National Housing Federation updates guidelines on ‘Commitment to Refer’ in bid to address data protection concerns, overcome barriers

The National Housing Federation (NHF) has updated the ‘Commitment to Refer’ guidelines to clarify the process around consent.

Developed in partnership with the Department for Levelling Up, Housing and Communities (DLUHC), the Commitment to Refer is a voluntary commitment made by housing associations. By signing it, housing associations make a commitment to refer an individual or family to a local housing authority if they are homeless or threatened with homelessness.

“This supports the aims of the government's Homelessness Reduction Act through attempting to prevent the household from becoming homelessness,” the NHF said.

The Federation said housing association feedback on the Commitment to Refer had raised concerns around data protection and that the concept of consent could be a barrier to using the Commitment to Refer.

It said it had sought advice from NHF members and from the Information Commissioner’s Office (ICO) to understand the issue better.

By updating the Commitment to Refer guidance it is seeking to make the difference between consent to referrals and consent to data processing clearer, and give advice on how to overcome barriers.

The NHF said: “The Commitment to Refer is modelled on the government Duty to Refer. The Duty to Refer guidance requires consent to be given for the referral to the local authority: to the referral itself and to the disclosure of their contact details to a local housing authority.

“In line with this, the Commitment to Refer requires individuals to consent to being referred to the local authority. The word “consent” has been interpreted as being consent in the data protection sense, which comes with legal implications. These perceived legal implications have been a barrier to using the referral mechanism and have prevented housing associations signing up to the Commitment to Refer.”

The Federation said its discussions had revealed that the meaning of consent could have been misinterpreted and unnecessarily being considered a legal barrier. “Someone consenting to a referral is not the same as someone consenting to processing personal data. This means that the person does have to agree to being referred, unless there is a safeguarding reason to refer them without agreement, but this agreement is not governed by the Data Protection Act 2018 or UK GDPR.”

The NHF suggested that sometimes non-consent could be because of non-engagement, attributed to tenant vulnerability or avoiding landlord enforcement. “Housing associations have been updating their approaches to income collection, with person-centred, trauma informed approaches. This personalised approach has improved tenant engagement and may encourage agreement to a referral.”

The NHF statement goes on to discuss how data protection fits in. It noted that the Data Protection Act 2018 (DPA) and UK General Data Protection Regulation (GDPR) are still relevant when it comes to processing data. “While whether someone has said yes or no to a referral is not personal data, collecting or sharing personal details is and so the legal requirements remain relevant.”

The NHF said: “In terms of data protection, i.e. collecting details of a person prior to the referral and sharing them with the local authority, the two main legal bases available to housing associations are consent and legitimate interests.

“For consent to be valid as a lawful basis for processing personal data under data protection law, it has to be freely given and fully informed - and the individual must be able to withdraw it at any point. The ICO has advised that using consent as the legal basis for data processing is not appropriate where there is an imbalance of power (because the person cannot be assumed to have given consent freely without constraint). Because of this, housing associations should explore other lawful bases for processing data.”

The NHF said “Legitimate interests” was one lawful basis for data processing that some housing associations had identified as being of potential use for referrals, as sharing the information to make the referral is clearly linked to their goals, e.g. to improve social justice and play their part in reducing homelessness. It pointed to a blog written by Hazel O’Halloran, Homelessness Lead at Bromford, detailing their motivations for signing the Committment to Refer.

“If you plan to use legitimate interests as the legal basis for data processing, work through the tests set out in the ICO guidance and discuss the matter with your Data Protection Officer (DPO),” the NHF said.

“When it comes to signing up to the Commitment to Refer, therefore, while the consent to refer someone does not fall under GDPR, data processing still needs to be anchored in a legal basis. Legitimate interests can be a potential alternative to the problematic concept of consent where there is an imbalance of power.”