Social landlords: A model of discretion

Landlord Expert
By Landlord Expert June 21, 2011 10:13

It’s his job to police all organisations that handle public data. Christopher Graham, the information commissioner, tells Simon Brandon why he’s got his eye on the housing sector. Photography by Simon Brandon

‘The housing sector needs to wake up.’ As the information commissioner, Christopher Graham is the man who, for the past two years has policed data protection in the UK and punishes those who get it wrong. And right now he’s looking your way.

‘Social housing is very much on our radar,’ he states when Inside Housing goes to meet him at the Information Commissioner’s Office in Wilmslow, Cheshire, last month. His message to the housing sector is clear: ‘It seems to us that there is very little awareness of data protection within the sector, with a few honourable exceptions. If we lift this particular stone we might find some nasty things under it.’.

Strong words - and Mr Graham is deadly serious. ‘The sector has to realise that it is holding highly sensitive personal information,’ he warns, ‘and if it isn’t giving a high priority [to data protection] then accidents are bound to happen.’

Coventry-based housing association Orbit Group is one of Mr Graham’s aforementioned ‘honourable exceptions’. Around four years ago the 34,500-home landlord had a near miss when some files containing sensitive data went missing. They were recovered without incident, but the episode was enough to scare it into thoroughly examining and tightening its data protection responsibilities. Now it has developed a toolkit to help other social landlords in this area.

The Chartered Institute of Housing also realises the need for housing providers to step up their game in relation to data protection. It is holding its first Data Protection Conference on 22 September in London.

Efforts to raise the importance of data protection among housing providers cannot come too soon - social landlords need to step up their game, and fast, says Mr Graham, who doesn’t seem the type to be unnecessarily alarmist. He comes across as friendly and open, but genuinely concerned about the need to impress upon social landlords the importance of protecting the data they hold on the members of the 4.87 million UK households whose homes they own.

Before taking over at the ICO in 2009, Mr Graham was in charge of the Advertising Standards Authority. He began his career as a journalist at the BBC: ‘I hope I have retained the nose for a good story, the persistence necessary not to take no for an answer, and I hope a bit of a crusading spirit,’ he says.

New technology

Recalling his days working for Auntie, Mr Graham points out how quickly the way organisations handle data has changed, first through the development of computer software and then the internet.

‘I do remember sitting next to then-director general of the BBC, John Birt, at a meeting after the summer holidays,’ Mr Graham smiles. ‘John said: “Online is the future. It is the third broadcasting medium and we need to deal with this.” I got quite impatient. It seemed to be visionary rubbish. And now look at us.’

That conversation took place in 1996. The ways in which we live and conduct our personal and business affairs has shifted enormously over the intervening 15 years. Those organisations whose data protection policies and safeguards have not kept pace with this change need to take action, Mr Graham suggests.

Social landlords’ customers’ personal data could be compromised in any number of ways. An unencrypted laptop burgled from an employee’s house; a USB stick left in a taxi; an over-helpful employee at the end of the phone, who is so eager to help, they give away information they shouldn’t. ‘I read recently that Johnsons, the cleaners, has a huge collection of USB sticks that were left in suit pockets when they were taken for dry-cleaning,’ says Mr Graham.

Tenants’ records that once filled a row of filing cabinets can now be saved on a tiny memory stick. You cannot leave a filing cabinet in the back of a cab, at least not very easily. Modern data storage is much more precarious.

In 2007, HM Revenue & Customs lost the personal details, including bank accounts and addresses, of 25 million people - almost half the UK population - when two CDs went missing in the post. Earlier this year, a BP employee misplaced an unencrypted laptop containing the insurance details of around 13,000 residents living in Louisiana, USA, who were making claims connected to the Deepwater Horizon oil spill. Even the most sensitive data is at risk of falling into the wrong hands, and social landlords are sitting on reams of the stuff.

Social housing providers’ roles have changed along with technological developments. They are no longer simply property managers; today a social landlord might liaise and share its tenants’ personal information with a number of other agencies, explains Mr Graham. As the housing sector’s responsibilities have expanded, so has the amount and type of personal information held about tenants - and the risks associated with a breach in data protection. Much more is at stake.

‘As public services are increasingly being delivered in a joined-up way, the pressure for information sharing between housing, social services, education and perhaps with law enforcement is going to become more and more pressing,’ Mr Graham warns. ‘If you are not sharp about the way you handle personal information there are disasters waiting to happen.’

‘The worst case [for tenants] would be identity theft,’ says Mr Graham. ‘That could have a very big impact on benefit claimants, for example. But the personal information that social housing authorities hold could be very sensitive stuff. It might be that the family was in trouble, marital difficulties, kids in trouble at school.’

The price of failure

The repercussions for tenants of a data breach could be awful, but what about the organisation responsible for safeguarding that data? The ICO has powers to issue fines of up to £500,000 the most serious incidents, a sanction Mr Graham describes as ‘the big stick in the cupboard’. The largest yet issued has been £100,000, which was issued to Hertfordshire Council after it faxed details of a child sex abuse case to a member of the public - a thumping sum, especially in these difficult times, but this financial penalty is still not the biggest stick threatening organisations with a lax attitude towards protecting their customers’ data: landlords’ reputations, hard-won and invaluable, are in jeopardy.

‘All the hard work you have put in to be seen as responsible, caring and tenant-focused will go out of the window as soon as you trash someone’s personal data,’ Mr Graham says. ‘The fine is unwelcome, but the publicity that goes with it is a killer.’

It may seem that the housing sector has been given a good telling-off, but Mr Graham describes the ICO as a ‘positive regulator’, much more interested in helping avert catastrophe than waiting for mistakes to happen and then pouncing. ‘There are all sorts of resources we can provide - the ICO website is a very good place to start,’ he says.

His wake-up call is clear though. ‘Orbit learned the hard way, and we want other organisations to learn from that,’ says Mr Graham. ‘Somebody from each organisation has to put a sufficient priority on this before it becomes a problem - because when it’s a problem, it’s usually too late.’

Landlord Expert
By Landlord Expert June 21, 2011 10:13


Recent Member Comments

  • User AvatarDave Osbourne { Had a blocked gully which tenant ignored after recent rain had the lounge and hall partly flooded the floor is going to be replaced but... } – Oct 16, 4:47 PM
  • User AvatarFiona Bullock { Dear Sir, I have received a text and email from my tenants saying they wish to end their tenancy of 3 years with effect from... } – Jul 05, 12:55 PM
  • User Avatarchristine clare timmins { Hi Rahima - Did you manage to resolve your problem? I am new to this site and saw your dilemma - we are about to... } – Jun 28, 9:12 PM
  • User AvatarShani Zvi { Hey, I need an advise regarding the TDS registration. The agency I'm working with claims that they need to register the tenant Zero Deposit scheme... } – Jun 04, 11:43 AM
  • Amanda Harrison { Advise needed }
  • Older »

News Archive