PropTech Privacy Pitfalls: Property Lovers and Others on Notice About Unfair Collection of Excessive Personal Information and Other Data
At a time where governments are seeking to alleviate the pressure faced by renters in a housing and economic crisis, the residential property rental industry is under increasing scrutiny from regulators, including from the Privacy Commissioner.
At least in part, the additional scrutiny is driven by the rental crisis and the rising costs of living are widely reported as adding to the significant power imbalance in the rental property market. Renters are currently at the mercy of real estate agents when making rental applications, providing any information requested, whether necessary or not.
Two examples show the nature and extent of the additional scrutiny by the Federal Privacy Commissioner:
2Apply
On 22 April 2026, the Company operating the 2Apply rental technology platform was found to have collected excessive information and to have done so by unfair means. As noted by the Commissioner, “[t]he final decision requires [the Company] to cease collecting a range of personal information, such as prospective renters’ gender, student status, citizenship status and visa expiry, and details of previous living history.” This information was found not to be reasonably necessary for the Company’s functions or activities.
The Commissioner said that property managers and real estate agents generally only need enough information to confirm identity, access the candidate’s ability to pay the advertised rent and access whether the candidate is likely to maintain the property in good repair.
Property Lovers and fastproperty.ai
On 14 May 2026 the Commissioner released her report on the investigation she had initiated on Property Lovers and fastproperty.ai. This investigation followed adverse determinations made in November 2024 against the applicable companies. As noted by the Commissioner, the applicable companies “provided products or courses to paying clients to assist them in the identification of real estate properties for development or other profitable resale. The [Commissioner’s] investigations [in November 2024] focussed on the collection and use of personal information by the entities, and concluded that the scraping of personal information to target vulnerable people was unlawful and had interfered with the privacy of individuals, in contravention of the Privacy Act.”
A fresh investigation was opened by the Commissioner in April 2025 because of her concern that the applicable companies may be continuing to breach the Privacy Act. The Commissioner concluded that the applicable companies did not use personal information and therefore there was no breach of the Privacy Act. However, she identified possible breaches of other laws and referred those breaches to another regulator.
The applicable companies were responsible for the collection and use of information handled on the platform fastproperty.ai, and the disclosure of that information to platform users as they navigated by the site by using search features, filters and map overlays. The Commissioner found no evidence that the geospatial visualisation data, the live real estate listings or the property or suburb data used by the platform contained information or opinion about an identified individual, or an individual who was reasonably identifiable. Although there was information in the map overlay to pinpoint ‘distressed sellers’ and ‘motivated vendors’ linked to a property address, the Commissioner found that this was not information or an opinion about an identified individual or an individual who is reasonably identifiable.
Key lessons for agents and property managers
Property managers and real estate agents should review and if necessary strengthen their policies on how they collect, use and otherwise handle personal information and the platforms they use to do so.
The key lessons are that property managers and agents:
- should only collect information that they genuinely need;
- should not be collecting information for ‘just in case’ situations where information may only be useful if the candidate is the successful tenant;
- should review their PropTech platforms carefully to ensure they are compliant with privacy laws and other laws regulating the handling of data that is not personal information; and
- should only utilise automated screening and profiling after a careful review of implications under privacy laws and other laws regulating the handling of personal information and other data.
What does this matter?
There are significant penalties for contraventions under the Privacy Act. However, if a property manager or agent does not properly manage their handling of personal information and other data it could adversely affect the value of their business in the context of a liquidity event.
Liquidity event
We have deep experience with PropTech businesses whose ultimate aim is a liquidity event. When the prospect of a liquidity event arises, a purchaser’s lawyers will undertake concentrated due diligence on the vendor business. Tech companies often wait many years for the opportunity to sell, only for a transaction to stall when a purchaser’s lawyers begin questioning whether the PropTech solution is legally compliant, particularly with laws such as privacy legislation. In these circumstances, buyers will often walk away from a deal rather than give the vendor an opportunity to rectify legal or compliance issues.
Based on our experience, it can be tempting for businesses to avoid undertaking a deep and thorough legal and compliance review due to the associated costs. There are often significant time and budget pressures, and we regularly see tech companies attempt to bypass or minimise legal and compliance work. However, investing in getting these issues right will place your business in the best possible position when an opportunity to sell arises and improve the likelihood of a successful completion.
Queries
Please contact the authors, or any member of our Corporate Real Estate or Fintech, Privacy and Emerging Technologies teams, should you have any questions about this article, or if wish to discuss how we may be able to assist you or your business.
Disclaimer
This information is general in nature. It is intended to express the state of affairs as of the date of publication. It does not constitute legal or financial advice. If you are concerned about any topic covered, we recommend that you seek your own specific legal and financial advice before taking any action.