Australian rental technology platform 2Apply collected excessive personal information from prospective tenants and used harmful “dark patterns” to pressure renters into upload more information than necessary, the privacy commissioner has ruled.
Dark patterns are manipulative design techniques that 2Apply used in its forms for tenancy applications, the OAIC said in a determination.
2Apply, owned by Brisbane-based IRE, trading as InspectRealEstate, deployed a technique called “confirmshaming”.
Applicants were told that providing more information would “help speed up your application process,” while withholding it “may affect whether you are considered as a suitable tenant.”
Biased framing that presented choices to emphasise the benefits of providing more information without disclosing the risks of doing so was another dark pattern used by 2Apply, along with bundled consent that required an agreement for personal information to be used for direct marketing, with no opt-out at data collection.
It is the first time the Office of the Australian Information Commissioner (OAIC) has applied the concept of “online choice architecture” – the way digital forms present and structure choices to shape user behaviour – in an assessment of whether personal information was collected by fair means under the Australian Privacy Principles (APPs).
The commissioner Carly Kind noted the power imbalance prospective tenants face when applying for rentals in an accommodation crisis with rising costs of living, leaving them vulnerable to unfair information collection practices.
“Renters often lack real choice when making rental applications,” Kind said.
“Either they hand over personal and private information, including ID documents and payslips, or risk housing precarity or even loss.
“This not only places them at risk that their applications will not be considered fairly and equitably, but that their personal information may be compromised in a data breach or cyber attack.”
While 2Apply is the largest “RentTech” platform with around 37 percent marketshare, there are six others operating in the same space.
Kind called on all RentTech providers to audit what data they collect, and to ensure that the information gathering practices are both necessary and fair.
2Apply to cull data collection
Without conceding that collecting the data was unlawful, IRE has agreed to cease collecting data on applicants’ genders, whether they’re students, smokers, bankruptcy status, their current or intended ownership of property and bond history and claims.
IRE will also limit collection of dependants information to number and ages only, instead of tenancy applicants having to provide full details.
Retirement status, previous living history, current applications for other properties, bond and rent assistance status along with citizenship and visa expiry were deemed by the privacy commissioner to not be reasonably necessary for processing of tenancy applications.
IRE has not, however, agreed to cease collection of that data, which the determination says contravenes APP 3.2.
IRE can appeal the determination at the Administrative Review Tribunal within 28 days.
