Information privacy is concerned with promoting and respecting the protection of information that identifies who you are, what you do and what you believe. In the property industry, and for real estate specifically, consumers or clients are constantly dealing with a property agency. Some of the clients that an agency deals with include:
- prospective vendors who are considering selling their property
- actual vendors who have signed an Agency Agreement to sell their property
- prospective landlords
- landlords renting their property under a Managing Agency Agreement
- prospective purchasers of properties inspecting a property or enquiring about that property
- actual purchasers of a property
- prospective tenants interested in renting a property
- actual tenants who have signed a Residential Tenancy Agreement
The general distinction between prospective and actual persons is made above because the relationship with prospective vendors, landlords, purchasers or tenants is at a general ‘Consumer’ level, whereas the relationship changes when a person signs an Agreement with the Agency and becomes a ‘Client’, or signs a lease.
While the legislative obligations concerning Privacy may not change for either relationship, the expectations of the individuals may be a little different when they transition from being a ‘consumer’ to a ‘client’.
Typically, agencies will collect and hold more information about clients, and so in principle, there is more risk to that information for a longer period of time.
It should be noted that the Act is applicable to government organisations as well as any organisation that has an annual turnover of more than $3M, as well as some other specific organisations that are documented. Hence, medium or large agencies are fully obligated under the Act, while smaller Agencies may not be.
Even if an agency is small, then it must be aware of the principles that the Act establishes as well as their client expectations. They cannot simply ignore any obligations concerning Privacy, or they do so at some level of risk to their business.
The thirteen (13) Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) set out how private sector organisations should collect, use, keep secure and disclose personal information.
The principles give individuals the right to know what information an organisation holds about them and a right to correct that information if it is wrong.
APP 1 – Open and Transparent Management of Personal Information applies and links closely with the requirements of the Property and Stock Agents legislation.
The Property and Stock Agents Regulation 2014 requires Agents to apply ethical standards to their behaviours.
The general Rules of Conduct are contained in Schedule 1 of the Regulations, with the following applying to, or referring directly to Privacy:
Section 1 – Knowledge of the Act and Regulations
An agent must have a knowledge and understanding of the Act and the regulations under the Act, and such other laws relevant to the category of licence or certificate of registration held (including, laws relating to residential tenancy, fair trading, competition and consumer protection, anti-discrimination and privacy) as may be necessary to enable the agent to exercise his or her functions as agent lawfully.
Section 7 – Confidentiality
An agent must not, at any time, use or disclose any confidential information obtained while acting on behalf of a client or dealing with a customer, unless:
(a) the client or customer authorises the disclosure, or
(b) the agent is permitted or compelled by law to disclose the information.
Using Personal Information
The diagram below details the sort of information (data) that an Agency deals with on a day-to-day basis:
The type of information that will be discussed, recorded, used in other documents and in other processes with respect to real estate business operations may include:
Mainly – Identification Information (which is defined in the Privacy Act 1988 as):
- the individual’s full name; or
- an alias or previous name of the individual; or
- the individual’s date of birth; or
- the individual’s sex; or
- the individual’s current or last known address, and two (2) previous addresses (if any); or
- the name of the individual’s current or last known employer; or
- if the individual holds a driver’s licence – the individual’s driver’s licence number.
Very occasionally, an agent may get information based on the following when they speak with a client, or attend a routine inspection or appraisal, which is categorised as Sensitive Information and defined as such under the Act:
- information or an opinion about an individual’s:
- racial or ethnic origin; or
- political opinions; or
- membership of a political association; or
- religious beliefs or affiliations; or
- philosophical beliefs; or
- membership of a professional or trade association; or
- membership of a trade union; or
- sexual orientation or practices; or
- criminal record:
that is also personal information; or
- health information about an individual; or
- genetic information about an individual that is not otherwise health information; or
- biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
- biometric templates.
All the above constitutes personal information under the Act and in addition:
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:
(a) whether the information or opinion is true or not; and
(b) whether the information or opinion is recorded in a material form or not.
Most real estate transactions will not record or document sensitive information, but there may be conversations with Clients or facts that become known, or opinions shared or that are derived from interacting with Clients or general consumers – and these should be considered confidential.
In addition, agencies will handle financial information that relates to Tenant Applications, Tenant payments, Landlord and Vendor bank account details etc, which are all at particular risk of being shared or used for fraudulent purposes, such as applying for credit or bank fraud. This data must be stored securely and used only for its authorised purpose.