Décret n° 2015-1437 of 5 November 2015 sets the closed list of documents a landlord or agency may ask an applicant for:
- an identity document
- proof of address
- one or more proofs of employment
- one or more proofs of income
Any document outside this list is prohibited, such as a bank statement, a Carte Vitale health card or a criminal record extract. Article 22-2 of the law of 6 July 1989 provides for a fine of up to €3,000 for an individual and €15,000 for a company. The CNIL specifies that before a viewing, only identity, contact details and search criteria may be collected.
Its reference framework on rental management (2021) sets the retention periods: proof of income from an unsuccessful applicant stays only 3 months in the active database, and any extra documents sent must be deleted or returned. In May 2019, the CNIL fined the property manager SERGIC €400,000: applicants' documents could be accessed by changing a web address, and rejected files were kept too long.
For an AI that sorts applications: ignore and delete any document outside the list, purge files when the retention period ends, and keep a human in any rejection decision to avoid a decision based solely on automated processing (GDPR, Article 22). Our guide to AI agent security covers the technical safeguards.