A determination issued today by the Privacy Commissioner finds that the 2Apply rental technology platform, operated by InspectRealEstate (IRE), collected excessive personal information and did so by unfair means.
The findings against IRE concluded a year-long investigation by the Office of the Australian Information Commissioner (OAIC), in response to which the platform laudably agreed to adapt its personal information collection practices on a without-admissions basis. The final decision requires IRE to cease collecting a range of personal information, such as prospective renters' gender, student status, citizenship status and visa expiry, and details of previous living history.
In issuing her decision, the Privacy Commissioner noted the significant power imbalance in the rental property market, exacerbated by the rental crisis and rising costs of living, and observed that consumers are particularly vulnerable to unfair information collection practices.
'Renters often lack real choice when making rental applications. Either they hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss,' said Privacy Commissioner Carly Kind.
'This not only places them at risk that their applications will not be considered fairly and equitably, but that their personal information may be compromised in a data breach or cyber attack.'
In addition to finding that IRE contravened Australia Privacy Principle 3.2 by collecting personal information that is not reasonably necessary for its functions or activities, the determination also concluded that 2Apply collected personal information by unfair means in contravention of APP 3.5, in circumstances where individuals have a limited choice and there is a significant power imbalance between renters and real estate agents, property managers and landlords.
In a first for the OAIC, the decision considered the design, structure and way information is conveyed in the 2Apply form and utilised the concept of online choice architecture, which describes how the presentation and structure of choices presented to individuals can shape how they make decisions.
The Commissioner's decision observed that the 2Apply form deployed 'confirmshaming' (the use of emotive language to make a user feel guilty or embarrassed for not taking an action that is beneficial to the information-collecting entity), biased framing (the practice of presenting choices in a way that emphasises their supposed benefits or downsides), and bundled consent (which involves requesting consent for the user for their personal information to be used for multiple purposes in a single request), which unfairly pressures individuals into making choices that are otherwise misaligned with their preferences or that they would normally voluntarily make.
Although the decision only pertains to IRE, the Commissioner in her determination emphasised the need for other RentTech providers to adapt their practices to be consistent with the findings. The Commissioner has also provided the decision to real estate peak bodies to assist real estate agents, property managers and landlords to consider the implications of the decision for their own information collection practices.
Privacy Commissioner's determination
The Privacy Commissioner's determination (PDF, 481 KB) is available on the OAIC website.
