Can an Entity Renting Premises to a Natural Person Require the PESEL Number to Be Included in the Agreement?

ANSWER

In accordance with Recital 18 GDPR, its provisions do not apply to the processing of personal data by a natural person in the course of a purely personal or domestic activity — that is, one not connected with professional or commercial activity. If, therefore, a person renting out a dwelling does so as a private individual (not as a professional undertaking whose business consists of letting dwellings), the provisions of the GDPR do not apply to that situation. The parties are thus free to determine the content of the tenancy agreement and the scope of personal data recorded in it. If, however, the landlord is an undertaking whose business consists of renting premises to natural persons, they will be a data controller within the meaning of Article 4(7) GDPR and will accordingly be required to comply with all the obligations imposed on data controllers by the GDPR. Nevertheless, the GDPR does not in any of its articles specify what personal data a data controller may or may not process. The data controller determines in each case what personal data is necessary for the relevant processing purpose, and it is accordingly the controller who bears the obligation to ensure appropriate protection of the personal data it processes.

With regard to the question concerning the PESEL number, it should be noted that the inclusion in a tenancy agreement, by a data controller, of personal data such as name and surname, address of residence, PESEL number, and contact details (telephone number or e-mail address) is proportionate to the processing purpose. The PESEL number is the only item of personal data among those listed that enables an unambiguous identification of a natural person. Including such personal data in a tenancy agreement will not breach the provisions of the GDPR, specifically Article 5(1)(c) GDPR, i.e. the data minimisation principle.