by 
Introduction
In recent years there have been some well-publicised Privacy Act breaches in the landlord-tenant space, most notably in relation to over-collection of personal information (including prospective tenants’ bank statements), and so-called ‘bad tenant’ websites (which I discussed in detail in a blog post called Why ‘bad tenant’ websites can be problematic). These breaches became a catalyst to the Office of the Privacy Commissioner (OPC) investigating what was going on, having discussions with the industry, and preparing a suite of guidance for landlords and tenants.
As most landlords and property managers will know, OPC released this guidance late last year. For landlords and property managers, the guidance takes the form of:
- a document called “Privacy Act guidance for landlords and property managers”; and
- an associated summary document called “Privacy Act 2020: Landlord Fact Sheet”.
OPC also released separate Privacy Act guidance and fact sheet documents for tenants. You can find them all here.
Helpful guidance
No one would deny that guidance to protect the privacy of tenants is desirable, especially given the power imbalance that often exists between landlords and tenants and the highly competitive rental market. It is also undeniable that the guidance provides helpful and, it seems, much-needed clarifications as to how various information privacy principles (IPPs) ought to be applied in landlord-tenant contexts, even if some people don’t agree with everything in the guidance.
But somewhat prescriptive
However, what strikes me about the guidance – which some landlords are interpreting as ‘rules’ – is just how prescriptive it is in relation to the application of IPP1.
IPP1 is a gatekeeper IPP, in that it sets the parameters for what personal information agencies (including landlords and property managers) may collect. Under IPP1, personal information must not be collected unless:
- the collection is for a lawful purpose connected with a function or activity of the agency collecting the information; and
- it is necessary to collect the information for that purpose.
IPP1 uses the language of ‘necessary for the purpose’ rather than ‘reasonably necessary’. However, it is generally accepted that an agency does not need to show that it absolutely must collect the information in order to achieve its purpose. Rather, it needs to show that it is reasonably necessary to collect it. See the Office of the Privacy Commissioner’s website.
The guidance for landlords and property managers is rather prescriptive about when they can collect different elements of personal information, depending on the stage they’re at in renting a property. The guidance’s starting point on this issue is that the “type of information you can collect will vary, depending on what stage you are at in the rental process, and the purpose of collection associated with that stage.” The guidance then describes five stages:
- when you are arranging property viewings
- when you are receiving applications and shortlisting applicants
- when you are doing further checks on preferred applicants
- when you are preparing a tenancy agreement
- when you are managing a tenancy.
Without getting into the details, the key point is that, as you progress through the stages, you’re able to collect more personal information, because more information is required for your decision-making or management of the tenancy. This makes sense.
When it comes to the first stage, though, landlords are told this:
When people enquire about or book a viewing of a property to see whether they’re interested in applying to rent it, the only information you should need is their names and contact details. These details will allow you to follow up to see if they’re interested in the property. You can give people the option of completing a full application form before they view a property, but they shouldn’t be required to complete one at this stage. Information gathered at viewings for Covid-19 tracking purposes must only be used for that purpose.
I do find this surprisingly prescriptive because there could be situations where a landlord wishes to take a different approach to renting their property. For example, given the tight rental market, a single advertisement might prompt inquiries from, say, 100 people, all of whom wish to view the property. It may be impractical or commercially problematic for a landlord or property manager to show that many people around, and so the landlord or property manager may wish to ask some basic questions to start filtering out people who don’t tick certain legitimate (non-discriminatory) boxes, such as whether a person interested in the property has pets, how many people they would like to live in the property, whether the proposed tenants are willing to commit to a particular fixed term (if relevant), whether they are happy to start paying rent at a particular date, whether they understand the bond obligations, and so on. In the kind of situation described here, not obtaining this information upfront could waste both landlords’ and prospective tenants’ time.
Admittedly landlords can avoid needing to ask for some of this information by stating clear requirements in their advertisements, but for various reasons an advertisement may not state all relevant and legitimate conditions, and a landlord may wish to ask about them, for example over the phone when someone wishes to arrange a viewing time, before showing people around. Even if an advertisement does list all relevant conditions, people desperate for a tenancy may rush to call without fully absorbing them. Similarly, in the natural ebb and flow of a potential applicant’s phone call enquiring about a property, something the person says might naturally prompt a question from the landlord or property manager that amounts to a request for and collection of personal information. In these kinds of situations, an alternative is to state a list of conditions and ask if the prospective tenant understands them (thereby potentially collecting less information), but that may not be the most tenant-friendly way of having the conversation.
