Real estate agencies and the GDPR: client identity and documents

A real estate agent (broker) is an obliged entity under the Lithuanian Law on the Prevention of Money Laundering and Terrorist Financing (PPTFPĮ). The law lists the agent among the “other obliged entities” when it acts on the client’s behalf or helps the client buy or sell real estate (Article 2(10)(9) PPTFPĮ). When the agent intermediates in letting, the law applies only where the monthly rent is equal to or above ten thousand euros (Article 2(10)(9) PPTFPĮ). In our assessment, the size of the agency does not matter here: that point sets no threshold for the volume of business.

So an agency processes two kinds of data, and each needs its own legal basis. It processes client identity data because the law requires it (Article 6(1)(c) of the General Data Protection Regulation (GDPR)). Marketing, viewings and listing photos need a different basis, for example legitimate interest (Article 6(1)(f) GDPR). Below: what the PPTFPĮ and the GDPR require, what changes from 10 July 2027 and what is at stake when something goes wrong.

When, and whose, identity must be established

The agent must identify and verify the client and the beneficial owner before starting a business relationship (Article 9(1)(1) PPTFPĮ). It must also do so before an occasional transaction or linked transactions equal to or above fifteen thousand euros (Article 9(1)(2) PPTFPĮ). Identification is also required when there are doubts about previously obtained identification data (Article 9(1)(7) PPTFPĮ), and always when money laundering is suspected (Article 9(1)(8) PPTFPĮ). If the client does not provide identification data, starting or continuing the relationship and carrying out transactions is prohibited (Article 9(18) PPTFPĮ).

A client is a person who carries out monetary operations or concludes transactions with the obliged entity (Article 2(11) PPTFPĮ). In our assessment, under the PPTFPĮ as it stands today the client is the person with whom the agency signs a contract. The law does not say that the agent must also identify the other party to the deal.

Where the client is a legal person, the agent needs its documents showing name, legal form, registered office, actual business address, code and a register extract with its date (Article 10(2) PPTFPĮ). A representative is identified in the same way as a client who is a natural person (Article 10(3) PPTFPĮ). When identifying the client, the beneficial owner must always be identified too (Article 12(1) PPTFPĮ): name, surname, personal code and citizenship (Article 12(2) PPTFPĮ).

What data and what copy may be taken

A client who is a natural person must produce an identity document showing name, surname, personal code, photo, signature and citizenship (Article 10(1) PPTFPĮ). Where the client is physically present for identification, the responsible employee must copy the pages with the photo and the other data needed for identification, or scan the document (Article 10(6)(5) PPTFPĮ). Remote identification is governed by Article 11(1) PPTFPĮ.

So when the client attends in person, the ID copy is a legal duty, not a choice. But the duty covers only those pages and that data. The GDPR allows only the data needed for the purpose (Article 5(1)(c) GDPR). In our assessment, extra documents taken “just in case” do not meet this requirement. When an ID copy may not be requested, we explain in Personal code and ID copies: what you may ask for.

Before starting a business relationship or an occasional transaction where identification is required, the agency must give a new client information about the processing under Articles 13 and 14 GDPR (Article 22(7) PPTFPĮ). It must state the purposes and the legal basis (Article 13(1)(c) GDPR) and the retention period (Article 13(2)(a) GDPR). If you obtain data about a person from someone else, the duty to inform arises under Article 14(1) GDPR.

How long to keep it, and what happens next

Copies of documents, beneficial owner data, other data obtained during identification and contract documents are kept for eight years from the end of the transactions or business relationship (Article 19(11) PPTFPĮ). Correspondence with the client is kept for five years (Article 19(12) PPTFPĮ). A competent authority may extend these periods by a reasoned instruction by no more than two years (Article 19(16) PPTFPĮ).

While the period runs, the client cannot demand that the copy be erased. The right to erasure does not apply where processing is necessary to comply with a legal obligation (Article 17(3)(b) GDPR). The PPTFPĮ does not say what happens when the period ends. The GDPR answers that: data is kept no longer than necessary for the purposes (Article 5(1)(e) GDPR). In our assessment, when the period ends the copies must be destroyed, unless another law requires keeping them.

Purpose: anti-money laundering only

The PPTFPĮ sets out when client data is processed: when establishing identity, when obtaining information from third parties, when giving information to the Financial Crime Investigation Service and when storing it under Article 19 (Article 24(1) PPTFPĮ). It is processed under the GDPR (Article 24(2) PPTFPĮ). We found no separate provision in the PPTFPĮ that expressly forbids the agent to use that data for other purposes. The GDPR, however, forbids further processing in a manner incompatible with the original purposes (Article 5(1)(b) GDPR). In our assessment, an ID copy or beneficial owner data cannot become a marketing list.

