First Reading

Bill introduced on motion by Mr Anoulack Chanthivong, read a first time and printed.

Second Reading Speech

Mr ANOULACK CHANTHIVONG (Macquarie Fields—Minister for Better Regulation and Fair Trading, Minister for Industry and Trade, Minister for Innovation, Science and Technology, Minister for Building, and Minister for Corrections) (11:14): I move:

That this bill be now read a second time.

I am pleased to introduce the Residential Tenancies Amendment (Protection of Personal Information) Bill 2025. The bill is yet another important milestone in the Minns Labor Government's commitment to modernise the New South Wales tenancy market and make renting fairer. The Government has already brought in the biggest reforms to rental laws in more than a decade. No‑grounds evictions have been abolished and landlords are now required to provide a valid reason when ending a lease. The Government has also made it easier for renters to have pets, limited rent increases to once per year, ensured renters are not asked to pay extra charges at the start of a tenancy and enabled rent to be paid by a free bank transfer. The Government also committed to improving protection of renters' data and privacy, and this bill fulfills that commitment.

Renters in New South Wales are being asked to provide vast quantities of personal information when they apply for properties. That can range from names to pay slips, bank records and highly sensitive identification documents. It can also include clearly unnecessary information such as photos, social media accounts, or even information about their children or relationship status. It is not clear how that information is being used, and if it ends up in the wrong hands the outcome could be disastrous. The Annual Cyber Threat Report indicates a data breach is reported around every six minutes. The consequences are significant and include identity theft, discrimination, emotional and financial harm, loss of consumer trust and reputational damage for businesses and government. The more information that is collected, the greater the risks.

The risks are even more pronounced in the current tight rental market, where renters are applying for multiple properties. Their information may be held by multiple agencies across multiple platforms. Renters provide the information in good faith and should not have to trade away their privacy to find a place to live. The current situation also subjects landlords and agents to significant risks. Many agents are worried about the amount of personal data they hold and their vulnerability to data breaches. Agents often comment that they feel obliged to collect and hold vast quantities of personal information to show landlords that they have done their due diligence in assessing potential renters, and because other agents also collect that amount of information. Once renters' information is collected, it is often used for purposes other than to assess their suitability for a property or to manage a tenancy.

For example, personal information can be used to market insurance and financial products. It is also usually kept for longer than necessary, with no clear time frames within which the information must be destroyed. While some real estate agencies and property technology companies are covered by the Commonwealth Privacy Act, smaller agencies and landlords are not covered. Further, the requirements in the Privacy Act are very general because they are intended to apply to a wide range of industries. All those elements show that there is a need for specific privacy obligations for the rental sector. The obligations set out in this bill address the needs of renters, landlords, agents and the growing property technology sector. They ensure that the personal information of renters is protected, while making certain that landlords can obtain the information they need to assess a rental application and manage a tenancy.

The bill, and the regulations that will be made under it, will establish a comprehensive scheme for dealing with the personal information of renters. It will limit personal information that can be collected from renters and set controls on its use and disclosure at different stages of a tenancy. The changes include requirements for safe storage of information and time frames for disposal. The reforms in the bill were developed following extensive public consultation, with over 16,000 survey responses and more than 400 written submissions from renters, owners, real estate agents, tenant advocates and industry representatives. The NSW Rental Commissioner consulted with renters, owners, agents, advocates, academics, the NSW Privacy Commissioner, experts in the field and a special reference group of experts. That group informed the development of the reforms to ensure the policy was reasonable, effective and proportionate to meet the needs of both industry and renters.

The Government has consulted widely and thoroughly to make sure the bill gets the balance right for owners, renters and others involved in the residential tenancy process, and for the people of New South Wales. In addition to making rules about dealing with renters' personal information, the bill makes other amendments relating to disclosure of embedded networks and altered images in rental advertisements, and a grace period for renters to apply to have pets.

I now turn to the detail of the bill. The bill applies the Australian Privacy Principles [APPs] in the Commonwealth Privacy Act 1988 to all landlords, agents and property technology operators who assist landlords, agents and renters in the leasing and management of rental premises. Many agents and property technology operators are already bound by these privacy principles, which are general in nature and establish a benchmark for the protection of personal information across a broad range of businesses. Applying the APPs will provide foundational protections for renters that will be augmented by specific requirements relevant to the rental sector. The APPs cover issues such as collecting only information that is consented to by the person concerned, using and disclosing information only for the purpose that the person has consented to, and taking reasonable measures to securely store the information and dispose of it when no longer needed. The bill also contains specific privacy protections for the rental sector, and regulation-making powers that will allow further details to be set out in the regulations. This will enable flexibility in the detailed requirements.

