What the Privacy Commissioner’s “2Apply” determination means for data driven platforms

The Privacy Commissioner’s recent determination marks an important development in how the Australian Privacy Principles (APPs) are applied to digital platforms that sit between consumers and essential services.  While this decision arises in the rental sector, its implications extend beyond property technology. 

Organisations that design digital workflows to facilitate third‑party decision‑making, particularly where individuals have limited practical alternatives, should consider the determination carefully.

Background

The determination arises from a Commissioner‑initiated investigation into IRE Pty Ltd (IRE), the operator of online tenancy application platform (“2Apply”) used by real estate agents across Australia.

Via 2Apply prospective tenants: 

1. create an account;
2. complete a profile; 
3. submit rental applications. 

The platform uses a form‑based workflow that allows for the collection of personal information and supporting documents.

The investigation examined whether the categories and volume of personal information collected at the application stage were reasonably necessary for IRE’s functions or activities, and whether the way that information was collected was fair in the context of the rental market.

Excessive information collection as a regulatory risk

Australian Privacy Principle 3.2 was given the starring role in the Commissioner’s determination. 

APP 3.2 limits the collection of personal information to what is “reasonably necessary” for an entity’s functions or activities. 

The Commissioner adopted a narrow and practical view of IRE’s role in operating the 2Apply platform. In applying APP 3.2, the Commissioner determined that IRE’s functions/activities were to facilitate the processing of completed rental applications.

The Commissioner rejected that IRE’s collection was reasonably necessary “to provide a service,” finding the stated function/activity too broad and undermines the ability for individuals to make informed choices about handing over their personal information.

A central focus of the Commissioner’s analysis was the “default list” of information fields built into 2Apply tenancy application forms. This list captured a wide range of applicant personal information as part of the standard process. Although agents could customise forms, the Commissioner treated IRE as responsible for the scope and design of the default fields it developed and promoted.

Although the Commissioner acknowledged that IRE’s use of 2Apply was intended to provide agents with a complete, ‘ready‑to‑act’ application, this did not justify collecting information merely because it was helpful or desirable to landlords, or more convenient than collecting less.

Below illustrates the contrast between the information the Commissioner considered reasonably necessary for IRE’s functions/activities, and the breadth of information collected through the 2Apply default list:

Fair means of collection and the role of platform design

The determination did not turn solely on what information was collected. The Commissioner also examined how information was presented to applicants, and the practical context in which decisions to disclose personal information were made.

In assessing whether collection occurred by lawful and fair means under APP 3. the Commissioner focused on the application workflow and completion prompts. Messages suggesting that extra information would speed up processing, or that omissions could affect suitability, were evaluated in the context of a tight rental market.

In a sector characterised by limited supply, intense competition and minimal applicant leverage, the Commissioner treated the messaging design features as undermining any real choice about how much personal information applicants disclosed.

Key take aways

The determination reinforces a number of themes that extend beyond rental technology:

• Necessity of information to be collected must be grounded in legitimate functional need, rather than business convenience.
• Platform intermediaries may carry independent privacy obligations, even where end decisions are made by customers.
• Fairness is assessed in real‑world context, including power imbalances and constrained user choice.
• Interface messaging and behavioural prompts are increasingly relevant to privacy compliance assessments.

For organisations operating data‑driven platforms, the decision highlights the importance of treating data minimisation and fairness as design‑stage considerations. 

This article was written by Ariel Bastian Senior Associate and Anna Kosterich Lawyer Corporate Commercial.

1. ^

    Commissioner Initiated Investigation into IRE Pty Ltd (Privacy) [2026] AICmr 24