Why ‘bad tenant’ websites can be problematic

Introduction

What’s happening

On 30 January 2021, Stuff ran an article called Landlords publishing ‘bad tenants’ lists online could be breaking the law. According to the article:

landlords “are compiling lists of so-called ‘bad tenants’ on websites and social media”; and
one of these websites “offers members access to a list of people who are deemed undesirable tenants”.

It appears that these sites contain, at the very least, a list of the tenants’ names. One of them appears to contain photos of tenants which the aggrieved landlords upload to the website, and presumably they contain commentary as to why the tenant is considered a “bad tenant”.

One of these sites requires authenticated access to see its content, but has some publicly available pages. One of those pages:

encourages landlords to register both good and bad tenants;
states that when a registered landlord wishes to find information on a tenant, the site will (upon payment of a fee) provide the landlord with all information relating to the tenant that the site has; and
talks about making these tenants ‘famous’ and ‘immortalising their names and photos on record forever’.

This particular website operator’s Facebook page contains a screenshot of, it seems, what the site looks like to a registered landlord who has logged in. It shows photos of people (tenants), with their names underneath which appear to be hyperlinked to more information (I can’t confirm there is more information as I can’t access the site itself).

Legal issues

A well-know New Zealand privacy barrister has indicated that these kinds of sites could be breaching the Privacy Act and committing the tort of defamation. I agree with her. Website operators doing this sort of thing might be breaching the Privacy Act and committing the tort of defamation, and so too could the landlords who post the information to the site. They could be falling foul of other areas of law as well. Whether they are depends on a range of circumstances. For present purposes, though, I’ll assume that the sites operate in the manner described above and that the tenants:

were not informed by their landlords that, if they behave ‘badly’, they could end up on such a website;
do not consent to personal information about them being posted to such websites; and
are generally unaware of the listings and are not given any opportunity to comment on allegations posted to the website.

The position of landlords who post to the site, and the position of the site operator

When considering the legal issues, it’s helpful to distinguish between the position of landlords posting content to the website, and the position of the website operator. Both might be breaching the law, and a concerted effort to protect individuals’ privacy may require consideration of each of them. I address each of them below.

Nothing I say here is meant to ignore the difficulties landlords can experience with truly bad tenants. Bad tenants exist just as bad landlords exist, and each can cause problems for the other. At the same time, we’re talking here about the publication of potentially damning information about tenants that:

will include personal information about them obtained in a specific context (the landlord-tenant relationship);
might include their photos, published without their permission;
might include personal information that is not verified before publication;
might include information that is objectively wrong or that is biased or incomplete or misleading, or that might be published for vengeful or retaliatory purposes; and
is published in circumstances where it seems the tenants have no ability to comment on or see what’s being published about them.

In addition, even where a tenant has behaved poorly in one tenancy (for whatever reason), that fact alone does not mean the tenant will behave the same way in future tenancies. The tenant may have been going through a hard time in their life. The tenant may have been depressed or suffering from some other mental condition but may now be fully recovered. The tenant may have been affected by financial hardship that resulted in missed rent payments that won’t be repeated in the future. One can imagine all manner of reasons as to why a person behaves a certain way at one point in their life but will not do the same in the future. Regardless of the legal position, to brand such people as “bad tenants” for evermore, on a site that purports to immortalise a time-limited period of behaviour, seems morally questionable. And this is occurring at a time when the rental market in many parts of the country is tight and challenging for tenants.

Landlords posting content to the website

Privacy Act issues

Let’s assume that a landlord who posts a bad tenant listing to the website posts the tenant’s name, photograph, and information about why the person was a bad tenant. The name and photo are definitely personal information, the fact that the person was in a tenancy relationship with the landlord is also personal information, and the information about why the person is considered a bad tenant is also likely to be personal information. The landlord will in all likelihood have obtained most of this information as a result of the landlord-tenant relationship. The person’s photo might have been found on a social media site like Facebook or otherwise on the web or perhaps the landlord will have taken a photo of the tenant. I suspect (but don’t know) that sometimes landlords would simply find a photo online and use that.

