"Renting a home means handing over your data: what the OAIC's 2Apply determination changes for Australian renters"
Renting a home means handing over your data: what the OAIC's 2Apply determination changes for Australian renters
If you have applied for a rental in Australia in the last few years, you have probably been asked for more than a payslip. Passport or Medicare card details, bank statements showing every daily transaction, two years of employment history, whether you have ever been bankrupt, whether you smoke, the names and ages of your dependants. Most of that travels through third-party rental platforms, and until recently nobody with regulatory power had tested whether any of it was lawful.
That changed on 1 April 2026, when the Privacy Commissioner handed down a determination against InspectRealEstate, the company behind the 2Apply platform used by real estate agents across the country. The finding was blunt: 2Apply collected personal information that was not reasonably necessary for its functions, breaching Australian Privacy Principle (APP) 3.2, and did so by unfair means, breaching APP 3.5. The decision, IRE Pty Ltd (Privacy) [2026] AICmr 24, is worth reading if you rent, because it is the first time a regulator has set out in detail where the line should sit between an agent's need to assess an application and a renter's right to keep their life to themselves.
What the Commissioner found
The determination concluded a year-long investigation. Among the findings, the Commissioner identified specific categories of information 2Apply could function without collecting: gender, details of dependants including names and ages, student status, bankruptcy status, retirement status, previous living history, whether applicants own property elsewhere, applications for other properties, bond and rent assistance application status, and citizenship status and visa expiry. The full reasoning is in the determination PDF, and the OAIC's media release summarises the outcome, including IRE's agreement, on a without-admissions basis, to change its collection practices.
Two parts of the reasoning matter beyond this one platform.
First, on what is reasonable: the Commissioner noted there is no federal or Australia-wide standard defining the information needed to assess a tenancy application. In the absence of one, she looked to state tenancy laws, which in places like Victoria already forbid asking about previous rental disputes, bond history, or protected attributes. She found that identity could be established "to distinguish them from other applicants" with much less than full document uploads at the initial application stage, and that where verification is genuinely needed, less intrusive paths exist, such as secure third-party ID verification or physical sighting of documents. Medicare card details, colour and all, did not pass the necessity test.
Second, on how is fair. APP 3.5 requires collection by lawful and fair means, and the Commissioner treated the design of the 2Apply form itself as part of the means. In a first for the OAIC, the decision analysed the platform's "online choice architecture": confirmshaming (emotive language making you feel guilty for declining), biased framing, and bundled consent that asks for agreement to multiple purposes in one click. The Commissioner found these unfairly pressure applicants into choices they would not voluntarily make.
Why the power imbalance matters
The fairness analysis leans on something any renter intuits: you cannot shop around. The agent chooses the platform, the market is short of properties, and housing is an essential need. The determination states that individuals "have limited choice", that they often feel they have no option but to submit the requested information for fear their application is rejected. In a rental crisis, a form is not really a form; it is a gate between you and a roof.
The OAIC's media release quotes Privacy Commissioner Carly Kind directly: renters either hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss. The Commissioner has flagged that the findings apply as a benchmark to other RentTech providers and has forwarded the decision to real estate peak bodies, though the determination itself binds only IRE.
How big is the problem
Research published in January 2026 by the Australian Housing and Urban Research Institute (AHURI) put numbers on the pattern. The ABC's report on the study noted some platforms ask up to 50 questions per application, well beyond what is reasonably needed to assess suitability, and that one third of Australian households rent. The full AHURI report goes further: applications are increasingly scored by AI and automated decision-making, screening criteria are often opaque, and much of the industry sits outside the Privacy Act altogether because of the small business exemption that covers many real estate agencies.
The scale of collection is striking. NSW Rental Commissioner Trina Jones has estimated that around 187,000 pieces of identification information are collected from NSW renters every week, with no consistent standard for how the data is stored, used or destroyed. Every one of those pieces is breach fuel. A RentTech platform is a centralised store of passport scans, payslips and bank statements for millions of people, and the sector's security posture has not been tested the way, say, telcos were tested after Optus and Medibank.
What reform is actually happening
Label the status carefully, because it is patchy:
- The 2Apply determination is final, in force, and binding on IRE. Other platforms are on notice but not bound.
- National Cabinet's "Better Deal for Renters" agreed in 2023 to standardise application forms and limit data collection, but implementation has been, in AHURI's words, slow and inconsistent. There is no national rollout as of October 2026.
- NSW has introduced the Residential Tenancies Amendment (Protection of Personal Information) Bill to stop unnecessary collection, per the NSW Rental Commissioner's comments reported by the ABC. A bill, not yet law.
- Victoria restricts what rental providers can request via its tenancy legislation, one of the few enacted regimes.
So the honest summary: one regulator has drawn a line, states are moving at different speeds, and the federal gap, especially the small business exemption, remains open.
What you can do as a renter
You cannot opt out of the system entirely, and we will not pretend otherwise. But the determination gives you arguments:
- Question the request. The determination lists what a platform must not require: your bank account's daily transaction history, Medicare card numbers, gender, dependants' names, bankruptcy status. If an agent insists on those, you can point to the determination and to Victoria's legislated restrictions as the emerging standard.
- Redact before you upload. Payslips and statements can be trimmed. Nothing in the assessment needs the transactions on page four.
- Complain while it matters. If you are asked for information the Commissioner has already ruled excessive, that context strengthens a complaint to the OAIC or your state's tenancy authority.
- Assume the data is a target. Whatever you do submit should be treated as something you will one day read about in a breach notification. Minimise it accordingly. If you want the broader picture on trimming your exposure, our stalker and OSINT lockdown guide covers document hygiene in more depth.
None of this is legal advice; it is a reading of a public determination and public research. But the direction is clear. The era of "just upload your whole passport and three months of statements because the form asks" is, at least on paper, over. Whether practice catches up depends on renters pushing back and on the reforms that are still bills rather than laws.
Sources: IRE Pty Ltd (Privacy) [2026] AICmr 24, OAIC media release, 1 April 2026, ABC News on AHURI Final Report 454, 29 January 2026, AHURI Final Report 454. This article is general information, not legal advice.