Case Note: IRE Pty Ltd (Privacy) [2026] ALCmr 24 (1 April 2026)

The Commissioner’s determination:

On 1 April 2026, Privacy Commissioner Carly Kind found that IRE Pty Ltd, owner and operator of 2Apply, interfered with individuals’ privacy by collecting personal information that was not reasonably necessary for its functions or activities, and through unfair means, in breach of Australian Privacy Principles (APPs) 3.2 and 3.5.

In reaching this conclusion, the Commissioner placed particular emphasis on the design and operation of the 2Apply platform, the volume and sensitivity of personal information required from applicants and the power imbalance faced by individuals in a competitive rental market. The Commissioner also considered how the platform’s “online choice architecture” exerted pressure on users to provide excessive personal information.

The Commissioner made an extensive declaration under s 52(1A)(b) the Privacy Act 1988 (Cth) (Privacy Act), which included a requirement that IRE Pty LTD:

• Cease collecting specified categories of personal information within 60 days.

• Engage an independent privacy reviewer to assess:

• whether each category of information collected is reasonably necessary (APP 3.2),

• the fairness of the platform’s online choice architecture (APP 3.5), and

• data retention practices under APP 11.2.

Takeaways for APP entities:

This decision highlights that compliance with APP 3.2 requires more than assessing whether information may be useful. The Commissioner rejected broad statements of purpose such as “providing a service”, instead construing IRE Pty Ltd’s functions as limited to facilitating the processing of completed rental applications. Entities should expect the OAIC to interrogate stated purposes of collection and disregard those that are overly expansive.

Entities must determine whether each category of personal information is reasonably necessary, in the objective circumstances at the time of collection, for their functions or activities. Entities should narrowly construe their purposes for collection of personal information. 

The decision also underscores that the means of collection matter. Practices that exploit power imbalances, urgency, or fear of adverse consequences may constitute unfair collection under APP 3.5. Entities operating digital platforms should carefully review user interfaces, consent mechanisms, and messaging to ensure that personal information is not obtained through undue pressure, including through techniques such as confirmshaming, biased framing, or bundled consent.

The Commissioner treated IRE Pty Ltd as responsible for the default list of information fields it embedded in 2Apply, even though agents could customise forms. This is an important compliance signal for SaaS platforms that provide configurable templates.

The determination also signals increased scrutiny of APP 11.2 retention practices for platforms that store large volumes of personal information.

Background:

The 2Apply platform is an application used by real estate agencies and renters to manage rental applications, property maintenance requests, and rental payments.

Between March 2020 and March 2025, rental applicants were required to provide extensive personal information to create an account and submit applications on the platform.

APP 3.2 prohibits APP entities from collecting personal information unless it is reasonably necessary for one or more of the entity’s functions or activities. The Information Commissioner’s guidelines indicate that necessity depends on:

• the primary purpose of collection;

• how the personal information will be used in carrying out the entity’s functions or activities; and

• whether those functions or activities could be achieved without collecting the information, or by collecting a lesser amount.

APP 3.5 requires that personal information be collected by lawful and fair means. The Commissioner’s guidelines clarify that collection will not be fair where it involves intimidation, deception, or is unreasonably intrusive.

The determination forms part of a broader regulatory trend. The OAIC has previously signalled that the real estate sector would be a focus of its privacy sweep and the determination anticipates forthcoming reforms introducing a “fair and reasonable” test for data collection and prohibitions on dark‑pattern practices under the Australian Consumer Law.

If your agency or organisation requires assistance in understanding how this determination may affect you, please contact our information law experts:

James Pratt – james.pratt@adaptbl.com.au | 0423 368 823
Alex Gent – alex.gent@adaptbl.com.au
Geoff Adams – geoff.adams@adaptbl.com.au | 0404 608 231