The first \u201csanction\u201d for an estate agency in Andorra has been announced. The property sector is one of the most important in the Andorran business network, having grown significantly, and it processes a large amount of personal data. This leads to the need for greater precaution regarding the collection, management and storage of personal data by controller and processors.<\/p>\n\n\n\n
The data processing involving this sector usually entails the processing of a significant amount of personal data, some of which is particularly sensitive, such as data on minors, health or that related to administrative or criminal offences.<\/p>\n\n\n\n
The Data Protection Agency <\/strong>(DPA) has therefore produced a preliminary guide<\/a> \u2013 offering guidelines and recommendations to companies and professionals from the property sector in the Principality of Andorra in order to guarantee adequate compliance or to strengthen the programmes for compliance with current data protection regulations. This Guide is essential, given the first \u201csanction\u201d issued to an estate agency in Andorra.<\/p>\n\n\n\n As is generally known, the legal framework governing data protection in the Andorran property sector comprises the Qualified Data Protection Law (LQPD) 29\/2021 of 28 October and its implementing Regulation, Decree 391\/20211 of 18 September (RLQPD), as well as the specific sector-focused provisions involving the property sector. This regulation governs the collection, processing, use, distribution, storage and safekeeping of data. <\/p>\n\n\n\n The preliminary guide <\/strong>lists the principles in data processing for property sector professionals: <\/p>\n\n\n\n The lawful basis for data processing is a legal requirement placed on the controller so that certain personal data may be processed. Lawful basis will basically depend on the purpose of processing and on the category of data processed. The controller may not change the lawful basis as required, but instead must maintain the original choice of lawful basis. <\/p>\n\n\n\n List of cases of lawful basis for the processing of personal data within the property sector: <\/p>\n\n\n\n It is essential to be correctly informed and familiar with the purpose for which the data is to be processed before any processing begins. Any change or modification to the purpose of processing could mean that the lawful basis is no longer suitable for legitimising certain processing activities.<\/p>\n\n\n\n It is therefore important for the controller to regularly review the processing activities conducted, updating the corresponding Register of Processing Activities <\/strong>(RPA), and determining whether any changes have been made to the purpose for which the data is processed. The RPA has proven to offer an effective control of data processing and is able to accredit due diligence in protecting the data processed. An updated RPA provides traceability of the processing activities and transparency for the controlling body.<\/p>\n\n\n\n It is important to note that the processing activities that may be conducted in the property sector may vary depending on the services provided.<\/p>\n\n\n\n The processor is the physical or legal person providing a service for the controller that involves processing personal data on the latter\u2019s behalf. <\/p>\n\n\n\n Data subjects have a series of rights that they may exercise at any time:<\/p>\n\n\n\n The data subject may exercise their right by requesting as such from the controller. <\/p>\n\n\n\n The data protection regulation requires that controllers and processors apply technical and organisational measures that must be adopted, depending on the risk inherent to each type of processing activity performed. <\/p>\n\n\n\n The first \u201csanction\u201d on an Andorran estate was recently made public<\/a> due to its excessive request for data in order to visit an apartment: requesting a residency permit, a bank certificate with references, data on the direct debiting and name of the manager of the account and work-related information, all of which is considered excessive data. The DPA has reprimanded the estate agency, although with no financial consequences to date. The first \u201csanction\u201d was a warning with no financial consequences.<\/p>\n\n\n\n Professionals in the property sector process data of a certain degree of sensitivity, including not only identifying data but also economic-financial data or sometimes user profiling. A strengthening of the precautions regarding the management of this data is therefore required, with the compulsory appointing of a Data Protection Officer <\/strong>(DPO) who, among other duties, establishes clear guidelines regarding the processing of data and acts as liaison with the DPA. An Impact Assessment<\/strong><\/a> may also sometimes be required.<\/p>\n\n\n\n Author<\/strong>: Katia Carneiro (Andorra La Vella).<\/p>\n\n\n\n If you need more information about any aspect of personal data in Andorra<\/strong>, contact us!<\/p>\n\n\n\n <\/p> \n
\n
\n
First \u201csanction\u201d for an estate agency in Andorra<\/h3>\n\n\n\n
<\/ul><\/div>\n