So, in these kinds of situations, the question is whether asking for more than names and contact details at an early stage can be permissible under IPP1. In my view, it may well be permissible, because arguably the collection is reasonably necessary for the lawful purpose of filtering out potential applicants who will not be able to meet certain conditions or requirements. In my view, landlords shouldn’t be forced to arrange a viewing of their property to do this. Potential applicants may actually appreciate this, as not every tenant will read every word of every advertisement, and asking some basic and innocuous questions may save them from a wasted trip.
If what I’ve suggested above is the case, where are we left, given the content of the ‘Privacy Act guidance for landlords and property managers’ and the ‘Landlord Fact Sheet’, parts of which have come across to some people as prescriptive or formulaic?
The guidance is guidance, not rules
The answer lies in the fact that the guidance is just that: guidance. Despite some newspaper articles and even the former Privacy Commissioner having referred to the guidance as “rules” (see this interview at 8:50 to 9:07), on the issue of how much information may be collected at varying stages the guidance does not actually lay down absolute “rules” that must be adhered to in every rental situation regardless of the circumstances. Despite the guidance coming across as rules in places (e.g., “we’ve produced a summary … of the information you can collect for different purposes, at different stages…”), as a matter of law the guidance cannot have that effect, as the Privacy Commissioner does not have the power to issue rules that prescribe how IPPs are to be interpreted or applied in particular situations regardless of the circumstances (codes of practice are a separate matter and are not relevant here). The guidance does not describe itself as ‘rules’, and it’s also worth noting that the guidance doesn’t purport to describe all conceivable means by which properties may be rented or to address every way in which potential applicants and landlords might converse. (The guidance does come across as particularly prescriptive in relation to information that landlords should not collect, but that’s understandable, as it’s a reflection of prohibited grounds of discrimination in the Human Rights Act.)
The guidance is generally very helpful and, wherever possible, following it would be prudent. However, not following it to the absolute letter in a particular situation does not necessarily mean you’ll be breaching the Privacy Act. That is ultimately a question of mixed fact and law that needs to be considered by reference to all relevant circumstances. It is also worth noting that an innocuous request for a piece of personal information at one point rather than another does not necessarily mean a landlord or property manager will have interfered with an individual’s privacy for the purposes of the Act, even if there has been a minor breach of an IPP.
If a tenant were to complain to the Privacy Commissioner in cases where a bit more personal information is collected at one stage as opposed to another, and the Commissioner elected to intervene, the Commissioner could be expected to indicate whether there has been a breach of IPP1 and, if so, whether it has caused a form of harm that results in a finding of an interference with privacy. While the Commissioner can also be expected to take their own guidance into account, in my view the Commissioner would likely take a reasonable and balanced approach. I say that because OPC is not in the business of hammering landlords who innocently ask innocuous questions at one stage rather than another, when it is reasonably necessary to do so for the purpose of filtering out applicants who won’t be a good fit because they can’t meet certain legitimate conditions. In the unlikely event that this were to happen, the Privacy Commissioner would not necessarily have the final say , as the complaint might be referred to the Human Rights Review Tribunal and a decision of the Tribunal could be appealed to the High Court.
Conclusions
My suggestion for landlords is to take good note of the guidance, as generally it is very good and will serve both landlords and tenants well, whilst also recognising that the guidance itself is not a legally binding set of hard and fast rules. The actual rules are found in the Privacy Act itself. If a landlord or property manager is collecting a little more information at a particular point in time than another, they still need to consider whether and be confident that it’s reasonably necessary to do so for the lawful purpose for which they’re collecting the information, but that is a decision they are able to make by reference to all relevant circumstances. If a landlord or property manager or their privacy officer or lawyer is confident that there is no breach of IPP1, then the risk is likely to be low.
In my view, OPC is unlikely to take action against a landlord who has good reason for requesting some basic information at one stage rather than another. As the Privacy Commissioner is reported to have said when releasing the guidance, “it’s not about us going around beating them up”. OPC is much more likely to take action against a landlord who clearly requests way too much personal information, or irrelevant personal information such as bank statements or information that could result in discrimination against an applicant, or who takes photos or video of personal items in a tenant’s room, or who otherwise breaches the IPPs in a way that clearly causes (or, in the case of compliance notices, could cause) harm to tenants.