Landlords who upload such information to a ‘bad tenants’ website run the risk of breaching the Privacy Act’s information privacy principle 11 (Limits on disclosure of personal information). Under IPP11, an agency (which includes a landlord) must not disclose personal information it holds unless the agency believes on reasonable grounds that one of the listed exceptions applies. Those exceptions are that:

the disclosure is in connection with, or directly related to, one of the purposes for which it was obtained;
disclosure is to the individual concerned;
disclosure is authorised by the individual concerned;
the agency got the information from a publicly available publication and, in the circumstances, it would not be unfair or unreasonable to disclose the information;
disclosure of the information is necessary to avoid prejudice to the maintenance of the law by a public sector agency, or to enforce a law that imposes a pecuniary penalty, or to protect public revenue, or for the conduct of court or tribunal proceedings;
disclosure is necessary to prevent or lessen a serious threat to public health or safety, or the life or health of any individual;
disclosure is necessary to enable an intelligence and security agency to perform any of its functions;
the information is to be used in a form in which the individual concerned is not identified, or is to be used for statistical or research purposes and will not be published in a form that could reasonably be expected to identify the individual concerned; or
disclosure is necessary to facilitate the sale or other disposition of a business as a going concern.

In all likelihood, none of these exceptions applies, and the landlord will be in breach of IPP11.

In addition, there’s also a risk (depending on the information that is disclosed) that these landlords are not complying with IPP8. Under IPP8, an agency must not use or disclose personal information without taking any steps that are, in the circumstances, reasonable to ensure it is accurate, up to date, complete, relevant, and not misleading. If landlords are disclosing personal information to a ‘bad tenants’ website that is not accurate or complete, or that is misleading, they will be breaching IPP8.

This kind of conduct – conduct that breaches IPP11 and IPP8 – is likely to constitute an “interference with privacy” under the Privacy Act and that, in turn, enables the Privacy Commissioner to investigate and find against the landlords accordingly.

Landlords also need to bear in mind that, under the Privacy Act 2020’s new compliance notice regime, the Privacy Commissioner may issue a compliance notice if the Commissioner believes there has been a breach of the Act, including (among other things) a breach of an IPP. If the Commissioner issues a compliance notice, the notice will describe the breach and require the agency to remedy the breach. Importantly, compliance notices may be issued in the absence of harm.

Copyright issues

Landlords should also note that uploading a person’s photo that they don’t have the right to copy and publish could expose them to a claim for copyright infringement, even if the photo is publicly available. Photos are copyright works and should not be copied and published without permission of the copyright owner. The mere fact that a landlord can find a photo of a person online does not mean they can copy it and use it if they don’t have permission to do so.

Defamation issues

There’s also a separate question as to whether the commentary posted is defamatory. This will turn primarily on the commentary itself and whether it is true or not.

An important consideration for landlords is that sometimes landlords themselves are less than perfect. Sometimes they are unable to see that they are not treating a tenant well or are breaching a tenant’s rights. That can fuel tension with a tenant, resulting in conduct on both sides that is less than desirable. A landlord might attribute all fault to a tenant and not realise that the landlord caused or contributed to what has happened. With landlords being human like the rest of us, the result could be a verbal outburst on a ‘bad tenants’ website that is not wholly accurate and that could end up being defamatory. I suggest that landlords need to be mindful of this risk.

Note also that the fact that the site is limited access is irrelevant. As soon as defamatory commentary (if any) is published to the site and viewable by others, it is ‘published’ for the purposes of the tort of defamation. It doesn’t matter that only other landlords can see it.

Tort of privacy

Landlords also need to be careful about publishing intimate or sensitive details of a tenant that they learn of through their role as landlord. Publishing this content runs the risk not only of breaching the Privacy Act but also of committing the tort of invasion of privacy (a ‘tort’ is a form of civil wrong). The tort can be committed where:

facts exist in respect of which there is a reasonable expectation of privacy; and
there is publicity of those private facts that would be considered highly offensive to an objective reasonable person.

Now, I’m not saying that this tort is being committed in the present circumstances. I am saying it might be, depending on the information that is being published on the website. And, again, it is being “published” even where access to a website is limited to the registered landlord community.

The significance of the tort is that, if it is committed, the tenant may have a remedy for damages (that said, the tenant would need to sue in the courts, and the costs of doing so would often be prohibitive).

