Residential tenancy databases

17.63 RTDs raise a range of issues. They are dealt with here because they are currently regulated by inconsistent and fragmented federal, state and territory legislation.

17.64 RTDs are electronic databases operated by private companies containing information about a tenant’s rental history. The purpose of such databases is to enable real estate agents to assess ‘business risk’ on behalf of the property owner. The listings on the database are based on information provided by real estate agents to the database operators. Listings are generally collected from across Australia and access can be obtained nationally.

17.65 In April 2004, the Privacy Commissioner made four determinations concerning a residential tenancy database operator. These determinations included that the operator had breached a number of the NPPs by:

• using an agreement with its members that did not specify sufficiently the data quality standards required;

• failing to take sufficient steps to check listings by property managers and not requiring minimum identification before listing;

• failing to advise tenants contemporaneously that they had been listed;

• using a ‘pick list’ method of reporting tenancy history, which relied on one category that was broadly defined and on descriptions that were brief, not consistently defined and not mutually exclusive;

• providing an inadequate dispute resolution process;

• failing to provide mechanisms to correct records where the individual concerned had established they were not accurate, complete and up-to-date, or to associate a statement to this effect when there was a dispute about accuracy, completeness or currency;

• charging individuals an excessive amount of money for access via mail to their personal information;

• failing to take reasonable steps to make sure the personal information it collected, used and disclosed was up-to-date; and

• failing to take reasonable steps to destroy or de-identify personal information that was no longer needed for any purpose.^[65]

17.66 RTDs contain personal information and so are subject generally to the private sector provisions of the Privacy Act. They are also regulated by legislation in some states and territories. The Privacy Act currently applies to RTD operators with an annual turnover of $3 million or less, despite the small business exemption, because they trade in personal information.^[66] If an RTD operator that is a small business gains consent for the collection or disclosure of an individual’s personal information, the Privacy Act will not apply.^[67] Further, the Privacy Act does not contain provisions directed specifically at RTD operators. For example, unlike credit reporting agencies, there is no provision under the Privacy Act relating to time limits for the removal of default listings.^[68]

17.67 While the states and territories can regulate the actions of the lessors and agents in their jurisdictions, they lack the power to regulate effectively RTD operators based in different jurisdictions.^[69] Residential tenancy legislation in New South Wales, Queensland, and now the ACT regulates how real estate agents and lessors list tenants on RTDs.^[70] This legislation, however, is incomplete and inconsistent. For example, while the Property, Stock and Business Agents Regulation 2003 (NSW) provides for the length of time information can be listed,^[71] and whether a listed person can access the listing information,^[72] the Residential Tenancies Act 1994 (Qld) does not. In South Australia and the Northern Territory some regulation is provided through fair trading legislation.^[73] This is primarily consumer protection legislation, however, and does not relate specifically to RTDs.

17.68 A number of inquiries have now recognised the need for national consistency in the regulation of RTDs.^[74] In August 2003, the Ministerial Council on Consumer Affairs (MCCA) agreed with the Standing Committee of Attorneys-General (SCAG) to establish a joint Residential Tenancy Database Working Party. The Working Party released its Report on Residential Tenancy Databases on 27 September 2005. The Working Party found that ensuring national uniformity in the treatment of RTDs was essential. It stated, however, that it was inappropriate for the Australian Government to legislate for RTDs and their use by agents, given the existing state and territory responsibilities for agents and tenancy issues.^[75]

17.69 The Working Party expressed the view that state and territory legislation should address the relationship between the agent and the tenant. Issues to be addressed include: informing the tenant about the use of RTDs and the collection of information; and the way that agents interact with RTDs, including such matters as controlling the information provided by agents to RTDs. The Working Party recommended that states and territories develop agreed uniform model legislation on the use of RTDs by landlords, agents and listing parties. In April 2006, SCAG agreed to develop model uniform legislation for RTDs. The MCCA has primary responsibility for drafting the legislation.

17.70 The Working Party also concluded that, because the states and territories would generally not be able to regulate directly the operation of RTDs or their interaction with agents, the Privacy Act should regulate this aspect of the operation of RTDs. The Working Party was concerned, however, that because the Privacy Act does not apply to small businesses that collect or disclose personal with the consent of an individual,^[76] RTD operators are not required to comply with other privacy obligations such as those relating to data quality. The Working Party recommended, therefore, that regulations should be made pursuant to s 6E of the Privacy Act to prescribe all RTDs as organisations for the purposes of the Privacy Act.

17.71 The Working Party also noted that the Privacy Act is not prescriptive and does not permit the OPC to direct RTD operators to comply with their obligations under the Act. The Working Party recommended, therefore, that the Australian Government consider the option of a binding code if RTD operators do not comply with the Privacy Act.^[77]

17.72 In submissions to this Inquiry, stakeholders raised a large number of concerns about the operation of RTDs, including that: tenants are often given little choice when signing tenancy agreements and RTD users routinely extract ‘consent’ from tenancy applicants; information held on RTDs is sometimes inaccurate;^[78] many tenants are unaware that they are listed on an RTD;^[79] RTDs can make it difficult for Australian households reliant on the private rental market to secure housing;^[80] inconsistent state and territory legislation regulating RTDs causes a number of problems;^[81] and in some jurisdictions there is no body to receive complaints about RTDs.^[82]

17.73 In DP 72, the ALRC agreed with the recommendations of the RTD Working Party that the states and territories should enact legislation that addresses the relationship between the agent and the tenant, including issues such as: informing the tenant about the use of RTDs and the collection of information; and the way that agents interact with RTDs, including such matters as controlling the information provided by agents to RTDs. The OPC and the OVPC endorsed uniform state and territory legislation to regulate the use of RTDs by landlords, agents and other listing parties.^[83]

17.74 The ALRC also expressed the view that all RTD operators should be regulated by the Privacy Act, regardless of whether they are small business operators or whether they gain consent for the collection or disclosure of an individual’s personal information. The ALRC noted that the then Attorney-General had announced that regulations to extend the coverage of the Privacy Act to all RTDs were complete.

