Tips for Keeping Real Estate Data Secure

Nearly 50% of data security breaches in the real estate industry occur due to errors by the person using the data, according to Trista Curzydlo, an attorney and real estate instructor.

“The broker or the agent haven’t adequately protected the data, or they haven’t implemented the second step of protection,” Curzydlo told PAR President Al Perry during a cyersecurity webinar. “It’s not the random guy in some basement trying to hack our information that we must be concerned about. It’s actually us.”

Curzydlo advises doing a data audit to review the information that you have. She said the Federal Trade Commission has a guide for businesses to protect personal information. She likes to call it the who, what, where, when, why and how, which she has simplified.

“It’s not the random guy in some basement trying to hack our information that we must be concerned about. It’s actually us,” according to Trista Curzydlo, an attorney and real estate instructor.

Steps for Data Protection

• What data do you have? “If you’re a broker, do you have personal information about your employees and the independent contractors you work with? Do you have their social security numbers, tax ID numbers and birthdates and is it in one place? What information do you have about your clients? It’s usually their name, address, social media handles and if you’re doing property management, you may have their credit card on file,” she explained.
• Why are you keeping the data? “In Pennsylvania, you’ve got retention regulations that require you to keep records for at least three years. You may keep some data because your attorney or accountant said you must keep it. Then you should dump the rest because every additional file you’re keeping is just an additional, potential liability. If you’re not required by law to keep it and you’ve hit the timeline when you can get rid of it, then it’s gotta go,” Curzydlo said.
• Where do you keep your data? “Is it in a filing cabinet? Is it in the cloud? Who has access to those files? If it’s in a physical filing cabinet, can anyone walk into your office and access it? If you’re using cloud storage or other management systems, who has access to that? Who has the passwords? Because if you’re giving your unlicensed assistant the password and then they leave you and on their way out they delete everything, you’ve got an issue,” she noted.
• When can you get rid of the information? “What timelines do you have to follow for retaining data?” she added. “Read the terms of the contract with cloud services to see how long they keep your data. What happens if you forget to pay for the cloud storage? What does the company do with your data?”
• How do you get rid of the data? In the past, paper files were shredded to eliminate information. Curzydlo said Realtors® may want to consider using a digital shredder to dispose of old computers, cell phones and memory cards after doing a factory reset. “I’m from Kansas and I know some people take their old computers out into the field and shoot it. I do not recommend that, but beyond a factory reset, you should physically destroy it. I recently found an old Blackberry that I used years ago while practicing law. I plugged it in and I was able to pull up old emails that had negotiation information in them.”
• Have a policy and procedure for how agents handle information after a closing. If your agents are keeping what we call shadow files on their own thumb drive or their own cloud storage and they leave you, that information is technically the broker’s information. If the agent loses the thumb drive or their cloud service is breached, the clients are technically the broker’s and they are responsible for it. While agents are encouraged to build their businesses and keep their own database, all the clients’ personal information should not be stored.

Tips to Further Ensure Data Security

• Review passwords. “When you’re using passwords like 123456 or the name of my dog; it’s not doing anything,” she said. “We shouldn’t be using those really easy passwords. We are legitimately going to look at having passwords that we change on a regular basis.”
• Use two-factor authentication and a password generator. “Using two-factor authentication where you enter your password and then you get sent a code via text or email is 100 percent more work for you, but you are protecting your clients’ data and that’s important.”
• Consider using encryption. “Encryption is truly a lock on the data. You want to look at your emails and where are you having confidential information exchanged for the client? Are you saving emails or files from your clients, are you encrypting them? A third-party encryption service provides that extra protection. PC Magazine and Wired review these services annually and break them down into different features.”

Curzydlo encourages Realtors® to explain the process to their clients. “I would include information in your packet of information that explains, we collect personally identifiable information and this is how we’re going to keep it safe. You prepare them in advance, so they understand that you’re not just making things complicated. You have their best interests in mind. Consumers are becoming very savvy. They know their data is valuable and they want it to be protected.”

Curzydlo also cautions about using artificial intelligence, or AI, when interacting with clients, particularly on websites. “AI is trained to use the information it’s given, but it’s not programmed to respond, ‘I don’t know.’ It will give you a response even if it has to create them.”

She added that providing information about properties can also open you up to releasing information about your client. “If I allow access to my digital files on my client’s information, will it use information that may be confidential, for example, if they’re highly motivated to sell because of a divorce? Or what is the lowest offer they’re willing to accept? That’s confidential information that we wouldn’t want to allow a Chatbot to respond on a website.”