Rental tech platform 2Apply breached Australian privacy laws by collecting “excessive” data on renters, the privacy watchdog has found.

In a determination released this week after a year-long investigation, the Office of the Australian Information Commissioner (OAIC) found 2Apply, which is run by InspectRealEstate, collected too much personal information and did this using unfair means.

2Apply is one of an estimated 57 third-party rental tech platforms used to collect data to process tenancy applications in Australia.

The platform uses a form-based workflow feature that collects and manages applications by users, including their supporting documents.

Under Australian privacy laws, companies cannot collect personal information that is not reasonably necessary for its functions or activities, and cannot do so by unfair means.

2Apply collects identity and contact details, information on someone’s ability to pay rent, and whether they are likely to maintain the property, and the OAIC found that it was authorised to do so.

But the platform also collects gender details, information of dependents’ names and ages, student status, bankruptcy status, retirement status, previous living history, current applications for other properties, bond and rent assistance application status, and vehicle details.

The privacy watchdog found that this type of information was not reasonably necessary for the platform’s functions or activities.

‘Confirmshaming’ rental applicants

The OAIC also investigated the design, structure and way information is conveyed on 2Apply’s form and the use of “online choice architecture”, which is how the presentation and structure of choices can shape how a user makes decisions.

It found that 2Apply was using “confirmshaming”, which involves emotive language used to make the user feel guilty or embarrassed for not taking an action that is actually in the interests of the information-collecting company.

It also uses “biased framing”, with choices presented in a way that emphasises their supposed benefits or downsides; and bundled consent, which the OAIC said unfairly pressures users into making choices that they might otherwise not want to.

“The circumstances in which the respondent collects personal information is characterised by significant power imbalances, limited choice and security risks relating to the real estate sector,” the OAIC’s determination said.

“In the absence of any legislated right to housing, the competitiveness of the current rental market means that individuals are at a disadvantage when trying to rent a home and are more vulnerable.”

The OAIC said 2Apply’s parent company was cooperative and provided detailed responses to its queries.

The company has agreed on a no-admissions basis to stop collecting the data that the OAIC said it was not authorised to.

Under the determination, it is also required to bring in an independent reviewer to audit its privacy practices.

The finding should be a warning to other rental tech providers, Privacy Commissioner Carly Kind said, and the decision has been provided to Australian real estate peak bodies.

‘Renters often lack real choice’

The OAIC said that renters are especially vulnerable to unfair information collection practices, due to the inherent power imbalance between them and real estate agents and landlords, and the current rental crisis.

“Renters often lack real choice when making rental applications,” Kind said.

“Either they hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss.

“This not only places them at risk that their applications will not be considered fairly and equitably, but that their personal information may be compromised in a data breach or cyberattack.”

The OAIC this week also signed a Memorandum of Understanding with Australia’s eSafety Commissioner to “jointly ensure Australians’ privacy and safety online”.