A core element of the General Data Protection Regulation (GDPR) is the so-called “right to be forgotten”. According to the principle of data minimization formulated in the GDPR, landlords are obliged to delete any personal data of current and past tenants and prospective tenants that are not strictly necessary for lease administration purposes or stored for purposes of documented legitimate interests, e.g. for tax or legal defense reasons.
For real estate companies, the right to be forgotten poses a significant challenge: On the one hand, they are responsible for the deletion of such personal data, but on the other hand, an often disorganized and intransparent flood of data makes this a task of formidable complexity and proportions. The implications of this challenge are illustrated by a recent example from Berlin: Following investigations conducted by local data protection authorities, Deutsche Wohnen was confronted with a payment request in the amount of EUR 14.5 million, based on the storage of personal records in violation of statutory requirements. According to media reports, the records in question include income statements, Schufa credit reports and employment agreements, all of which should have been destroyed at the conclusion of the respective lease agreements.
In order to identify and delete such data, EVANA uses its proprietary EVANA AI. The AI scans all digitally available documents for pieces of personal data and applies corresponding filters for subsequent verification and deletion by the client. The algorithm employed has been trained with over 20 million data extraction operations and is capable of recognizing almost all common document types used in the real estate industry. For example, all digitally available salary statements, account statements, tenant self-disclosures, certificates of good conduct, Schufa credit reports, employment agreements and guarantees are automatically detected and prepared for deletion. As such, EVANA AI reduces the significant effort required from property managers and real estate companies under the GDPR.