Can a Community Manager Disclose the Dues Payment Status of the Tenant to the Homeowner?

Pursuant to article 22 of the Turkish Condominium Law, those who take continuous benefit from one of the independent sections based on rental contract, right of residence, or any other reason are jointly and severally liable for the expenses and advances and damages for delay which the homeowner has to pay pursuant to article 20.

 
Is it a violation of GDPR When the Community Manager Discloses the Debt of the Tenant to the Homeowner?

Can a Community Manager Disclose the Dues Payment Status of the Tenant to the Homeowner?

Personal Data Protection Board announced a very topical decision that is of particular concern for community and site managers.

The case, in which the community management has informed the jointly and severally liable homeowner about the debt of the tenant, has been taken to the board as complaint pursuant to the above mentioned articles of the Turkish Condominium Law.

In the case that was taken to the Personal Data Protection Board, the tenant had applied to the community management as the data controller, asking for information as to whether he has been clarified about the processing of personal data, claiming that he has received an SMS from the homeowner regarding the payment of dues and that his personal data has been disclosed by the community management to the homeowner but he had not given consent to the disclosure of his personal data to the latter. In response to the said request, the community management stated that the personal were disclosed upon the request of the homeowner. Then, the tenant applied to the Board as no explanation regarding the clarification liability or open consent had been made and asked for an administrative fine to be imposed on the community management.

The issue was discussed by the Personal Data Protection Board and reflected upon in the decision no. 2020/755 dated 29/09/2020.

What is the tenant complainant about here?

The petition of complaint the tenant submitted to the board is shortly as follows: the tenant received an SMS from the homeowner informing that the monthly dues have been either partially paid or not paid at all; this SMS proved that his personal data was processed illegally as the related person had neither been informed about nor given consent for the disclosure of his personal data by the community management to the homeowner. Accordingly, the tenant exercised his rights stipulated in article 11 of the GDPR by applying to the community management as the data controller and asked for information as to whether he has been made any clarification about the processed/disclosed personal data. The community management stated in return that the monthly due payment information of the related person was disclosed upon request of the homeowner, but no document or proof of legal compliance was available to indicate that a clarification had been given to or open consent had been obtained from the related person. So, a request was placed by the tenant for the imposition of administrative fines upon the community management. 

What was the result of the complaint and its justification?

The justification of the result is laid out in paragraph (2) of article 5 of the Law titled “The conditions for processing personal data”, which stipulates that “it is possible to process personal data without seeking for open consent of the related person in case of the presence of either one of the conditions where data processing is a must for establishing, using, or protecting a right, or data processing is a must for the sake of the legitimate interests of the data controller, on the condition of keeping the basic rights and freedoms of the related person free from harm". In consideration of the prevalence of the provisions in article 22 of the Condominium Law and the fact that homeowner and tenant are jointly and severally liable for common expenses and damages for delay. The complaint was  rejected since no legal procedures were applicable with regard to the said complaint as it is of interest for both the homeowner and the community manager when the homeowner is informed whether the tenant has paid the respective part of the common expenses of the occupied unit, e.g. monthly dues. Data sharing was done within the frame of establishing, using, or protecting a right, and the response given by the community manager to the claims of the related person (tenant) was ruled to be sufficiently clear.

In conclusion; it was considered that since the case in which the property management as data controller disclosed personal data to the homeowner upon the request of the latter the dues payment status, which is the personal data of the related person, was judged in the previous decisions of the board in the scope of establishing, using, or protecting the rights, the property manager is not expected to obtain further open consent of the related person in relation to the said data transfer, and that such transfer does not constitute violation of the Personal Data Protection Law.

We are of the opinion that a clarification will be made soon as to whether this decision shall form the basis for the issue of disclosing the debts of flat owners/residents to the other flat owners or not for the same reason and may be applied by analogy.

You may read the full text of the decision below.

Decision Date : 29/09/2020

Decision No : 2020/755

Summary : Disclosure of dues payment status of the related person to the homeowner

The petition of complaint the related person has submitted to the Board is shortly as follows; the tenant received an SMS from the homeowner informing that the monthly dues have been either partially paid or not paid at all; this SMS proved that his personal data was processed illegally as the related person had neither been informed about nor given consent for the disclosure of his personal data by the community management to the homeowner. Accordingly, the tenant exercised his rights stipulated in article 11 of the GDPR by applying to the community management as the data controller and asked for information as to whether he has been made any clarification about the processed/disclosed personal data. The community management stated in return that the monthly due payment information of the related person was disclosed upon request of the homeowner, but no document or proof of legal compliance was available to indicate that a clarification had been given to or open consent had been obtained from the related person. So, a request was placed by the tenant for the imposition of administrative fines upon the community management.

As a result of the examination of the issue, the Personal Data Protection Board has reached the Decision no. 2020/755 dated 29/09/2020, which is as follows;

Paragraph (1) in article 5 of the Law titled “Conditions for processing personal data” stipulates that personal data may not be processed without the open consent of the related person, and paragraph (2) stipulates that processing of personal data without open consent of the related person is possible in cases where processing the personal data of the parties to a contract is a necessity as clearly set forth by laws, is compulsory for protecting the life or the physical integrity of a person who is unable to express his consent for actual impracticability or whose consent is legally invalid or of another person, or is directly related to the execution or performance of a contract; where such processing is necessary for the data controller to fulfil its legal liabilities; where such information has already been publicized by the related person; where data processing is necessary for establishing, using or protecting a right; and where data processing is necessary for the legitimate interests of the data controller on the condition of keeping the basic rights and freedoms of the related person free from harm,

On the other hand, article 22 of the Condominium Law no 634 titled “Warranty of Shared Expenses” includes the provision which stipulates that, “The people, who are users of the apartment either by residence rights or by means of the rental of that particular apartment or by other means, have mutual and solidary obligation upon the expenses on their share, with reference to Article 20 of the law. Nevertheless, the tenant(s)’ liability is limited to the rent that he has to pay. For this reason the extra payment that he makes is to be reduced from the amount of rent he has to pay".

Considering the fact that the tenant and the homeowner are jointly and severally liable for common expenses and damages for delay pursuant to the above legal provision, it is for the interests of both the homeowner and the community manager when the homeowner is informed about whether the tenant has paid the respective parts of the common expenses of the related flat, such as monthly dues, and therefore such data processing is done within the scope of establishing, using or protecting a right pursuant to item (e) in paragraph (2) of article 5 of the Law no 6698,

In this respect, considering that the data controller has replied the related person stating that the debt information of the related person has been disclosed to the homeowner upon the request of the same, such response given by the data controller to the related person is ruled to provide sufficient clarification for the claims of the related person

and therefore;

Based on the fact that the dues payment status, which is, in nature, personal data of the related person, has been disclosed by the data controller upon request of the homeowner and that such disclosure has been made pursuant to the provisions in article 22 of the Condominium Law no 634; it has been decided that the explanations included in the response letter that the data controller, community manager, has sent to the related person are aimed at clarifying the issues that are claimed by the related person and therefore no legal procedures are applicable with regard to the said complaint.