Data protection impact assessment

Summary

HMO Watch collects HMO licence registers published by UK councils under the Open Government Licence, standardises them, and presents them to residents, renters and buyers. The registers are public by law. The risk is not in their existence but in aggregating 361 of them into one searchable surface, which makes things findable that were previously scattered.

Every control below is implemented and covered by an automated test. Where a control is a database privilege rather than application logic, that is deliberate — it means a mistake in application code cannot breach it.

1. Republishing licence holders’ names and home addresses

The harm

The Open Government Licence does not cover personal data, so there is no licence to republish it. Doing so would also expose individuals to unsolicited contact and, for some, to being located.

The control

No column for a natural person’s name or home address exists anywhere in the database. Fields are stripped when a register is imported, before anything is constructed. A test enumerates every column in the database and fails the build if one appears. Company holders are named; individuals are recorded only as a flag.

2. Implying that a property is unlicensed

The harm

Operating an unlicensed HMO is a criminal offence under s72 of the Housing Act 2004. Stating or implying that a specific property is unlicensed imputes criminality, and absence from a register does not prove it — publication lag, pending applications, exemption notices, converted flats, below-threshold occupancy, council error and our own address-matching failures all produce the same absence.

The control

No "unlicensed" label, filter, colour, badge or icon exists anywhere in the product; the vocabulary is blocked in code and asserted by tests. Only three statuses can attach to an address, all read directly from the register. A no-match returns fixed wording that explains the ambiguity.

3. Publishing occupancy detail at a single address

The harm

Bedroom counts, maximum occupants and amenity counts at an identified address form a targeting dataset — useful for burglary, and for locating people who have moved to escape someone.

The control

Occupancy is stored in a separate Postgres schema on which the public API’s database role holds no privilege at all. It can be read only by the report generator, and only for the single property a paid report was purchased for. Publicly it appears only in aggregate.

4. Publishing an unevidenced allegation

The harm

A resident report is an untested allegation of a criminal offence. Publishing it against an address would be defamatory and would expose occupants to harassment.

The control

Reports live in a separate Postgres schema that neither the API role nor the report role can read. They are double opt-in, human-triaged, and referred to the council. Publicly they appear only as a ward-level count, banded below a floor of five so a single report cannot be isolated.

5. An occupant cannot get their address removed

The harm

Someone who has fled violence may find their new address discoverable through data they had no part in publishing.

The control

Any occupant can remove an address in 48 hours, with no evidence and no questions. There is deliberately no evidence field on the form and no approval step. Suppression is keyed on address identity rather than a row ID, so re-importing the council’s register cannot resurrect it, and it overrides reports and aggregates too.

6. A council redaction fails to propagate

The harm

A council may redact a record for a reason it cannot tell us — often safeguarding. If our copy persists, we have undone their decision.

The control

The store is not append-only. A record that disappears from source is marked withdrawn within one refresh cycle and drops out of every public view. Public reads go through views that filter suppressed, redacted and withdrawn rows, and the API role cannot read the underlying tables at all.

7. Bulk extraction and re-identification

The harm

The dataset is more sensitive in bulk than record by record. A full copy would serve exactly the investor market we refuse to sell to.

The control

No bulk download, no public API, no result-set export. Search is rate limited. The map serves a bounded viewport and refuses an oversized bounding box. There is no reverse search: the API has no input for "all properties held by X" or "all properties with N+ bedrooms".

8. Publishing where we have no right to

The harm

Northern Ireland restricts register inspection to interested persons, so worldwide republication would exceed that right.

The control

Northern Ireland is excluded. All 11 NI councils are seeded as out of scope with the statutory reason attached, and BT postcodes are refused at search with an explanation rather than returning an empty result.

Residual risk

Address matching is imperfect. A property may be shown at the wrong position, or a register entry may be attached to the wrong address, particularly where a council publishes addresses without a UPRN. We show the geocoding precision on every record so a postcode centroid is not mistaken for a surveyed position, and anyone can correct or remove an entry.

We also cannot control what councils themselves publish. Where a council publishes personal data, we strip it on import — but it remains on the council’s own site, and that is a matter for the council.

Contact

Questions about this assessment: privacy@hmowatch.co.uk. To remove an address, use the removal form — that route does not require you to contact anyone or explain yourself.