The Social Tenant Access to Information Requirements (STAIRs) is a policy statement introduced by the UK Government, under the leadership of the Ministry of Housing, Communities and Local Government (MHCLG). In 2024, it was put forward for public consultation as a foundation for a proposed new regulation aimed at benefiting tenants of private sector social housing providers in England and Wales. In July 2024, the consultation period ended, and we are now awaiting the Government’s decision on when to activate the existing legislation to bring the STAIRs requirements into effect by way of a new legal access to information standard, with which private social housing landlords will have to comply.
What is STAIRs?
The intention behind the STAIRs is to plug an ‘information rights gap’ experienced by social housing tenants whose landlords are what are known as private registered providers (PRPs), being predominantly housing associations, rather than local authorities (the other main provider of social housing in this country). Social tenants renting homes from local councils, which are classified as public authorities under the Freedom of Information Act 2000 (FOIA), currently have the right to submit freedom of information (FOI) requests to their landlords. This statutory right grants them access to a wide range of information about their homes, among other matters. On the other hand, people who rent from housing associations are not covered by the FOIA. As such, if they wish to make a formal request to their landlord for information, they are not entitled to submit an FOI request but instead must rely on a data subject access request (DSAR) under the Data Protection Act 2018 (DPA). Although it is quite a strong right, a DSAR is not very broad as it only relates to the requester’s personal data – i.e., information about the person as an individual.
The aim is for the STAIRs to address this shortfall between the right to make an FOI request, which currently only council tenants enjoy, and the DSAR right, which residents of housing associations are limited to relying on at the present time.
The MHCLG will achieve this purpose through the Secretary of State instructing (under a power in the Housing and Regeneration Act 2008) the Regulator of Social Housing (RSH) to introduce a new standard for housing association landlords to be more transparent with their information that could be of use and interest to their tenants. The STAIRs will be published under the power already contained in Section 22 (‘Standards relating to information and transparency’) of another existing law, the Social Housing (Regulation) Act 2023.
The new standard brought in by the RSH will:
- Enable housing association residents to request data about the management of their homes
- Set specific time periods for responses, and
- Require housing associations to publish certain information proactively via a publication scheme.
URM expects the types of information that will be requested by social tenants to include:
- Condition of the property
- Repairs and improvement plans
- Patterns of poor property conditions within a block or district
- Repair times
- Antisocial behaviour (ASB) cases and outcomes locally
- Health and safety issues
- Breaches of housing association or other policy
- Outcomes of property inspections
- Basic property estate management
- Senior employees’ (decision makers’) names and job roles
- Policies and procedures
- Property spending
- Housing stock management
- Performance standards
- Rent rates
- Service charges for shared owners.
Is this just an extension to FOI – if so, why didn’t the Government just extend the FOI Act to include housing associations?
As mentioned above, FOI already applies to local authority housing providers – council social housing tenants have been able to make significant requests to their public authority landlords for 20 years. STAIRs is specifically aimed at PRPs – private sector social landlords, such as housing associations - which are exempt from FOI, due to their non-public status. Bringing in the STAIRs standard continues to respect the fact that, fundamentally, FOI is intended for use with public bodies spending taxpayers’ money, but acknowledges the additional information and transparency duties which bind PRPs, by virtue of their special ‘quasi-public’ function and role in society.
It was deemed disproportionate to extend the FOI to PRPs. The STAIRs-based standard is intended to strike a fair balance between the information privacy and efficiency rights of PRPs as private organisations, and the ‘rights to know’ of their tenants who have more than the normal consumer/supplier relationship with the provider of the roof over their heads. For example, unlike the FOIA, the STAIRs scheme will not be available for use by the press or by ordinary members of the public who are not tenants of PRPs. The standard is specifically directed at tenants and their representatives.
It is proposed that the timescale for response to STAIRs information requests will be 30 days, whilst further time may be applied for in exceptional circumstances – similar to a DSAR. Complaints of failure by PRPs to comply with requests will be heard by the Housing Ombudsman.
STAIRs will not override the statutory rights of the FOIA or the General Data Protection Regulation (GDPR)/DPA.
High-level similarities between STAIRs requests and FOI Requests / GDPR DSARs
- The receiving organisation may refuse a request if:
- the requester cannot be validated
- a request is abusive or offensive, or
- the request would take longer than 18 hours to fulfil (subject to the consultation).
- Complaints process to the regulator
- 30-day timeframe for response (DSAR is one month, FOI is 20 working days).
STAIRs Standard and Freedom of Information: a Detailed Comparison
The regulator is expected to issue the STAIRs standard in its finalised form in 2025, and URM will confirm when this happens. In the meantime, you can visit our website page dealing with URM’s STAIRs-related service offering.
How URM can Help?
Whilst the introduction of STAIRs is an entirely new development in the regulatory landscape for PRPs, URM’s 2 decades’ of experience supporting organisations to meet data protection compliance requirements means we are ideally positioned to help PRPs comply with the STAIRs standard once it comes into force. As with all our data protection services, URM can provide a gap analysis service, where URM can review all your relevant processes and determine what changes need to be made in order to meet the requirements of the STAIRs standard. As part of such a review, we will provide you with a with a prioritised list of remediations to address any shortfalls. URM can also support you in developing new processes and policies and in providing your staff with awareness training and your data protection champions with more in-depth training on how to deal with STAIRs requests. This training will include dealing with exemptions, timeframes for responding, when requests can be refused and how to respond.
For those organisations with limited data protection resources, URM is able to offer a virtual data protection officer (vDPO) service, providing ongoing or ad hoc support with any aspect of STAIRs and GDPR compliance that you require.
Other Data Protection Services
URM can provide DSAR support in the form of our DSAR redaction service, whereby our large team of consultants will help to apply the necessary exemptions and redactions to ensure your response to these requests is completed in full compliance with the GDPR. Or, to evaluate your organisation’s processing practices more broadly, we can conduct a GDPR gap analysis, where we identify the areas in which you are currently compliant with the Regulation and any areas of noncompliance for remediation.
To strengthen your own understanding of data protection, we also regularly deliver a number of data protection training courses, each of which are led by a practising GDPR consultant. Our half-day courses on conducting data protection impact assessments (DPIAs) and data transfer impact assessments (DTIAs), as well as our one-day ‘How to Manage DSARs’ training course, will all leave you with the necessary skills to undertake these vital compliance activities in your workplace. Meanwhile, to gain an industry-recognised data protection qualification, URM runs the BCS Foundation Certificate in Data Protection (CDP) course, aimed at leaving you with a strong understanding of the UK data protection legislative landscape.
URM can offer a host of consultancy services to improve your DP policies, privacy notices, DPIAs, ROPAs, privacy notices, data retention schedules and training programmes etc.
By attending URM’s online BCS Foundation Certificate in Data Protection course, you will gain valuable insights into the key aspects of current DP legislation including rights of data subjects and data controller obligations.
If uncertain, URM is able to conduct a high-level GDPR gap analysis which will assist you understand your current levels of compliance and identify gaps and vulnerabilities.
This blog considers at high-level various possible legal ramifications of using Chatbots, especially ChatGPT, concerned with data protection risks.
The EU GDPR and the UK DPA both require organisations to protect and ensure the privacy of any personal data which they process.
Is there a catch-all international standard that effectively proves external verification of data protection compliance?