Is it possible to rent a place without giving out all my personal information?

Question

I am trying to rent a place in Sydney, Australia. I believe this question remains valid regardless where you live.

When renting a place, a real estate agent is permitted by law to ask for as much personal information as they want, such as your passport, your Medicare number, your Centrelink customer reference number (social security identifier), your driver licence, your birth certificate, your employment history, your rental history, your education, etc.

They are also permitted by law to disclose personal information to residential tenancy database operators for screening purposes, such as National Tenancy Database (owned by Equifax which infamously leaked personal information of 145M Americans to China in 2017) or Trading Reference Australia (investigated by the Office of the Australian Information Commissioner in 2020 for potential data breach).

As a privacy-aware individual, this really worries me. I don't want my personal information ends up in the hand of information brokers (legal information thieves in my own opinions), such as Acxiom, or even worse, in the hand of identity fraudsters. With this amount of personal information, it's more than enough to impersonate or blackmail me.

While in theory, personal information cannot be collected unless it is "reasonably necessary" and sensitive information cannot be collected without "consent". In practice, they can simply refuse renting the property if you don't give what they want.

How should a privacy-aware individual rent a place? Is it better for privacy if one were to stay in a hostel? What are my options?

Answer 1

Most private landlords are not covered by the Privacy Act

The act is only applicable to organisations with annual revenues of more than $3 million (and others criteria not applicable here). Most private landlords will not meet that threshold. So a landlord can ask whatever information they like and hand it out in flyers if they like.

The act will almost certainly apply to others like credit reporting agencies and real estate agents (except very small operations). The can only collect information reasonably necessary and must explain:

• why they need to collect it

• what happens if you don’t give it to them

• who they would usually disclose it to

• that you can access it

• that you can complain about their handling of it

This explanation will usually be in their privacy policy which all organisations subject to the Act are required to have.

Real estate agents are expressly allowed to contribute to and access residential tenancy databases.

Private individuals do not have a right to sue directly under the Act for breaches but there may be indirect methods. For example, a consumer can seek damages under Australian Consumer Law for misleading and deceptive conduct - a person who has said they will follow a particular policy and doesn’t has arguably done this although I know of no case law on point.