Fair Trading Commissioner's Guidance

When a prospective tenant applies for a property

The following guidance is considered by the Fair Trading Commissioner to be best practice for landlords, agents and third party tenancy application platforms in dealing with tenants’ personal information.

For information about the general obligations that apply to real estate agents and the application of the Australian Privacy Principles to businesses that deal with personal information please see here.

Collect information only where reasonably necessary

The Australian Privacy Principles – and privacy laws and guidance globally – emphasise the importance of not collecting more data than reasonably necessary for the purpose for which it is collected.

This is known as ‘data minimisation,’ which is an important concept that can help reduce privacy and security risks and impacts. For example, collecting more personal information than is necessary may increase the risk of harm to an individual in the event of a data breach. Holding large amounts of personal information may also increase the risk of unauthorised access by internal or external sources. Organisations should only collect the minimum amount of information that is reasonably necessary in the circumstances.’

In the context of collecting information from a tenancy applicant, some personal information may be reasonably necessary to collect because it is needed to:

confirm the tenant’s identity
establish that prospective tenant(s) who are listed on the lease would be able to pay the rent for the property when it falls due
demonstrate that the tenant is likely to look after the property.

Guiding questions

Am I asking the prospective tenant for information that is beyond what is necessary for the above purposes?
Am I asking for information only from the relevant people, who are the prospective tenants who would be listed on the rental agreement?
Am I requesting multiple forms of evidence when I only need one?
Am I collecting information only from sources that the tenant is aware of and has given informed and voluntary consent to?
If using a third-party platform, am I confident that the platform is only collecting information on my behalf that is reasonably necessary?
Am I balancing my obligation to act in the landlord’s best interest with tenants’ rights to privacy, freedom from discrimination and protection of their personal information?

Collection of information to verify the tenant’s identity

Best practice would be to only request information that is reasonably necessary to verify a tenant’s ID, and to simply sight the ID documents and note any details that may be necessary to keep (for example, if it is necessary in future to confirm the identity of the tenant for providing a reference or providing access if they are locked out of a property), without storing the documents. This will reduce the amount of ID information that will be disclosed if an agency is subject to a data breach.

Guiding questions

How much information do I need to verify the successful applicant’s identity for this purpose?
Am I requesting or collecting more information than necessary as part of these checks – for example, multiple types of evidence when only one or two types are necessary?

Example – an agent verifies the successful tenant’s identity

To verify the tenant’s identity, the agent asks the tenant if they can see a copy of the tenant’s driver’s licence or passport. The agent makes a note for their records of the licence and passport numbers but does not scan the documents.

This would be considered privacy best practice.

Example – an agent uses a third-party platform to verify the successful tenant’s identity

An agent uses a third-party platform to collect applications for a rental property.
The agent uses the third-party platform to collect identifying documents for the successful tenant. Once they have viewed these documents, they are deleted from the platform. The agent does not download or store copies of the information but makes a note for their records that they have sighted this information.

This would be considered privacy best practice.

Establish that prospective tenant(s) listed on the lease would be able to pay the rent for the property when it falls due

Consider what information is reasonably necessary to show that the tenant can pay the rent under the agreement: for example, a current rental ledger or information from their employer (such as a payslip) to confirm their income.

If the prospective tenant does not receive income through employment, an alternative source of information about capacity to pay may need to be considered. However, it is still best practice to only require a tenant to provide the minimum level of information necessary to assess capacity to pay. For example, in situations where a prospective tenant does not have payslips and instead provides bank statements, they should be encouraged to redact the daily transaction history and only provide evidence of savings.

Information on capacity to pay should be limited to those tenants who will be listed on the lease and will have a legal obligation to pay the rent.

Example – agent or third-party requests employment information from all adults in the household

An agent or third-party platform requests employment history for all adult members of the household above 18 years of age, regardless of whether they will be listed on the lease and paying rent under the tenancy agreement.

Collecting this additional evidence is not reasonably necessary for determining whether the people who will be listed on the lease will be able to pay the rent for the tenancy.

This would not be considered best practice and could also breach the Australian Privacy Principles (which larger agencies may be subject to).

Information to demonstrate that the tenant is likely to look after the property

Information collected for this purpose might include a reference from a previous landlord or agent or confirmation that the tenant has read and understood the Tenant Information Statement.

An agent may also conduct a residential tenancy database search. Where an agent uses a tenancy database, it is best practice for agents to disclose to prospective tenants that their information will be used for this purpose.

Bond claims made against the tenant or involvement in a previous tenancy dispute are not necessarily a good indicator of a tenant’s likely conduct as there may have been other reasons for these, including an unreasonable landlord or agent.

Example – third party requires prospective tenant to pay for extra checks

When submitting a rental application on a third-party platform, the application strongly suggests that a prospective tenant pay for a tenancy database or credit check to complete their application.

