and confidentiality – data processed should be secured. In my opinion, asking people to send their payslips to the email address, in attachment, is far away from making it secure. What if someone makes a mistake in the mail and documents end up in the wrong hands? Don’t we really have any software to share those files? What is more: where can I see a privacy policy? What about the retention periods?

Further steps

Searching the internet for content on this topic, I did not find anything specific. That is why I decided to take the appropriate steps and file a complaint to AP myself. I chose two agencies that had treated potential tenants in the most brutal way. But: as well as drawing attention to the problem, we should ask ourselves: how can we change the current situation? First, agencies should be pushed to change their tactics. At the first stage of the housing application, candidates should be selected based on a short motivation letter, where they can provide some basic information about who they are and what they do for a living. Only after the selection of a suitable candidate, the person who is willing to sign the contract should provide a document confirming his/her earnings. In addition, the number of documents provided should not be excessive. Perhaps a work contract or eventually one payslip (not 3!) is sufficient to guarantee solvency? I would also like to add that sending all documents, as attachments, by e-mail is a matter of concern. Is it not possible to avoid this practice and use modern software which complies with security standards? Or maybe someone (too lazy to read motivation letters and/or too cheap to invest in a software) is just using the crisis? In the end, desperate people are going to do anything to obtain the right to rent a place – even if their privacy is at stake.