In a Nutshell

The Commissioner for the Protection of Personal Data in Cyprus, Mrs Irini Loizidou, in a recent presentation of hers, explained and gave valuable guidance on how the provisions of the GDPR apply to the Real Estate and Construction industry in Cyprus. The GDPR introduced strict new rules for companies and businesses in Cyprus and the EU and failure to comply with the GDPR carries with it the risk of hefty fines and penalties.

The EU General Data Protection Regulation

The introduction and coming into force of the EU General Data Protection Regulation 2016/679 (GDPR) created and continues to create plenty of concern, confusion and discussions in Cyprus as to the requirements, standards and rules that businesses collecting and processing personal data need to comply with.

The risk of hefty fines for failure to comply with the requirements of the GDPR and the widespread powers granted to the Office of the Commissioner for the Protection of Personal Data has caused individuals and companies to pay grater attention, update and reconsider their practices and systems as regards personal data they collect and handle.

Real Estate & Personal Data

The Commissioner for the Protection of Personal Data, Mrs Irini Loizidou, in a recent lecture addressed to professionals in the Real Estate and Construction industry, sought to explain and gave valuable guidance on how the provisions of the GDPR apply to this industry.

The Commissioner made clear that the provisions of the GDPR extend to all aspects and all actors of the industry, regardless of whether a proposed transaction (whether it be a sale, an exchange of land, a construction project or other) is completed or not.

Key Takeaways

Some key points of interest that were raised and discussed with the Commissioner were the following:

1. Real Estate Agents, Valuers, Architects and Civil Engineers may be both Data Controllers and Data Processors, depending on their exact roles and responsibilities in a real estate project.
2. The collection of Personal Data of a potential buyer by a real estate agent and the sharing of this information with other agents requires the express consent of the said person (data subject), who needs to be clearly informed to whom and for what purposes his/her data will be shared.
3. The Commissioner expressed her concern as regards frivolous complaints and highlighted that the GDPR should and cannot be used as a pretext or as an excuse to challenge or hinder processes and practices that one does not agree with.
4. The compliance requirements imposed on professionals in the Real Estate and Construction industry by Anti-Money Laundering legislation (AML) and the distinctions and differences between the requirements of AML legislation and the GDPR appear to have created extensive confusion and concern in the market. The Commissioner clarified that the two should not be confused and that compliance with AML legislation does not equate to compliance with the GDPR.

It would appear that businesses and professional service providers in the Real Estate and Construction industry are still struggling with the requirements of the GDPR.

M.Paraschou Law Office is available to assist you to comprehend and put in place the necessary procedures for compliance with the GDPR.