When we talk about data protection laws, we're talking about changes for all companies that handle customer information. This information can include addresses, payment methods, documents, purchasing habits… Any data that can be linked to a person. This means that most sectors of the economy are impacted by the General Data Protection Law, which came into effect in September 2020.
Simply having employee data in an internal database is enough to be impacted by the law once it comes into effect. Many companies that do international business are already familiar with the European data protection law, the GDPR. It requires that external suppliers also protect their data.
Companies.
The impact of the LGPD (Brazilian General Data Protection Law) is no different for the real estate market. This is because these companies handle a great deal of customer data, including proof of income, addresses, bank account details, and other information provided during the purchase, sale, or rental of a property.
Furthermore, real estate agencies often have photos of the actual property that is for sale or rent. This information is very personal and must be kept confidential to maintain client security. Therefore, it is necessary that these files are not stored just anywhere and that access is restricted.
Real estate agencies also have the practice of sharing information, whether among themselves, between brokers, etc. These sharing platforms, which hold customer data, must comply with the LGPD (Brazilian General Data Protection Law) to avoid the fines and sanctions provided for by the law. In other words, it is necessary to verify whether each process involving data complies with the legislation.
In this time of adaptation for real estate companies, it is necessary to invest in a data mappingso that one can get an idea of how much personal information the company has in its database. Then, specialized consultancies and tools facilitate the process of protecting this data and obtaining consent.
How should data be collected in the real estate sector?
There are several legal bases for the collection and processing of personal data in companies. One of them is when the data is necessary for the execution of a contract. In other words, there is no problem in requesting CPF (Brazilian tax identification number), address, and other information when this data will be used in the contract to be signed between the real estate agency and the client. This leads us to the issue of legitimate interest, which is when the data is collected to support and promote activities that benefit the data subject, that are in their interest.
Another legal basis is consent, that is, the client's express authorization for the collection of that data. According to the law itself, it is the "free, informed and unequivocal manifestation by which the data subject agrees to the processing of their personal data for a specific purpose".
A practical example of this is the request for consent on the real estate agency's website, whether for... use cookies or request personal information. If you have a form on your website for customers to request more information about a property, it should contain a checkbox for them to indicate that they authorize the use of their contact information for sending emails, messages, etc.
Data protection and privacy for customers.
With the LGPD (Brazilian General Data Protection Law) coming into effect, it becomes necessary to create policies Internal guidelines for real estate companies regarding data usage will be provided to employees. These guidelines will guide employees on the necessary use of personal data, ensuring that data subjects' rights are protected, as well as their rights to privacy and intimacy.
Companies that do not comply with the LGPD (Brazilian General Data Protection Law) may face penalties for improper data processing. This is already the case in Europe with the GDPR. Here in Brazil, fines can reach up to 2% of annual revenue, with a ceiling of R$ 50 million.
An example of a fine in the sector occurred in Germany: in October 2019, the Berlin supervisory authority issued a fine of €14,5 million against the real estate company Deutsche Wohnen SE for storing tenants' personal data without a legal basis. The company also failed to implement the principle of privacy by design. This was the highest GDPR fine applied in Germany up to that point.
Here in Brazil, the first company A company in the sector was condemned by the São Paulo court, in the first instance, based on the LGPD (Brazilian General Data Protection Law). The construction company Cyrela would have to pay compensation of R$ 10 for sharing a client's data with other companies.
Coming into compliance.
If you own or work in a real estate agency, a tool that can help with LGPD compliance is... website monitoringThe module uses Artificial Intelligence to scan your website for compliance criteria. This allows you to check the level of compliance of your real estate website, as well as visualize the necessary corrections.
The module performs constant, or periodic, monitoring, generating alerts in cases of changes that represent risks or non-compliance with personal data protection laws. Curious to know how it works? [Follow the instructions/provide the link/etc.] free trial from our platform!
