The Federal Government must review tenancy laws to better protect tenants, the UNSW Sydney says.

Recent data breaches have highlighted concerns about just how secure our personal information is in the hands of companies. But there’s one sector where a large-scale cybersecurity breach would be devastating – real estate.

A data breach in the rental sector is a growing concern for renters, who regularly hand over large amounts of personal information when applying for rental housing. Transparency over how this information is used, shared and secured is often unclear.

Dr Chris Martin, Senior Research Fellow from the UNSW City Futures Research Centre, says the ability of real estate agents and landlords to collect vast amounts of sensitive information is a significant concern. The tenancy law expert says now is the time for governments to regulate data collection in the rental sector.

“They’re collecting a lot more personal information, with arguably not a whole lot of purpose behind it,” Dr Martin says. “It’s a big risk if all of that information falls into the wrong hands.”

Multiple identification documents, bank statements, utility bills, employment details and rental history are standard asks – more than enough to falsify an identity. But social media accounts, pet profiles and self-funded background checks are also becoming more common.

“The sorts of questions being asked in tenancy applications are getting more intense,” Dr Martin says. “Applicants might not want to hand over that level of information because of privacy concerns, but they’re in a position where they have little choice.”

Dr Martin says the issue stems from a lack of regulation over the amount and type of information property managers can ask from tenants.

Tenancy laws in most states and territories place few restrictions on what agents can collect. Only recent amendments to the Victorian Residential Tenancies Act restrict landlords and agents from asking tenants about previous disputes with renter providers, bond history, bank statements with daily transactions or information about protected attributes
under discrimination law.

“It’s not just a matter of protecting tenants’ data from hackers. It’s an issue for housing access,” Dr Martin says. “Questions about source of income, social security recipient status and whether you’ve applied for social housing can be used to deny you a tenancy, and it’s not unlawful and not regulated in any jurisdiction.”

Individual landlords and some smaller agents aren’t covered by the Australian Privacy Principles. Those who are covered can collect information that is “reasonably necessary” for their functions or activities, which Dr Martin says leaves a lot of room for interpretation.

“If it’s argued their function is to assess the best candidate for tenancy, then there could be quite a broad scope to argue they can legally collect substantial personal information to do that.”

The Real Estate Institute has signalled concern about the amount of data being collected and supported better guidelines on what should be collected by agents. But Dr Martin says fear of reputational damage alone is not enough to ensure privacy concerns are addressed.

“We should be doing more in our residential tenancy legislation to regulate the tenancy application process and the information collected by agents, landlords and third-party intermediaries,” Dr Martin says.

One solution would be to review the tenancy application process and develop a standard application with prescribed questions.

“We could have a standard form for tenancy application that asks a reasonable number of relevant questions, and not the unreasonable, intrusive and risky questions landlords and agents may be asking now,” Dr Martins says.