Real estate agencies using software to screen tenants, rank rental applications or carry out background checks may need to update their privacy policies before new laws take effect on 10 December.
The changes to Australia’s Privacy Act will require businesses covered by the legislation to explain when computer programs use personal information to make, or play a major role in making, decisions that could significantly affect someone.
And while many agencies might assume the rules only apply to artificial intelligence, they also cover ordinary software that has been used in real estate offices for years.
Thomas Beard, founder of Melbourne-based Agentic Digital Identity (ADI), said this was one of the biggest misunderstandings surrounding the changes.
“The law never says AI. It says ‘computer program’, and the explanatory memorandum that came with it spells out that this includes pre-programmed, rule-based processes as well as AI and machine learning. The Office of the Australian Information Commissioner (OAIC) reads it the same way.
“So yes, standard software counts. The memorandum’s own example is an Excel spreadsheet that produces a score about a person, where the score is a key factor in someone’s decision. A rule that automatically drops applicants under an income threshold is in the same boat as an AI model.”
Rental applications could be affected
For real estate agencies, the biggest impact is likely to be in property management, where software is increasingly used to assess prospective tenants.
For example, an agency might use a rental application platform that automatically ranks applicants based on their income, rental history or other information.
Another system might automatically reject applications that do not meet a minimum income requirement.
Under the new rules, agencies covered by the Privacy Act may need to explain these processes in their privacy policies if they significantly affect decisions about applicants.
Mr Beard said agencies should pay particular attention to the technology used in their leasing departments.
“As you can imagine, property management is where most of it sits. The OAIC’s guidance names access to housing as a significant interest, and it uses a rental example: a program that pulls in an applicant’s details, calculates a suitability score and drops it straight into the assessment screen.”
He said tenancy database checks, credit checks and AI-generated summaries of rental references could also be relevant, depending on how much weight property managers place on the results.
However, everyday AI tasks such as writing listing descriptions or sorting emails would generally fall outside the new requirements because they do not involve significant decisions about individuals.
A property manager making the final call may not be enough
One of the more important details for agencies is that having a person approve a decision does not necessarily mean the software falls outside the rules.
If a property manager relies heavily on an automated ranking system to choose a tenant, the agency may still need to disclose how that technology influences the decision.
Mr Beard said the distinction was important.
“The rule also covers software that does something ‘substantially and directly related’ to a decision a person makes, and the explanatory memorandum says ‘substantially’ means it’s a key factor in that person’s decision.
“If a property manager works off a ranked shortlist, that ranking counts, even if they’re the one clicking approve.”
He said agencies should look beyond who makes the final decision and consider how much influence their software has along the way.
What agencies actually need to do
The changes do not ban agencies from using automated systems or AI to help make decisions. Instead, covered businesses must make their use of relevant technology clearer to the people whose information they collect.
This means updating privacy policies to explain what kinds of personal information the software uses, what decisions it makes automatically and what decisions it substantially helps staff make.
Agencies will not generally need to name individual software providers or explain the technical workings of their systems.
Mr Beard said the policy update itself should be relatively straightforward once agencies understand how their technology works.
“Most agencies have a stack of tools bought at different times by different people, and a lot of the decision-making lives in settings nobody has looked at since onboarding. It might be a default minimum score, an auto-decline rule or an integration that pulls a credit file, and you have to find those before you can disclose them.”
That means agencies may need to contact their technology providers to establish exactly how their systems handle applications and whether any automated rules are operating behind the scenes.
What happens if agencies don’t comply?
Businesses that fail to meet the new requirements could face regulatory action from the Office of the Australian Information Commissioner.
Mr Beard said infringement notices could reach $21,840 per contravention for a company, with higher penalties possible in certain circumstances.
However, he believes the damage to an agency’s reputation could be just as significant.
“Look, for most agencies I think the bigger risk is reputational. Privacy policies are public, and ‘we didn’t know our software did that’ is a hard thing to say to a renter who’s been knocked back.”
The changes also come as the OAIC continues to examine privacy practices in the property sector, including the information rental application platforms collect from prospective tenants.
Are smaller agencies exempt?
Not every real estate business will automatically be covered by the new requirements; businesses with annual turnover of $3 million or less are generally exempt from the Privacy Act, although exceptions apply.
Mr Beard said smaller agencies should also consider how the rules interact with anti-money laundering obligations, particularly when using automated identity verification systems.
Agencies should therefore check whether the Privacy Act applies to their business and whether any of their software falls within the new disclosure requirements.
What should agency principals do now?
With the deadline approaching, Mr Beard recommends starting with a review of the technology already being used across the business.
“If I ran an agency, I’d start with a list of every tool that touches a decision about a person – application platforms, screening and database checks, CRM automations, arrears workflows, ID checks. Then I’d go through each one and ask whether it decides, or whether it scores or filters in a way the team usually follows, and write the answer down with a date, including for the ones that are out.”
He also recommends asking technology providers to explain in writing what their products do with applicants’ personal information and whether any decisions are made automatically.
The OAIC has published guidance to help businesses understand the new requirements, while ADI has developed a free online checker to help businesses assess their software and prepare disclosure wording.
Ultimately, Mr Beard believes the changes present an opportunity for agencies to build greater trust with their clients.
“I think this is a good moment for agencies. Agents sell trust, and an agency that can tell a renter in plain words what its software does with their application, and where a person makes the call, looks a lot better than one that can’t.”