Under Part IIIA of the Privacy Act 1988, strict rules apply to credit reporting bodies about who can access an individual’s consumer credit report.

Credit reporting bodies are prohibited from disclosing an individual’s credit reporting information to third parties, except in specific limited circumstances prescribed by Part IIIA. Credit reporting bodies are not permitted to provide a copy of an individual’s consumer credit report to a real estate agent because they are not credit providers.

There is therefore no obligation for a prospective tenant to provide a copy of their consumer credit report to a real estate agent, even if the real estate agent asks for it. An agent asking a prospective tenant to provide a credit report in support of their application would not be best privacy practice.

Charging a prospective tenant for a credit check or other background check is a breach of the Residential Tenancies Act 2010.

Agents, landlords and third parties must not require or receive any fees from a prospective tenant in connection with submitting an application for a tenancy, apart from the costs specifically allowed for in section 23 of the Residential Tenancies Act, which are a holding fee, rent, a bond, and an amount to cover any fee payable for registration of a tenancy agreement with NSW Land Registry Services.

Unlawful discrimination

It is unlawful in NSW to discriminate in the provision of accommodation on the grounds of race, sex, marital or partner status, age, disability, sexual orientation, or gender identity.

The guidance set out here may help agents and third parties reduce the risk that they discriminate, or are perceived to have discriminated, in the assessment of a rental application. In particular, by ensuring that prospective tenants only provide as much information as the agent and landlord reasonably needs to assess an application, agents will make it easier to ensure that they are assessing that application fairly and on non-discriminatory grounds.

Consideration should also be given to whether any program or algorithms used by third party platforms to assess an application could be assessing information in a discriminatory way.

Visit the Anti-Discrimination New South Wales for more information about types of discrimination.

Anyone wishing to make a complaint about discrimination should contact the NSW Anti-Discrimination Board on 1800 670 812.

Example – agent removes unnecessary information from tenancy application form

An agent updates their application form for a tenancy agreement. In doing so, the agent ensures that they do not include any unnecessary and potentially discriminatory questions, including the marital or relationship status of the applicants.

This ensures that when the application is assessed, the agent is not influenced by whether the applicants are married. Whether or not prospective tenants are married has no bearing on their capacity to sustain a tenancy.

Example – agent infers details about prospective tenants

As part of a tenancy application, a prospective tenant provides a copy of their driver’s licence. Even though the application form does not ask the prospective tenant their gender identity, the agent assumes this from the tenant’s name and photo.

Agents should use reasonable endeavours to ensure that they do not make assumptions about a tenant’s attributes where those attributes have no bearing on their capacity to sustain a tenancy.

Regardless of whether agents are told information by prospective tenants or assume it based on other information provided, agents must ensure that they do not assess a person’s application, or offer differing lease terms, based on any protected characteristics outlined above.

Anyone wishing to make a complaint about discrimination should contact the NSW Anti-Discrimination Board on 1800 670 812 or at https://www.antidiscrimination.nsw.gov.au.

Inform applicants why specific information is collected and how it will be assessed

Agents and third party platforms should explain at the tenancy application stage why specific forms of information are required for assessing a person’s suitability as a tenant, how it will be collected, and how their application will be assessed.

This is considered best practice. It is also a requirement of the Australian Privacy Principles. The APP Guidelines set out the matters that must be included in a collection notice: Chapter 5: APP 5 — Notification of the collection of personal information - Home (oaic.gov.au)

Dealing with unsolicited personal information

Unsolicited information is information received where no active steps were taken by the receiver to collect it. Where unsolicited information is provided, the receiver should decide whether it would have been reasonably necessary to collect that information.

The Australian Privacy Principles emphasise that the unsolicited personal information should be destroyed as soon as possible if it would not have been reasonably necessary to collect it.

Example – a prospective tenant provides more information than requested

As part of a tenancy application, a prospective tenant submits a copy of their tax return. This information was not requested by the agent and was provided in addition to other information that evidenced their ability to pay the rent for the property.

The agent does not copy or file the tax return. The agent deletes the information permanently and advises the prospective tenant that they have done so, as the information was not required.

This is considered best practice.

Individual’s right to access information held about them

The Australian Privacy Principles emphasise that if an individual requests information that is held about them, that information should be provided to them as soon as reasonably practicable. If information is stored via a third party, the individual should not be simply referred on to that third party.

It is important to verify that a request for personal information is made by the individual concerned, or by someone authorised to make the request, such as a legal guardian.

This principle is particularly important if an unsuccessful tenant wishes to access information held about them to better understand why they were not successful in securing the property.

Individuals also should be given an opportunity to correct personal information held about them. This may be particularly important where a prospective or current tenant becomes aware that information held by an agent, landlord, or third party is inaccurate during an application or tenancy and wants that information to be amended.

Print this page

Request accessible format of this publication.