Section 18 of the Multi-Unit Developments Act 2011 requires an Owners’ Management Company (OMC) to establish and maintain a scheme to collect the service charges of its members. Information such as payment of service charges obtained in operating such a scheme constitutes the personal data of the individuals concerned and so must be processed according to the General Data Protection Regulation (GDPR) and Data Protection Act 2018. In line with the principles of purpose limitation, any service charge payment details collected should be only used for that explicit purpose and not further processed in a manner incompatible with those purposes.

Disclosure of some or all of the service charge payment details of members to all members of an OMC (such as at an AGM, or posted around the property) would likely constitute further processing of personal data inconsistent with the original purpose. In the absence of the consent of the individual concerned, it is unlikely a valid lawful basis exists for disclosing service charge payment details (including underpayments) to all/some members of the OMC. It is also unlikely an OMC can rely upon a legitimate interest to disclose service charge details to all its members.

Section 22 of the Multi-Unit Developments Act 2011 provides for recovery of non-payment of service charges. This provides a legitimate basis for an OMC to process personal data relating to non-payment of service charges where necessary and proportionate in a debt recovery process, through a debt collection agency or court.

For more information, read our guidance on data protection considerations relation to multi-unit developments and owners’ management companies.