Minta Kay

A whole range of industries around the world are quite and perhaps wearily so, familiar with the EU's General Data Protection Regulation. These companies are in financial services, the legal industry, the technology sector and the advertising space among many others. Commercial real estate however? Perhaps not so much. That is because the main points of this very complex European legislation focus on Europeans' privacy, consumers' rights over their data and such concepts as the right to be forgotten. It also addresses the export of personal data outside the EU. Any company dealing with a resident of these countries — such as a US company with European clients — is subject to this law, which went into effect in May of 2018. It is not, in other words, the type of legislation that would appear to have a great affect the owner of US offices or apartments.

But it does have an effect on the fund formation side, Goodwin partner Minta Kay, chair of the firm's Real Estate Group, tells GlobeSt.com. In this area, she says, “there is a tremendous amount of spillover. Our clients are global in many respects and so they've got to think about global policies around the use of data. And GDPR is so unbelievably far reaching that anytime there is mention of an asset or there's an arguable solicitation of a client for investment, we have to jump through the GDPR hoops,” she says.

“So much so that we have not been able to avoid it as much as you would have thought and as much as our clients would like to. It is becoming invasive in many aspects of what we do.”

Onerous Penalties

Indeed now is a good time for CRE firms to make sure they are not running afoul of the tenants of this law before enforcement by the EC starts to pick up. Because of the law's complexity, there has been an unspoken grace period afforded most firms but it is largely expected that enforcement will happen and that some unfortunate companies will be find non-compliant and made an example.