Rental providers and agents have obligations under the law to protect renter’s information that they collect from misuse and to destroy it within certain timeframes.
Renter’s information is any information disclosed by a renter or a prospective renter to the rental provider or agent when applying for or entering into a rental agreement or for the purposes of administering the rental agreement.
A breach of these obligations is a criminal offence and penalties apply.
Protection of renter’s information from misuse, interference or loss
Rental providers and agents must take reasonable steps to protect renter's information from:
- misuse or loss, and
- unauthorised access, modification or disclosure.
Destruction and de-identification of renter’s information
Rental providers and agents who hold a renter's information must destroy or permanently de-identify the renter's information within specific timeframes.
The scenarios and timeframes the rental provider or agent must wait before they destroy or de-identify a renter’s information have been outlined in the table below:
| Scenario |
Timeframe |
Renter’s rental agreement has ended
|
Within 3 years after the end date of the rental agreement |
Applicant for a rental agreement was unsuccessful in their application
|
Within 30 days after the rental agreement is entered into
|
Applicant for a rental agreement was unsuccessful in their application but has provided written consent for the information to be used to apply for other premises
|
Within 6 months after the initial rental agreement they applied for is entered into |
Circumstances where a rental provider or agent may keep or disclose renter’s information
There are some limited situations where rental providers and agents who hold a renter's information don’t need to destroy or permanently de-identify it, or may disclose it.
These include:
- the rental provider or agent believes the disclosure is necessary to lessen or prevent a serious threat to a person’s life or a person’s or the public’s health, safety or welfare
- the rental provider or agent believes the disclosure is necessary on behalf of a law enforcement agency to prevent illegal activity
- the rental provider or agent has obtained written consent from the renter to disclose the information, and the information is held for that purpose
- an Act, law or order of a court or Tribunal otherwise requires the rental provider or agent to hold or disclose the renter's information.
Exemptions from these responsibilities
A rental provider or agent is not required to comply with these obligations to protect and destroy renter’s information if they are complying with a corresponding obligation under any of the following acts:
Sections of the Act
If you want to know what the law says about a rental provider’s or agent’s responsibilities in relation to a renter’s personal information, you can read these sections of the Residential Tenancies Act 1997:
- Section 505BA – Interpretation
- Section 505BB - Protection of renter's information from misuse, interference or loss
- Section 505BC - Destruction and de-identification of renter's information
- Section 505BD - Disclosure of renter's information
- Section 505BE - Relationship of sections 505BB, 505BC and 505BD with other privacy laws