Australia’s Office of the Australian Information Commissioner (OAIC) has handed down a landmark determination against rental-application platform 2Apply, operated by InspectRealEstate (IRE). Published on 22 April 2026, the ruling concludes that the company collected far more personal information than was reasonably necessary, including applicants’ gender, student status, citizenship status and visa-expiry dates. The Commissioner found that such data harvesting breached Australian Privacy Principle 3.2 (data minimisation) and that the design of 2Apply used manipulative “choice-architecture” such as confirm-shaming and bundled consent to push renters into revealing sensitive details. Why does this matter to global mobility? Expatriates, temporary visa-holders and new migrants are disproportionately represented in Australia’s rental market. Requiring disclosure of visa status exposes them to potential discrimination and increases the risk of identity fraud if documents are breached.
![Australia’s Privacy Commissioner Orders RentTech Platform to Stop Collecting Visa and Citizenship Data]()
If you, your employees, or your relocating assignees need to prove visa status without oversharing sensitive data, VisaHQ can help. Via our secure platform, users can obtain official visa confirmation letters, keep expiry dates on file, and share only the minimum details landlords require—fully aligned with the OAIC’s data-minimisation principles. Discover more at https://www.visahq.com/australia/
The decision forces IRE to remove these questions and serves as a warning to scores of other RentTech providers that similar practices will not pass privacy scrutiny. For employers relocating talent to Australia, the ruling means assignees will face fewer invasive questions when completing lease applications. Relocation managers should brief transferring staff that landlords can no longer insist on visa-expiry dates as a condition of tenancy. Real-estate agencies, meanwhile, must review onboarding forms to ensure they are not requesting unnecessary immigration information. The case also signals a tougher enforcement stance by the OAIC just months ahead of the government’s planned overhaul of the Privacy Act. Organisations that process visa or passport data—travel agents, accommodation providers and sharing-economy platforms—should expect heightened regulatory attention. Finally, the decision strengthens Australia’s reputation for safeguarding migrant data at a time when other jurisdictions are debating similar protections. Multinationals can cite the ruling as proof that employee data transferred to Australia will be subject to world-class privacy controls.
If you, your employees, or your relocating assignees need to prove visa status without oversharing sensitive data, VisaHQ can help. Via our secure platform, users can obtain official visa confirmation letters, keep expiry dates on file, and share only the minimum details landlords require—fully aligned with the OAIC’s data-minimisation principles. Discover more at https://www.visahq.com/australia/
The decision forces IRE to remove these questions and serves as a warning to scores of other RentTech providers that similar practices will not pass privacy scrutiny. For employers relocating talent to Australia, the ruling means assignees will face fewer invasive questions when completing lease applications. Relocation managers should brief transferring staff that landlords can no longer insist on visa-expiry dates as a condition of tenancy. Real-estate agencies, meanwhile, must review onboarding forms to ensure they are not requesting unnecessary immigration information. The case also signals a tougher enforcement stance by the OAIC just months ahead of the government’s planned overhaul of the Privacy Act. Organisations that process visa or passport data—travel agents, accommodation providers and sharing-economy platforms—should expect heightened regulatory attention. Finally, the decision strengthens Australia’s reputation for safeguarding migrant data at a time when other jurisdictions are debating similar protections. Multinationals can cite the ruling as proof that employee data transferred to Australia will be subject to world-class privacy controls.
