Australia’s Office of the Australian Information Commissioner (OAIC) has handed down a landmark determination against rental-application platform 2Apply, operated by InspectRealEstate (IRE). Published on 22 April 2026, the ruling concludes that the company collected far more personal information than was reasonably necessary, including applicants’ gender, student status, citizenship status and visa-expiry dates. The Commissioner found that such data harvesting breached Australian Privacy Principle 3.2 (data minimisation) and that the design of 2Apply used manipulative “choice-architecture” such as confirm-shaming and bundled consent to push renters into revealing sensitive details. Why does this matter to global mobility? Expatriates, temporary visa-holders and new migrants are disproportionately represented in Australia’s rental market. Requiring disclosure of visa status exposes them to potential discrimination and increases the risk of identity fraud if documents are breached. The decision forces IRE to remove these questions and serves as a warning to scores of other RentTech providers that similar practices will not pass privacy scrutiny. For employers relocating talent to Australia, the ruling means assignees will face fewer invasive questions when completing lease applications. Relocation managers should brief transferring staff that landlords can no longer insist on visa-expiry dates as a condition of tenancy. Real-estate agencies, meanwhile, must review onboarding forms to ensure they are not requesting unnecessary immigration information. The case also signals a tougher enforcement stance by the OAIC just months ahead of the government’s planned overhaul of the Privacy Act. Organisations that process visa or passport data—travel agents, accommodation providers and sharing-economy platforms—should expect heightened regulatory attention. Finally, the decision strengthens Australia’s reputation for safeguarding migrant data at a time when other jurisdictions are debating similar protections. Multinationals can cite the ruling as proof that employee data transferred to Australia will be subject to world-class privacy controls.
