Clarifying consent for the Commitment to Refer

We have updated the Commitment to Refer guidelines to clarify the process around consent.

Developed in partnership with Department for Levelling Up, Housing and Communities (DLUHC), the Commitment to Refer is a voluntary commitment made by housing associations. By signing it, housing associations make a commitment to refer an individual or family to a local housing authority if they are homeless or threatened with homelessness. This supports the aims of the government's Homelessness Reduction Act through attempting to prevent the household from becoming homelessness.

Housing association feedback on the Commitment to Refer raised that concerns around data protection and that the concept of consent can be a barrier to using the Commitment to Refer. We have sought advice from NHF members and from the Information Commissioner’s Office (ICO) to understand the issue better.  As a result of these discussions we have updated the Commitment to Refer guidance to make the difference between consent to referrals and consent to data processing clearer.

What is the issue with consent?

The Commitment to Refer is modelled on the government Duty to Refer. The Duty to Refer guidance requires consent to be given for the referral to the local authority: to the referral itself and to the disclosure of their contact details to a local housing authority.

In line with this, the Commitment to Refer requires individuals to consent to being referred to the local authority. The word “consent” has been interpreted as being consent in the data protection sense, which comes with legal implications. These perceived legal implications have been a barrier to using the referral mechanism and have prevented housing associations signing up to the Commitment to Refer.

Our discussions revealed that the meaning of consent could have been misinterpreted and unnessarily being considered a legal barrier. Someone consenting to a referral is not the same as someone consenting to processing personal data. This means that the person does have to agree to being referred, unless there is a safeguarding reason to refer them without agreement, but this agreement is not governed by the Data Protection Act 2018 or UK GDPR.

A personalised approach to encourage consent

Sometimes non-consent can be because of non-engagement, attributed to tenant vulnerability or avoiding landlord enforcement. Housing associations have been updating their approaches to income collection, with person-centred, trauma informed approaches. This personalised approach has impoved tenant engagement and may encourage agreement to a referral.

What has changed in the guidance?

As a result of these discussions we have updated the Commitment to Refer guidance. We have made the difference between consent to referrals and consent to data processing clearer, and given advice on how to overcome any barriers.

So, where does data protection fit in?

The Data Protection Act 2018 (DPA) and UK General Data Protection Regulation (GDPR) are still relevant when it comes to processing data. While whether someone has said yes or no to a referral is not personal data, collecting or sharing personal details is and so the legal requirements remain relevant.

In terms of data protection, i.e. collecting details of a person prior to the referral and sharing them with the local authority, the two main legal bases available to housing associations are consent and legitimate interests.

For consent to be valid as a lawful basis for processing personal data under data protection law, it has to be freely given and fully informed - and the individual must be able to withdraw it at any point. The ICO has advised that using consent as the legal basis for data processing is not appropriate where there is an imbalance of power (because the person cannot be assumed to have given consent freely without constraint). Because of this, housing associations should explore other lawful bases for processing data.

“Legitimate interests” is one lawful basis for data processing that some housing associations have identified as being of potential use for referrals, as sharing the information to make the referral is clearly linked to their goals, e.g. to improve social justice and play their part in reducing homelessness. Hazel O’Halloran, Homelessness Lead at Bromford wrote a blog detailing their motivations for signing the Committment to Refer.

If you plan to use legitimate interests as the legal basis for data processing, work through the tests set out in the ICO guidance and discuss the matter with your Data Protection Officer (DPO).

When it comes to signing up to the Commitment to Refer, therefore, while the consent to refer someone does not fall under GDPR, data processing still needs to be anchored in a legal basis. Legitimate interests can be a potential alternative to the problematic concept of consent where there is an imbalance of power.