Know your rights: A guide to renters’ data privacy

With Australia in the midst of a housing crisis, renters want to make a great impression in their application. So much so that few even give a minute’s thought to renters' data privacy.

However, with the Office of the Australian Information Commissioner (OAIC) recently finding rental app 2Apply breached privacy laws, renters should know they are under no obligation to supply even half the information these platforms are demanding.

While the OAIC’s determination was against InspectRealEstate (IRE), the operator of 2Apply, the Commissioner made it clear that other RentTech providers should adapt their practices accordingly.

This means that if you are looking for a rental property, you should only be asked for information that is reasonably necessary for those organisations to be able to assess your application.

The NSW Government also introduced a bill to protect the personal information of renters, though the other states and territories are lagging behind.

The OAIC finding helps define what information you don’t have to hand over.

 

 

What personal information can rental platforms legally request?

Rental application platforms should only request information that is genuinely needed to assess whether or not you are a suitable tenant.

Information that is likely to be classified as “reasonably necessary” includes your name and contact details, proof of income (i.e. capacity to pay the rent), employment details (to a limited extent), rental history and references.

Many people searching for the best rent privacy apps for tenants in Australia may assume that the most popular rental app is the most trustworthy when it comes to data. But the OAIC’s findings show that even the most used rental app can cross the line when it comes to data collection.

Although you are not legally required to provide information that is not “reasonably necessary” for your rental application to be assessed, in an increasingly competitive rental market, you might feel pushing back puts you at a disadvantage.

The key is knowing your rights before you hand over data. You can ask the agent or platform which fields are mandatory, and which are optional. If a field is marked mandatory but the information seems irrelevant or excessive, ask why it is required.

 

 

What to do before you apply

It is important to know your renting rights in general. But it can get tricky once technology is involved. If you only do these three things, you can help prevent a breach of renters' privacy data.

• • Check the privacy policy. We appreciate no one has time to go through the fine print in detail but focus on what they collect, how long they keep that information and who they share it with. Flag vague answers or unlimited retention periods.
  • Screenshot the form before you start. This will give you a record of what is presented as mandatory and any prompts suggesting that a “more complete profile improves your chances”. That’s the kind of pressuring technique known as confirmshaming the OAIC flagged in its determination.
  • Ask if there is another way to apply. The OAIC found that some renters who requested an alternative mode of application were refused. Keep any refusal in writing. (And read how to score your dream rental, which provides practical advice on a strong application without oversharing.)

 

 

During the application process

You can push back on a lot more than you think. The OAIC found that in the case of 2Apply, the platform was asking for unnecessary information, such as gender, student or retirement status, the names and ages of dependents, and whether you own or are applying for other properties.

If a rental app asks for information in these categories, you have a legal basis to challenge it, even if the field reads as if it is mandatory.

Don’t feel pressured into uploading unredacted documents, either. A bank statement showing income can have unrelated transactions blacked out.

Put queries to the agent in writing, not just through the platform. A simple “is this field genuinely required to assess my application” creates a paper trail and often prompts a rethink. Or use this simple template to outline your concern:

• • I am happy to provide information that is reasonably necessary to assess my rental application. However, I am concerned that some of the information requested may go beyond what is necessary for that purpose.
  • Please confirm why this information is required, how it will be used, how long it will be retained, and whether I can provide a less intrusive alternative.

 

 

After the rental application

If you have already submitted your application and are concerned about renters' data privacy, you have options.

Under Australian Privacy Principles, the cornerstone of the Privacy Act 1988, you have the right to access the personal information a platform holds about you. It also enables you to request any inaccurate data be corrected.

Contact the platform in writing and ask what information they hold about you, why it was collected, who it was shared with, how long it will be retained and whether data deemed unnecessary by the OAIC can be deleted. If you do not receive a satisfactory answer within 30 days, you can escalate to the Commissioner at oaic.gov.au.

It is worth escalating if:

• • The platform collected sensitive information without a clear reason
  • Your data was shared without your knowledge or consent
  • You were pressured into providing information through misleading form design
  • The platform fails to respond or refuses to engage with your complaint

In a joint statement with the Digital Platform Regulators Forum (DP-REG), the OAIC noted the critical role of accessible complaint handling.

“The many challenges Australians experience when resolving complaints on digital platforms continue to be a concern for all DP-REG members,” the statement said. “This Privacy Awareness Week, DP-REG members reiterate their support for the development of minimum internal dispute resolution standards for digital platforms.”

They also encouraged consumers to continue to report issues to relevant platforms.