The first protection in the bill is that a landlord or agent who collects personal information must offer the renter a way of providing the information directly to the landlord or agent. This aims to ensure that a renter is not forced to provide their data to a property technology platform to apply for a property if they would prefer not to do so. The bill also ensures that information must be collected directly from a renter unless they consent to it being collected in another way or the regulations permit this. This will ensure that landlords and agents will be limited to permitted sources of information and are not able to use information from sources such as social media to assess rental applications.

The bill provides for the development of a mandatory application form that will be required to be used for all rental applications. This will be included in the regulations. Although the information fields will be prescribed, there will be flexibility in the format and layout to support the use of different digital and paper forms. It is intended that the standard application form will specify that information can be collected from a rental applicant only for limited and legitimate purposes, to determine whether the applicant will be a suitable match for the property.

The regulations will set out the information that an applicant can provide, at each stage of the application process, to allow an assessment of the applicant's ability to pay the rent, the likelihood they will look after the property and be reliable, and to verify their identity. The number and type of documents that can be collected for these purposes will also be prescribed. This will end intrusive and excessive data collection from rental applicants, while ensuring that landlords are still able to access the information necessary to assess their application. To ensure that renters can provide evidence of their reliability and ability to meet rent payments in past tenancies, the bill requires a landlord to provide a renter with their rent record at the end of a tenancy. The bill makes an important change to the collection of identity information from rental applicants. Current industry practice is to collect identity information from all applicants at the start of the rental application process.

The bill instead provides that verification of identity is permitted only for the preferred applicant, as the final step prior to entry into the tenancy contract. This simple change will significantly reduce the unnecessary collection of sensitive personal documentation such as driver licences and passports. Given that each rental property advertised would usually receive a significant number of rental applicants and require at least two forms of identification to be provided, it has been estimated that this approach could save upwards of 3.2 million personal documents being collected and stored annually. To ensure that a renter is not disadvantaged if information is collected unlawfully, the bill provides that this information cannot be used when assessing a tenancy application and must be destroyed within two business days of the landlord, agent or property technology operator becoming aware of the contravention. The APPs require that information be generally used and disclosed for the purposes for which it is collected, and destroyed when it is no longer needed for those purposes.

The regulations will elaborate on the APPs with specific requirements that will generally limit the use and disclosure of the information to assessing the rental application and the ongoing management of the tenancy for the successful applicant, and impose specific time frames for destroying information for unsuccessful and successful applicants. The requirements in the bill are accompanied by penalties for breach, which will be enforced by NSW Fair Trading. The NSW Civil and Administrative Tribunal is also empowered to make orders relating to breaches of the new requirements in the bill and the regulations. These orders can include restricting the collection, use or disclosure of personal information, requiring renters to be given access to their own information, or requiring personal information to be destroyed, amended or de-identified.

The bill also makes important amendments to existing provisions regulating the operation of tenant databases to ensure that these databases act fairly towards renters and comply with the law. Residential tenancy databases hold information about renters who were subject to a tribunal termination order for breaching a tenancy agreement or who left the previous landlord out of pocket, with a debt that was not covered by the rental bond. The information in the databases is used by landlords and agents to decide whether to lease to prospective renters. Tenancy databases are tightly regulated due to the serious consequences for renters who are listed on them. Most landlords and agents will not rent to someone listed on a database, with the result that these renters can face homelessness. With the development of new property technology platforms, greater clarity is needed about what should be considered a database and whether the operator needs to comply with the restrictions on what information can be held.

The bill amends the definition of a database to provide clarity about when someone is operating a database and creates a distinction between tenancy databases and the other technology platforms that collect and share information about tenants. The amendment will ensure that other technology platforms that are carrying out the functions typically carried out by landlords and agents, such as having tenants complete tenancy applications and collecting information from tenants with their consent, are not defined as residential tenancy database operators. However, they will still be required to comply with the new rules in the bill and the regulations. Any person who seeks to collect and share information from landlords and agents about previous tenancy breaches will have to comply with the restrictions applying to tenancy databases. The bill also tightens up the database provisions to ensure that renters are provided with a fair and timely means to check what information is kept about them on such databases and, if information should not be on the database, that it is corrected or removed promptly. The bill also increases the penalties for failing to comply with these provisions.

