By its nature client due diligence (CDD) requires the gathering and processing of personal identifiable information. On the one hand regulated firms have to deal with the plethora of legislation and regulations that demand the collection of personal information to perform CDD. On the other hand there is the need to comply with GDPR which places legal limitations on the collection of private information.
The first aim of GDPR is the lawful processing of personal information. Article 6(1) of he GDPR sets out six requirements that must be met in order to lawfully process personal information:
Processing shall be lawful only if and to the extent that at least one of the following applies:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- processing is necessary for compliance with a legal obligation to which the controller is subject;
- processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
This provides 3 legal basis for the collection and processing of personal data for the purpose of CDD:
- Consent is given by the data subject (the client on whom CDD checks are to be carried out)
- To comply with the data controller’s (you) legal obligations
- For the data controller’s legitimate purpose
Gaining consent from your client to collect private information for the purpose of CDD is the easiest method but this does have draw backs as the client can at some point withdraw consent.
For Estate Agency Businesses (EAB’s) CDD is a legal obligation and you are subject to the Money Laundering Regulations (MLR). On that basis EAB’s are able to collect and process private information that is relevant to the CDD requirements in the MLR without the consent of the client. The GDPR also clarifies that obtaining and processing personal information for the purpose of fraud detection and fraud prevention is a legitimate purpose.
EAB’s must also consider HMRC’s guidance note which states:
4.31 If you cannot comply with the customer due diligence measures, you must not:
- carry on estate agency work with, or for, the seller or buyer
- establish a business relationship or carry out an occasional transaction with the seller or buyer
4.32 If you cannot comply with the customer due diligence measures, for example, the individual is not willing to prove their identity, you must:
- terminate any existing business relationship with the seller or buyer
- consider whether to make a suspicious activity report
Provided EAB’s make clear to the client in their terms and conditions that personal data will be collected for the purpose of CDD, what type of information will be collected and that a business relationship cannot exist without completing CDD the potential clashes of GDPR and MLR will be overcome. Include in your terms and conditions that the data may be shared with third parties (for example the transaction counterparty) and you may comfortably process and share the relevant personal data for relevant MLR purposes.
Related Links:
