A prospective buyer initiated the facilitated purchase of a property through a real estate intermediary. Shortly after this, the vendor of the property withdrew from the sale. As part of the purchasing process, the prospective buyer had provided a copy of their ID, proof of address and bank details to the real estate intermediary. Following the breakdown in the process, the prospective buyer sought the erasure of their personal data pursuant to Article 17 of the GDPR.

The prospective buyer initially submitted this erasure request to the email address listed on the real estate’s privacy policy, but this ’bounced back’ as the email was not active. The prospective buyer then sent the request to the primary email address of the real estate intermediary.

As no response was received from the real estate intermediary, the individual made a complaint to the DPC. Following the intervention of the DPC, the real estate intermediary engaged with the individual concerning their erasure request. However, during the complaint handling process, the DPC established that the organisation concerned refused to comply with the erasure request. According to the organisation, it was relying on an obligation under the Property Services (Regulation) Act 2011, which created a legal requirement to retain the data for six years. The matter was referred to the Property Services Regulatory Authority for clarity, who advised that bank details were not covered by the wording of the Act and could be deleted on foot of an erasure request.

Following this confirmation, the DPC engaged with the real estate intermediary to ensure that the bank details were erased as part of the erasure request. The DPC informed the prospective buyer that certain other items of personal data, such as their name, address and contact details would not be erased as the real estate intermediary had a lawful basis to restrict the right of erasure in line with the Property Services (Regulation) Act 2011. The DPC also ensured that the real estate intermediary updated its privacy policy to accurately reflect the appropriate point of contact.