I now turn to the remaining provisions in the bill, which will make renting fairer. To ensure that renters have key information before they enter into a rental agreement and are not misled by advertising, the bill imposes two important disclosure requirements. The first is where any service to the rental premises is supplied through an embedded network, referred to in the bill as an exclusive supply network to ensure alignment with strata and other occupancy laws. Embedded networks for services like electricity, gas or hot water mean that a renter cannot shop around and use an alternative supplier, and so cannot control the price at which the service is supplied. Currently, owners and agents are only required to disclose that a service is provided through an embedded network in the residential tenancy agreement. However, by the time the agreement is being signed, renters would already be committed to the property.

The bill will require embedded networks to be disclosed in advertising for a rental property and before the renter enters into a tenancy agreement. This was a recommendation of the parliamentary inquiry into embedded networks, and will assist renters to understand the features of the property before they rent it. If there is no disclosure at all before entering into a tenancy agreement, the renter will have a right to terminate the agreement. The second disclosure requirement will require disclosure of when images in a rental advertisement have been altered in a way that would be reasonably likely to mislead or deceive a prospective renter. For example, this would capture alterations such as those that remove undesirable infrastructure from the background, such as electricity towers or items that obscure views; digitally modifying photos to obscure property damage, such as water ingress stains or mould; or using artificially generated furniture that shows a double bed in a bedroom that is only large enough to fit a single bed.

Finding a suitable rental property can be time consuming and arduous. This requirement aims to reduce the risk of misleading and deceptive images leading an applicant to waste their time on unsuitable properties, or leading renters who do not have time to inspect into renting an unsuitable property. To assist the sector to comply with the advertisement disclosure requirements, the bill allows the secretary to issue guidance, providing clarity about the sorts of alterations that Fair Trading will consider to be misleading.

The bill also increases the penalties attached to certain existing offences in the Act to ensure that they are proportionate and reflect the harms caused. Currently, offences relating to the terms that must or must not be included in a residential tenancy agreement, restrictions on amounts payable before an agreement, the way rent is paid, and providing rent records have a maximum penalty of 20 penalty units, or $2,200. That amount is not an appropriate deterrent and can result in a breach of these provisions simply being absorbed as a cost of doing business. The penalties have also been amended to include separate penalties for individuals and others, in recognition that a higher penalty should be available for contraventions by sophisticated corporations that may be offending on a larger scale than an individual landlord.

The bill will increase penalties for offences relating to failing to use the standard residential tenancy agreement; requiring a renter to make prohibited additional payments before entering an agreement; failing to ensure that required rent payment methods are made available; and failing to keep or provide a rent record to a maximum of 50 penalty units for individuals, or $5,500, to align with other penalties for offences by individuals under the bill. It also introduces a separate penalty for non-individuals of up to 300 penalty units, or $33,000, for failing to use the standard residential tenancy agreement, and a maximum of 200 penalty units, or $22,000, for breach of the other requirements.

Finally, the bill will make an important amendment to enable the more effective operation of the Government's changes to make it easier for renters to have pets. The bill introduces a grace period for renters who have moved into a rental property but are waiting for the landlord's permission to keep pets. If the renter applies for the pet within seven days of moving into a new rental property, they can keep the pet at the property until the landlord gives a written response to their application. This grace period will provide an opportunity for renters to apply to keep a pet without automatically being in breach when they move into a new rental property.

This bill represents another step forward in implementing the Government's commitments to make renting fairer in New South Wales. The Government's changes to end no-grounds evictions, to make it easier for renters to have pets, to prevent rent bidding, to limit the frequency of rent increases, to prevent additional fees and to ensure free and convenient rent payment options are creating a more modern, fair, transparent and stable rental market. The Government is also implementing the nation's first portable rental bonds scheme. The scheme will be a game changer for renters, who will be able to save thousands of dollars by transferring their bond between rental properties. We have invested $8.4 million in the Rental Taskforce, with inspectors and support teams to help renters and to act on serious breaches of rental laws. We launched the new, free Rent Check website to make it easier for renters to check whether the rent they are being asked for is fair.

The reforms in the bill are the next step in implementing the Government's election commitment to protect renters' personal information and privacy. These reforms will provide clarity and certainty about what rules apply, and will reduce risks for renters and those who hold their personal information. I thank all members of the community who participated in the consultation on the reforms and all stakeholders representing renters, owners, agents and others who provided input and advice to help the Government develop the reforms. I particularly thank members of the reference group, including representatives from the Tenants' Union of NSW, the Real Estate Institute of NSW, Legal Aid, the University of New South Wales City Futures Research Centre, Ray White, Harcourts, the REA Group, Proptech Association, Multicultural NSW, academics from the University of Sydney and University of Technology Sydney, and the NSW Privacy Commissioner. I commend the bill to the House.

Debate adjourned.