A few months ago I received a phone call from a senior investment manager, let's call him Roni, who had built a luxury residential project in Berlin. A tower of 180 units, one of the most advanced smart management systems on the market, a lobby with facial recognition, elevators that know where you're going before you do, and an energy system that learns each tenant's sleep habits in order to set the temperature in the room.
“The project succeeded beyond all expectations,” he said. “And now I'm in big trouble.”
The trouble did not come from the building. It came from what the building knew.
The technology company that supplied the smart management system had added a clause to the contract, a clause buried among dozens of technical pages, under which all the data collected by the system is the exclusive property of the company. Not Roni's property. Not the management company's. Not the tenants'.
When the technology company was acquired by a large American investment fund, the data went with it. Suddenly, the behavioral profiles of 180 families became an asset of a company Roni had never known. The system knew exactly when each tenant left home in the morning and when he returned at night. It knew when he slept, because the lighting and heating adjusted themselves automatically to his sleep habits. It knew how many guests came to the apartment, how often, and at what hours. It knew whether the tenant was home on a weekday during working hours, information an insurance company or an employer would pay handsomely for. This is not a feeling of being surveilled, it is precise, systematic and continuous documentation of people's most private lives inside their homes.
And then came the complaint. Not from the American fund. From the tenants themselves.
Three tenants filed a complaint with the German data protection regulator - GDPR in full force. The claim: they never gave explicit consent to the collection of a full behavioral profile. They signed a lease, not an agreement to monitor their private lives.
Roni found himself explaining to the regulator who is responsible at all: he as the developer? The management company that operated the building? The technology company that supplied the system? And the regulator, in its bureaucratic wisdom, decided that everyone is responsible. Jointly and severally.
The fine was not small. And the cost of the legal defense was much higher.
I tell this story because it is not exceptional. It is going to be the norm.
Smart buildings are no longer the future, they are the present. IoT sensors, access control systems, high-resolution cameras, smart electricity meters, tenant management apps - all of these collect information at a level that no traditional lease law was designed to handle.
And before you rush to explain to me that you have a “privacy policy,” ask yourself: who wrote it? When was it last updated? And what exactly does your tenant agree to when he clicks “I agree”?
So who owns the data?
Under most Western privacy laws - GDPR in Europe, CCPA in California, and similar laws spreading around the world - the data belongs to the person it relates to. Period. The tenant is the owner of the data about his life. All the other players - developer, management company, technology company - are data processors and temporary custodians only, permitted to use the information only for the specific purpose for which it was collected, and only as long as the tenant lives in the building. They cannot sell it, transfer it to a third party, or use it for other commercial needs, unless they received explicit and informed consent from the tenant. And if they violate these rules, they bear direct legal liability, even if they didn't know they were violating them.
The problem is that most technology contracts on the market are written backwards. They try to transfer ownership, create unlimited licenses, allow sale to third parties. And whoever doesn't read, pays.
What should a developer who doesn't want to find himself in Roni's position do?
First, contract control with technology suppliers must include an explicit clause that clearly defines who owns the data, for what purpose it may be used, and what happens to the data if the supplier is sold, closes or is acquired. This is not a given, and if the supplier refuses such a clause, that is a red flag.
Second, the lease must include full disclosure of every data collection system in the building. Not in a clause in minuscule font at the end of the appendix. Clearly, explicitly, in language an ordinary person understands. Consent obtained by indirect means will not hold up in court, and certainly not before a regulator looking to prove a point.
Third, appointing a data protection officer, internal or external, is not a waste of money. It is insurance. Projects that include systematic monitoring of tenants, which is exactly what a smart building does, are required to appoint a data protection officer in all EU countries, in post-Brexit Britain, and under parallel laws in the US, Brazil, Canada, Australia and Israel. In other words, in almost every market in which an Israeli developer operates.
Fourth, define a minimal data retention policy. Don't collect information just because you can. Every piece of data collected is also a potential liability. The less you collect, the smaller your exposure.
Roni closed his story with a settlement sum and with a new data management agreement that we drafted together.
He is not happy about the story, but he asked me to tell it. “If it helps one developer not go through what I went through,” he said, “it's worth the embarrassment.”
Your smart building can generate enormous value - for the developer, for the tenants, for the management company. But the most valuable asset in it is not the designed lobby or the solar roof. The most valuable asset is the trust of your tenants. Once it is broken, it is very hard to rebuild.
Stories are based on real situations, with identifying details changed. Not legal advice.
Translated from the Hebrew original. עברית