Can a person running a business consisting in renting residential premises (as data controller) require a tenant to provide an income statement?

ANSWER

A person who runs a business consisting in renting flats to natural persons is not entitled to require presentation of an income statement or employment contracts. There is no provision of law giving the landlord such a right, and at the same time from the perspective of personal data protection this entity, understood as the data controller, will process excessive data. Personal data contained in an employment contract or statements concerning income earned are not necessary for the data controller to achieve the purpose of processing, i.e. concluding a lease agreement. In such a case the data controller will breach the fundamental principle arising from Article 5(1)(c) GDPR — the data minimisation principle, which provides that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.