A person has no right of access to the data about them that you reported to the Financial Crime Investigation Service (Article 24(4) PPTFPĮ).

Other data: marketing, viewings, photos

Contacts of buyers and sellers for marketing, lists of viewing visitors and listing photos with people in them are not anti-money laundering. The legal obligation basis does not fit them. Other bases fit them: consent (Article 6(1)(a) GDPR), performance of a contract or steps taken at the person’s request before entering into one (Article 6(1)(b) GDPR), or legitimate interest (Article 6(1)(f) GDPR). Direct marketing may be regarded as carried out for a legitimate interest (Recital 47 GDPR). But the person has the right to object at any time, and then the data is no longer processed for marketing (Article 21(2) and (3) GDPR). How to carry out the balancing test, we explain in Legitimate interest: when it is enough.

A viewing visitor who concludes no transaction with the agency is, in our assessment, not a client under Article 2(11) PPTFPĮ. So there is no basis for copying their ID. In our assessment, a name and phone number are enough to arrange a viewing (Article 5(1)(c) GDPR).

Personal data is any information about a person who can be identified (Article 4(1) GDPR). In our assessment, an owner or tenant who can be recognised in a listing photo, or family pictures on the wall, are personal data. Before publishing, remove or blur them, or have a legal basis for publishing them, for example consent (Article 6(1)(a) GDPR).

What changes from 10 July 2027

Regulation (EU) 2024/1624 applies from 10 July 2027 (Article 90 of Regulation (EU) 2024/1624). What follows is future law:

• it will apply to estate agents and other real estate professionals acting as intermediaries in real estate transactions, and for letting where the monthly rent is at least ten thousand euros, irrespective of the means of payment (Article 3, point (3)(d) of Regulation (EU) 2024/1624);
• for customer due diligence purposes, both parties to the transaction will be treated as clients (Article 19(6)(c) of Regulation (EU) 2024/1624);
• identity will be verified after the seller or lessor accepts an offer, and in all cases before any funds or property are transferred (Article 23(1) of Regulation (EU) 2024/1624); before that, prospective customers need not be checked (Recital 56 of Regulation (EU) 2024/1624);
• processing the data for commercial purposes will be prohibited (Article 76(4) of Regulation (EU) 2024/1624);
• information will be kept for five years from the end of the business relationship, the date of the occasional transaction, or the date of refusal to enter into the relationship or carry out the transaction; personal data will then be deleted, without prejudice to retention periods for data collected under other Union or national acts (Article 77(3) of Regulation (EU) 2024/1624).

The PPTFPĮ edition in force from 1 January 2027 does not change the PPTFPĮ provisions discussed here: the eight-year period stays (Article 19(11) PPTFPĮ). In our assessment, it is not yet clear how the eight-year PPTFPĮ period and the five-year period of the Regulation will be reconciled.

What can go wrong

Compliance with the PPTFPĮ is supervised by the Financial Crime Investigation Service (Article 30(1)(1) PPTFPĮ). For breaches of the law it may impose a fine from half a percent to five percent of annual income from this activity (Article 40(1)(1) PPTFPĮ). For a single serious or a systematic breach, or a repeat breach within one year of an earlier sanction – from two thousand to one million one hundred thousand euros, or, where twice the benefit obtained exceeds that ceiling, up to that amount (Article 40(1)(2) PPTFPĮ). Failing the identification or record-keeping requirements is itself a serious breach (Article 34(1)(1) and (3) PPTFPĮ).

The second risk is the GDPR. If you take copies without a basis or use them for marketing, the principles and the conditions of lawfulness are breached. The fine for that is up to twenty million euros or, for an undertaking, up to four percent of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5)(a) GDPR). ID copies must be stored with security appropriate to the risk (Article 32(1) GDPR). A person who suffers damage from an infringement has the right to compensation (Article 82(1) GDPR).

When to call a lawyer

• when you do not know whether your letting deals reach the PPTFPĮ threshold;
• when a client refuses to give an ID document or beneficial owner data;
• when a client asks for erasure and the retention period has not ended;
• when you want to use client contacts for marketing and need a balancing test;
• when you are preparing for the changes of 10 July 2027 and for checking both parties to the deal.