the solution Logo
the solution
Banner Photo

Recent Cases: Commonwealth

IRE Pty Ltd (Privacy) [2026] AICmr 24 (1 April 2026)

Facts

 

The Australian Privacy Commissioner (“Commissioner”) made a determination that IRE Pty Ltd interfered with the privacy of individuals by breaching Australian Privacy Principles (“APP”) 3.2 and 3.5. The Commissioner made declarations as to the time and steps that IRE Pty Ltd needed to take action in relation to the breaches. 

 

IRE Pty Ltd, trading is InspectRealEstate (“respondent”) is a corporation owned by a parent company Reapit Holdings Pty Ltd.  The respondent owns and operates a suite of software products that are tailored for real estate agencies, including the 2Apply third-party rental technology platform (“Platform”) and the 2Apply form (“Form”).  Rental technology platforms of the type considered by the Commissioner have emerged in recent years as the primary way for individuals to submit applications for rental properties.  To apply for a property, individuals need to create an account on the Platform and create a profile, which includes details such as name and contact details of the applicant, their dependants, their employment referees and emergency contacts.  Other information sought includes smoker status, address history, employment history, pet details and vehicle details including registration. For action to be taken they need to fill out various details on the Form.   The Commissioner’s determination reinforces that the third-party operators of this Platform and similar technologies may bear their own obligations under the Privacy Act to handle personal information in a manner consistent with the APPs.

 

Held 

 

The Commissioner determined that the respondent interfered with the privacy of individuals whose personal information was collected, concluding that: 

  • The collection of the personal information was not reasonably necessary for its functions or activities, in breach of APP 3.2; and 
  • The collection of personal information by unfair means, in breach of APP 3.5.

 

Reasoning

 

Collection of personal information that is reasonably necessary for functions or activities – APP 3.2 

 

Does the respondent collect personal information?

The Commissioner reasoned that personal information is routinely uploaded onto the Platform and collected by the respondent as part of its business practices.  The information is about an identified individual and held on record by the respondent, for various periods of time depending on the success of the application.  The Commissioner was satisfied that the respondent collected personal information and had obligations to comply with the APPs. 

 

The respondent’s functions or activities

The Commissioner characterised the respondent’s functions or activities with the Platform to include: 

  • Facilitating the processing of complete tenancy applications; 
  • Facilitating the management of successful tenancy applications; and 
  • Improving its service offerings and fields on the Form. 

 

Was the personal information collection reasonably necessary for the respondent’s functions or activities?

The primary purpose for collecting the personal information was for the purpose of allowing the respondent to facilitate the processing of tenant applications, which is disclosed to applicants in the terms and conditions of use.  More generally, the Commissioner considered that the purpose of the collection was to ‘provide a service’ to potential applicants and real estate agent customers, but this was an overly broad purpose that would undermine other APPs. 

 

The Commissioner then considered whether the respondent’s function could be performed without collecting the personal information.  The Commissioner reasoned that, while the respondent’s intention to provide real estate agents with all personal information they may require in a ‘ready to act’ form, the various legislation and guidelines did not authorise landlords to collect any and all personal information that might be helpful or desirable. 

 

The Commissioner considered that an individual’s identity and contact details, ability to pay rent and whether they are likely to appropriately maintain the property are necessary pieces of personal information for the function.  However, the Commissioner found that the respondent was likely to be able to perform its functions without collecting personal information about an individual’s gender, dependents’ details, student status, bankruptcy status, retirement status, living history, current or intended ownership of their principle place of residence or investment property, current applications for other properties, bond and rent status, citizenship status, emergency contact or vehicle details.  In addition, the Commissioner considered that the respondent did not need to collect identification documents, proof of income documents and employment details to the extent that it collected them in order to perform its functions for rental applicants. 

 

Additionally, the respondent would be able to facilitate the administration and management of successful tenancy applications with a lesser amount of personal information.  Improving the respondent’s service offerings on the Form did not inherently require personal information that identifies individuals; this function could be undertaken with technical or operational metrics, as well as usability testing and feedback. 