Website operator

Privacy Act issues

A primary legal question is whether the website operator is “collecting” personal information for Privacy Act purposes or only acting as a fully automated conduit or social media-style platform, such that the information could be considered “unsolicited”. If unsolicited, the “collection” principles in the Privacy Act (IPPs 1-4) would not apply. Other principles would apply, but not these ones.

The Privacy Act 2020 has a clearer definition of “collect” than the Privacy Act 1993’s definition. The 2020 Act defines “collect” as follows:

collect, in relation to personal information, means to take any step to seek or obtain the personal information, but does not include receipt of unsolicited information

In one of the cases referred to in the Stuff article, the website operator appears to be taking active steps to have landlords provide personal information about “bad tenants” (and, to be fair, “good tenants”). It is doing this through the site itself and its Facebook page, and it is seeking to make money from tenant searches. In these circumstances, it seems arguable that the website operator is in fact “collecting” the personal information. If so, then various collection-related questions could arise. For example:

is it necessary for the website operator to collect all the personal information it is collecting for a lawful purpose connected with its activities?
is it permissible, under the Privacy Act’s IPP2 (Source of personal information), for the website operator to collect tenants’ personal information from landlords rather than from the individual tenants themselves?
is the website operator collecting the information by a means that is fair and does not intrude to an unreasonable extent upon the personal affairs of the individual concerned?

These questions are heavily fact-dependent and so it’s difficult to come to a conclusion on them without knowing all the facts. That said:

in relation to the first question, even if it can be said to be necessary to collect some of the personal information for a lawful purpose, it is questionable whether it’s necessary to collect all of it;
in relation to the second question, the website operator may endeavour to rely on certain IPP2 exceptions that, it might argue, justify collection from the landlords rather than the tenants (I do not express a view on this or how the Privacy Commissioner might approach such reliance);
even if an IPP2 exception did apply, the answer to the third question might be no. The website operator appears to be collecting the information from landlords without either the landlords or the website operator giving the tenants an opportunity to comment, in circumstances where the website operator is unable to verify the content before publication, and where the publication could be harmful to tenants in various ways. Does that sound like a fair means of collection to you?

Regardless of the application of the Privacy Act’s collection principles, website operators holding this kind of personal information still need to be mindful of other principles. For example:

they have storage and security obligations under IPP5;
they need to comply with their obligations in IPP6 to provide access to an individual’s personal information on request by that individual;
they need to deal with requests for corrections to personal information in accordance with IPP7;
they “must not use or disclose that information without taking any steps that are, in the circumstances, reasonable to ensure that the information is accurate, up to date, complete, relevant, and not misleading” (IPP8); and
they “must not keep that information for longer than is required for the purposes for which the information may lawfully be used” (IPP9).

In relation to IPP8, it’s not clear that website operators doing this kind of thing are taking any steps to ensure the information about tenants that they publish is accurate, up to date, complete, relevant, and not misleading.

In relation to IPP9, one of the website operators referred to in the Stuff article has referred to immortalising their names and photos on record forever. That seems problematic.

Copyright issues

Website operators doing this sort of thing also need to be careful with publishing photos of people. In addition to being potentially problematic from a privacy perspective, publication of photos can create copyright problems. As noted above, photos are copyright works and should not be copied and published without permission of the copyright owner. The fact a photo is publicly available elsewhere on the web, e.g., in a tenant’s Facebook account, does not mean others have legal permission to copy and publish them. They don’t.

Now, social media and website operators may allow the uploading of user-generated content that is protected by copyright, without moderating the content before it’s published. They have a limited defence to copyright infringement while they don’t know it’s infringing. However, if they’re informed it’s infringing and don’t delete or prevent access to it as soon as possible, they can become liable for copyright infringement.

Defamation

The website operator also needs to be wary of committing the tort of defamation. A website operator that publishes defamatory content provided by another can be liable in defamation on the basis that it allows publication of the statements and repeats the statements. In some situations a website operator may be able to avoid liability on the basis of innocent dissemination but, once it knows that the material it’s hosting is defamatory, it can become liable if it doesn’t take it down.