17.75 The ALRC noted that some stakeholders had argued that all RTD operators should be brought under the Privacy Act and that the OPC should make a binding code in relation to them.^[84] Others supported both state and territory legislation and a binding code under the Privacy Act.^[85] One stakeholder submitted that it did not believe that the need for a binding code on RTD operators had yet been demonstrated, but that it may be supportive in the future if this is required.^[86]

17.76 The ALRC did not propose the making of a binding code to regulate RTD operators. It was the ALRC’s view that state and territory legislation regulating the use of RTDs and the regulation of RTD operators by the Privacy Act should deal with many of the issues identified in the submissions. The ALRC also expressed the view that it would be appropriate for the Privacy Commissioner to delegate his or her complaint-handling powers in relation to RTD operators to state and territory tenancy tribunals and equivalent bodies.

Submissions and consultations

17.77 Some stakeholders continued to raise concerns about the operation of RTDs.^[87] Anglicare submitted that the Privacy Commissioner should develop and enforce a binding code that provides detailed guidance on compliance with the Privacy Act by RTD operators and their customers.^[88] The Australasian Compliance Institute indicated that it supported the Privacy Commissioner imposing further requirements on RTD operators in the future if there was evidence of ‘privacy problems’.^[89]

17.78 The Queensland Government addressed the ALRC’s view that the Privacy Commissioner could delegate his or her complaint-handling powers in relation to RTD operators to state and territory tenancy tribunals and equivalent bodies. It submitted that:

consultation on the detail of how such a proposal would be implemented, and to determine capacity and resourcing, must occur with tenancy authorities and counterpart complaints tribunals (in Queensland, the Small Claims Tribunal). … Additionally, the Queensland Government notes that this proposal may give rise to confusing duplication, with tenancy-related privacy complaints handled by tenancy dispute authorities and general privacy complaints by existing dedicated privacy regulators or complaint frameworks.^[90]

ALRC’s view

17.79 A number of reviews have established the need for stronger and nationally consistent regulation of RTDs. The ALRC shares the concerns raised in these reviews and of those who made submissions to this Inquiry in relation to the collection, use and disclosure of personal information held on RTDs. The ALRC agrees with the recommendations of the RTD Working Party that states and territories should enact legislation that addresses the relationship between the agent and the tenant. Legislation would address issues such as: informing the tenant about the use of RTDs and the collection of information; and the way that agents interact with RTDs, including such matters as controlling the information provided by agents to RTDs. The ALRC notes that the MCCA is in the process of developing raft legislation.

17.80 Further, all RTD operators should be regulated by the Privacy Act regardless of whether they are small business operators. In this regard, the ALRC notes the promulgation of the Privacy (Private Sector) Amendment Regulations 2007 (No 3) (Cth). The Regulations amend the Privacy (Private Sector) Regulations 2001 (Cth) to provide that under s 6E(2) of the Privacy Act a small business which operates a residential tenancy database and undertakes certain acts and practices is prescribed as an organisation.

17.81 The ALRC does not recommend the making of binding rules to regulate RTD operators. It is the ALRC’s view that state and territory legislation regulating the use of RTDs and the regulation of RTD operators by the Privacy Act should deal with many of the issues identified in submissions.

17.82 As noted in Chapter 48, the ALRC is no longer of the view that the Privacy Act should be amended to empower the Privacy Commissioner to develop and impose a binding code. The ALRC notes, however, that the Privacy Commissioner could request that RTD operators develop a privacy code to be approved by the Privacy Commissioner under Part IIIAA of the Privacy Act. Alternatively, the Minister could make regulations under the Act to regulate RTDs. In the ALRC’s view, the OPC should monitor the use and operation of RTDs in order to determine whether it should request that RTD operators develop a privacy code, or that it should advise the Minister to make regulations under the Privacy Act to regulate RTD operators.

17.83 The ALRC notes stakeholder concerns that tenants with privacy complaints about the handling of personal information by RTD operators should be able to have those complaints dealt with by a state or territory tenancy tribunal or an equivalent body. These bodies are well suited to deal with privacy matters in the residential tenancy context—they are quick, accessible and affordable.

17.84 In Chapter 49, the ALRC recommends that the Privacy Act be amended to empower the Privacy Commissioner to delegate to a state or territory authority all or any of his or her powers in relation to complaint handling. In the ALRC’s view, it would be appropriate for the Privacy Commissioner to delegate his or her complaint-handling powers in relation to RTD operators to state and territory tenancy tribunals and equivalent bodies under this section.

17.85 The ALRC acknowledges, however, the concerns of the Queensland Government. In the ALRC’s view, the Privacy Commissioner should consult with relevant state and territory tenancy tribunals before making such a delegation. Further, any confusion or duplication relating to the handling of complaints about RTDs would be ameliorated by clear delegations of power, the development of MOUs between the OPC and relevant state and territory tenancy tribunals,^[91] and community education.