 

The Commissioner concluded that the respondent had collected personal information that was not reasonably necessary for its functions or activities, particularly in relation to the personal information collected for considering applicants. 

 

Collection of personal information by lawful and fair means – APP 3.5

 

The Commissioner considered the relevant personal circumstances for the context of the collection.   This included the inherent and significant power imbalance in the rental property market, exacerbated by the current rental crisis; that individuals tend to have a limited choice and cannot choose which rental platform to use; the excessive collection of personal information along with security risks, and the ‘Online Choice Architecture’ practices employed by the respondent which unfairly pressures individuals into making choices misaligned with their preferences or choices.  The Commissioner added that Online Choice Architecture practices can include ‘confirm shaming, biased framing and bundled consent’, each of which were found by the Commissioner to have been employed by the respondent. 

 

The Commissioner found that the circumstances set out above supported the Commissioner’s conclusion that the collection of personal information by the respondent was not fair. This was found to be characterised by the power imbalances, limited choice and security risks while rental applicants are at a disadvantage when trying to rent a home.  The Commissioner concluded that the respondent had contravened APP 3.5. 

Stewart and Secretary, Services Australia (Freedom of Information) [2026] ARTA 759 (11 May 2026)

Facts

 

Mr Stewart (“applicant”) made a request to Services Australia (“respondent”) under s 48 of the FOI Act to amend a document “Defined Benefit Income Stream Schedule for Centrelink assessment purposes” that contained information about him.  The applicant sought to amend the document as he believed an incorrect or misleading methodology had been used in the document. 

 

The respondent refused the amendment request, informing the applicant that Centrelink had corrected and updated the applicant’s records based on documentation he had provided, meaning the current documents were not incorrect or misleading.  The applicant applied to the Australian Information Commissioner (“Commissioner”) for review the decision to refuse amendment.  The Commissioner set aside the respondent’s decision, substituting a decision that the respondent must amend the document in issue by adding a note specifying where the document is incorrect, pursuant to s 50(2)(b) of the FOI Act.  The respondent provided the applicant with an amended copy of the document and confirmed that a note had been added as a permanent display to the file, to advise all future staff that the new methodology had been incorrectly selected. The applicant again applied to the Commissioner, expressing concern with the respondent’s implementation of the Commissioner’s decision.  As the Commissioner did not consider that any further action was required the applicant sought review by the Administrative Review Tribunal (“Tribunal”). 

 

Held

 

The Tribunal was satisfied that necessary amendments had been made to ensure the personal information was correct, up to date and not misleading. 

 

Reasoning

 

Amendment to personal records – s 50

 

Is the information incorrect, misleading or out of date? 

The Tribunal was not satisfied that the applicant had provided the necessary information to prove that the personal information remained incorrect.  The Tribunal could not identify an amendment that would be likely to be more correct than the information recorded at that time.  The evidence reflected that the inaccurate information had been corrected by the inclusion of a note on the original document, further following documents had contained the correct calculation information and did not require amendment. 

 

The Tribunal’s view was that including the note on the original document allowed the reader to understand the context surrounding the original error.  The information did not convey false or inaccurate meanings and the corrections to the Centrelink screens meant that the reader would not be led into error by presenting false information.  While, originally, the document was out of date, after the addition of the amendment, the personal information was no longer out of date. 

 

Was the Commissioner correct to conclude the addition of a note for amendment? 

The Tribunal considered whether the Commissioner’s decision to add a note as amendment under s 50(2)(b) was correct. Adding a note was taken as the appropriate way to amend the document, raising the concern that, if the document was amended, essentially as if the error did not occur by replacing it with the “correct” document, then that could mislead future readers or decision-makers. The fact remained that an error did occur and it cannot simply be erased from the record.  However, the note showed that the error could be remedied without distorting the historical facts of the matter and allowed the respondent to correct the error transparently.