The Privacy Commissioner goes into Bat for Renters 

Key Takeaways 

• Businesses should not be collecting personal information that feels good to know but isn’t genuinely needed. It isn’t sufficient that it might be helpful.  

• Platform providers serving other companies can still be legally “collecting” when they create and operate the online forms that are used by their clients. 

• Fairness in collection extends to the design and wording of online forms. Wording and choice presentation that pressures users to disclose more is likely to be unfair. 

• Bundling consent on multiple points into a single mandatory step in an online form can render collection unfair even if each individual data point is otherwise justifiable. 

• Where users have little real choice (e.g. the service is selected by an employer or a real estate agent) and the consequences for the individual are serious, businesses should expect a stricter fairness standard than for less significant consumer app. 

The IRE Pty Ltd Determination 

If you’ve applied for a rental property in Australia any time in the last few years, there’s a decent chance you’ve used 2Apply.  

It is used by real estate agents and property managers across Australia to process tenancy applications. As of March 2025, the platform had processed over 8.5 million applications. 

In terms of the numbers of people affected and the power imbalance that exists when it comes to renting, the behaviour of real estate agents and rental apps must qualify as one of the most significant privacy injustices out there. 

On 1 April 2026, the Privacy Commissioner, Carly Kind, handed down a Determination finding that IRE Pty Ltd (trading as InspectRealEstate), the company behind 2Apply, breached two separate privacy principles: it collected personal information that wasn’t reasonably necessary for its business (APP 3.2), and it collected that information by unfair means (APP 3.5).  

Importantly, the Commissioner found that IRE was collecting personal information in its own right, not just enabling real estate agents to collect. This was mainly because IRE created and maintained the default list set of questions that agents would use. As anyone who has studied behavioural economics will tell you, defaults really matter. 

Overcollection 

2Apply’s default application form asked for a long list of personal information including but not limited to gender, dependants’ names and ages, smoker status, whether you’re a student, whether you’ve ever been bankrupt, your retirement status, two years of address history and the reasons you left each address, property ownership status, current applications elsewhere, your vehicle registration, your pet’s breed, whether you’re receiving Centrelink or rent assistance, and your citizenship and visa expiry date. That was in addition to most obviously relevant data such as name, income and identification documents. 

The Commissioner asked the simple question of whether the information was reasonably necessary to assess whether someone can pay the rent and look after the property.  

Referring to tenancy and anti-discrimination laws, the Commissioner found that personal information ‘reasonably necessary’ to assess a rental application was: 

• the individual’s identity and contact details 

• the individual’s ability to pay rent 

• whether the individual is likely to maintain the property 

Run through that lens, most of the list didn’t survive. Some of these also carry a nasty side effect: asking about bond assistance status or age of dependants can make it easier, deliberately or not, to discriminate against single parents, older applicants or people relying on social security.

Other fields, like ID documents, income history and employment details, were found to be excessive in the amount collected. Two years of income history for instance, is far more than banks themselves ask for when approving credit cards or loans.

It would be fascinating if there ever was a challenge to this reasoning because I’m sure there are landlords who would furiously dispute the notion that the long default list wasn’t necessary. It is also likely that no landlord needs to challenge the Determination because they can get their real estate agents to tell them informally the data points to enable them to discriminate without putting it in an online form.

What Counts as “Fair” in an Online Form 

Under APP 3.5, information also has to be collected by fair means. This is where the decision breaks new ground, because the Commissioner didn’t just look at what was collected. She looked at how the online form was designed to get people to disclose. 

This is the first OAIC Determination to seriously grapple with “online choice architecture”, essentially the psychological nudges and dark patterns built into a form’s design. The decision calls out the specific tactics used on the 2Apply form: 

• Biased framing and emotive language (‘confirmshaming’): telling applicants extra disclosure is something that will “speed up” your application. Skipping a field “may affect whether you are considered as a suitable tenant”, which of course pressures people to hand over more than they’re comfortable with. (If applicants did skip an item, they had to tick a box and had to explain why they skipped it in a free text field.) 

• Bundled consent: requiring applicants to agree to direct marketing just to submit their application, with no opt-out at the point of collection. 

None of these tactics involve outright lying. But the Commissioner found that fairness has to be assessed in context, and the context here is people who need to find a place to live, a national rental shortage, real estate agents holding almost all the power, and renters who have essentially no choice about which platform they use and feel if they push back, they won’t get the place they are applying for.  

The Ramifications 

IRE cooperated with the investigation and agreed, without admitting fault, to comply. IRE was ordered to bring in an independent privacy reviewer within 60 days to properly assess its remaining data fields, its choice architecture, and its data retention practices, then report back to the OAIC. 

The decision explicitly signals that this isn’t just about one company. With millions of rental applications running through similar rent tech platforms each year, the Commissioner expects the whole industry to take notice, and says as much by flagging that the determination will be circulated to real estate peak bodies. 

Beyond real estate, for anyone building products that ask users to fill in forms, the lesson is broader: “reasonably necessary” doesn’t mean “useful to have”, and how you ask for information can be just as legally significant as what you’re asking for.