OAIC finds RentTech platform breached privacy principles by unfair and excessive personal information collection

On 22 April 2026, the Office of the Australian Information Commissioner (OAIC) issued the Privacy Commissioner's determination Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr24 following its year-long investigation into the 2Apply rental technology platform, operated by InspectRealEstate (IRE). The Privacy Commissioner found that IRE had breached the Privacy Act by collecting personal information that was not reasonably necessary for its functions, and collecting personal information by unfair means.

While the determination applies specifically to IRE, the OAIC has indicated that it expects all providers of RentTech to adapt their practices to be consistent with the findings. The determination also provides useful guidance for other entities who collect personal information.

Key takeaways from the OAIC's decision

Findings in this decision provide useful guidance to all APP entities. In particular:

• APP entities should adopt data collection minimisation practices by only collecting the minimum amount of information needed to perform a function or activity.
• APP entities must collect personal information by lawful and fair means under APP 3.5. A method of data collection may be considered unfair even if it is not unlawful.
• The way forms are structured, designed and presented will inform whether information is being collected by fair means.

Background

2Apply is a rental technology platform used by real estate agents to allow rental applicants to submit rental applications. The 2Apply platform uses digitised rental application forms to collect and manage prospective renters' applications.

IRE provides real estate agents with a default form for use on the 2Apply platform, which includes a customisable list of data fields. A real estate agent can specify the questions they would like to ask, which fields are visible, which questions are mandatory and any required supporting documentation.

IRE and real estate agents used the platform to collect personal information such as gender, details of dependants (including names and ages), student status, bankruptcy status, retirement status, details of previous living history, current or intended ownership of principal place of residence or investment property, current applications for other properties, bond and rent assistance application status, citizenship status and visa expiry (Renter Personal Information).

OAIC investigation

On 18 March 2025, the Privacy Commissioner commenced an investigation under section 40(2) of the Privacy Act 1988 (Cth) (Privacy Act) into IRE's compliance with Australian Privacy Principle (APP) 3 in relation to the collection of personal information between March 2020 and March 2025.

Findings

The Privacy Commissioner found IRE breached APP 3.2 and APP 3.5 and had collected Renter Personal Information:

• that was not reasonably necessary for its functions or activities in breach of APP 3.2; and
• by unfair means in breach of APP 3.5.

APP 3.2 Collection of personal information reasonably necessary for an entity's functions or activities

The Privacy Commissioner found IRE collected personal information that was not reasonably necessary for its functions or activities. The Privacy Commissioner concluded IRE could undertake its functions or activities without collecting all of the Renter Personal Information.

In reaching this conclusion, the Privacy Commissioner considered IRE's functions and activities and whether it could achieve those through collection of a lesser amount of personal information. The Privacy Commissioner considered that IRE could collect a lesser amount of personal information, and the collection of all Renter Personal Information was not necessary.

APP 3.5 Collection of personal information by lawful and fair means

The Privacy Commissioner found IRE's collection of personal information was not fair. This was due to the significant power imbalance between renters and real estate agents, property managers and landlords (and by extension intermediaries), the rental crisis, the limited choices applicants have regarding how to lodge applications, the excessive collection of personal information by IRE, and associated security risks.

Notably, the Privacy Commissioner considered IRE's "Online Choice Architecture" practices used on the 2Apply online form. The Privacy Commissioner found the way the form was designed, structured and presented unfairly pressured individuals to make choices they would not normally voluntarily make. This practice was considered as part of the Privacy Commissioner's assessment of the fairness of IRE's collection practices.

Privacy Commissioner's declaration

The Privacy Commissioner made a number of declarations, including that IRE must:

• cease collecting the elements of Renter Personal Information identified by the Privacy Commissioner (including individuals' genders and address histories);
• engage a qualified independent reviewer to conduct a review of its privacy practices in relation to the 2Apply platform; and
• submit a report to the OAIC specifying the independent reviewer's findings and recommendations.

For more information about this determination and how it affects your organisation's privacy obligations, please contact our team of experienced privacy lawyers.