When the new General Data Protection Regulation (GDPR) comes into effect on 25th May 2018, you’ll need to have established a process to make sure that all personal data that you hold and pass on to third parties is altered or deleted as requested by the individual whose data you hold.
The same goes for data that we pass on to you. So for example, when we receive a request from an individual based on their “right to erasure”, we need to send notifications on to any third parties who we’ve passed the personal data to. Then, those third parties must also alter that individual’s information, as requested. We have to keep a written record that this notification has been given. This process is known as “Downstream Notification”
In the case of Rightmove, the majority of downstream notifications that we might send you will relate to the personal data of house-hunters that we would have sent you in a lead.
When a house-hunter contacts us and asks for their details to be deleted or altered, we’ll check who we’ve passed their details onto through a lead. By law, we have to inform house-hunters of who has their data. If you’ve received that house-hunter’s data, we’ll be in contact with you so that you can also alter their data in your records.
We’ll remind you that the house-hunter will be notified that the request has been passed on to the relevant agent or developer who received their data.
This is what you should expect:
We’ll notify you of the request by email and remind you that you have 30 days to action it
When we tell the house-hunter that we’ve started the downstream notification, we’ll also give them the date of that notification.
We’ll record that we’ve notified you of the request.
Email 2 – 7 days later
If we don’t hear back from you, we’ll send you a second email and record that we’ve sent it.
Email 3, the final notification – 14 days after the first notification
We’ll give you a reminder of the deadline and warn you this will be our final notification that you need to take action.
Let us know you’ve taken action
If you let us know that you’ve have actioned the request, either via your Account Manager or via our Customer Support Team we’ll stop sending you reminder emails.
You may want to map out how your company plans to handle incoming downstream notifications from companies like Rightmove, get the relevant advice and train your team accordingly. You’ll also need to consider how your own company will notify any third parties that you share data with so you’re prepared for a process of your own that is compliant with the GDPR.
Please be aware that the content of this article is meant to help your understanding of GDPR, but does not constitute legal advice. You should always seek out your own independent legal advice for specific queries. Also, keep in mind, your downstream notification process may need to be different to the process described above.