The Times Australia
The Times Australia

.

Renting a home in Australia means handing over too much sensitive info. It’s a national security risk

  • Written by Moataz ElQadi, Adjunct Researcher, Faculty of Information Technology, Monash University

Our personal information[1] is more valuable than ever. The most recent government cyber threat report warns that foreign state actors have an[2] “enduring interest” in obtaining sensitive and personally identifiable information about Australians.

In recent weeks, Prime Minister Anthony Albanese noted[3] “there is a cyber attack in Australia roughly every six minutes. This is a regular issue.”

In some situations, it can be difficult to protect our info even when we’re aware of the risks. Notably, in Australia many rental providers and their agents collect, store and disclose excessive personal information on potential tenants. Sometimes, they collect more info than what’s needed to get a government security clearance.

With about one-third[4] of Australian households being renters, the handling of renters’ data is a major concern for Australia’s information security.

So what information are real estate agents collecting, and how can we mitigate the risks?

Steep competition for rentals

For several years now, Australia has faced a rental crisis[5]. Low vacancy rates[6] – below 1% in some capital cities – not only drive up rental prices[7], but can result in “bidding wars” over rentals[8].

With renters competing for housing, rental providers are empowered to command larger rent increases[9]. They also require potential tenants to provide extensive personal information.

For tenants, sharing – or oversharing – of personal information in the hope of securing a home might seem acceptable.

However, the collection and handling of this information raises serious security concerns. If Australians’ sensitive personal data falls into the hands of cyber criminals, or foreign agents, this has security implications for the entire nation.

What info are renters asked for?

Potential tenants need to provide information to the satisfaction of the real estate agent and their client, the rental provider. This information is increasingly collected online via rental application websites where the form questions are controlled by real estate agents[10].

The websites themselves are subject to the Australian Privacy Act 1988[11], but the data is handed over to real estate agents and owners.

The rental application websites seem to recognise that this information is extensive: one rental application website started selling[12] a privacy service where they vouch for the applicant instead of sharing their information with the real estate agents.

In some cases, the requested data matches or even exceeds the requirements for a government security clearance[13]. The Australian Government Security Vetting Agency (AGSVA) has a clear public privacy statement[14]. It explains how data is collected and handled and used only for the assessment of a security clearance. Rental providers don’t necessarily follow the same stringent rules.

Information collected by some rental application forms may include five or more years of address history. Others request five or more years of employment history. In addition, financial information such as payslips and bank statements are also required.

Other sensitive – and irrelevant – information includes vehicle registration numbers and pet names.

Potential tenants are also usually asked to attach personal identification documents including passports, driver licences and Medicare cards. They may be asked to list up to two personal and one business references.

Screenshot of a rental application form requesting employment history.
A rental agent may require five years of employment history. Author provided

If any of this information falls into the wrong hands, it easily exposes the person to social engineering[15], personalised scams[16] or identity and account theft.

Who can access the info?

The names of family members and pet names are a common – albeit unsafe – choice of password. The rental application forms collect both. In Australia, research by Telstra and YouGov found[17] that 20% of Australians used pets’ names as passwords, and 17% used their birth dates.

Pet names may be required on rental applications. This can give away some people’s passwords. Author provided

If a rental provider, or their agent, shares applicant information with others, it can be a security breach. This makes the storage, handling and sharing of this information by private rental providers a major concern.

Rental agency agreements commonly state that personal information can be disclosed to “any person who maintains any record, listing or database of defaults by tenants.”[18] This policy, which a tenant has to accept, is already loose.

More importantly, after the information is sent to the owner of the rental property, there is no visibility as to who that is, or what they do with the information.

Example of a privacy agreement on a rental application form. Author provided

Too much info to rent a home

Having to share extensive personal information is more than an inconvenience for renters – it’s a serious security concern. The government should put explicit limits on personal information requested by rental providers.

One technological solution to this problem could be “access tokens” provided by banks. People in Australia are protected by the Consumer Data Right[19]. This allows consumers to authorise a data holder, such as a bank, to share data with an accredited recipient.

Australian banks are held to strict information security requirements[20]. They already handle highly sensitive data, such as client identity, income sources and other financial information.

If real estate agents require proof of this info to vet potential rental applicants, they could request it through an authorisation token with the applicant’s bank. This way, proof of identity and financial status could be shared without having to disclose actual sensitive personal information, limiting the cyber security risk.

In the meantime, rental providers and their agents should request the least possible amount of personal information – it’s the responsible thing to do.

References

  1. ^ personal information (www.oaic.gov.au)
  2. ^ foreign state actors have an (www.cyber.gov.au)
  3. ^ noted (www.abc.net.au)
  4. ^ one-third (www.aihw.gov.au)
  5. ^ faced a rental crisis (www.abc.net.au)
  6. ^ vacancy rates (propertyupdate.com.au)
  7. ^ drive up rental prices (www.abs.gov.au)
  8. ^ in “bidding wars” over rentals (www.abc.net.au)
  9. ^ larger rent increases (www.abs.gov.au)
  10. ^ controlled by real estate agents (help.2apply.com.au)
  11. ^ subject to the Australian Privacy Act 1988 (www.oaic.gov.au)
  12. ^ started selling (www.smh.com.au)
  13. ^ government security clearance (www.agsva.gov.au)
  14. ^ privacy statement (www.agsva.gov.au)
  15. ^ social engineering (www.cyber.gov.au)
  16. ^ personalised scams (www.scamwatch.gov.au)
  17. ^ Telstra and YouGov found (www.telstra.com.au)
  18. ^ “any person who maintains any record, listing or database of defaults by tenants.” (www.google.com)
  19. ^ Consumer Data Right (www.accc.gov.au)
  20. ^ strict information security requirements (www.apra.gov.au)

Read more https://theconversation.com/renting-a-home-in-australia-means-handing-over-too-much-sensitive-info-its-a-national-security-risk-254293

Video games can help trans players feel seen and safe. It all starts with design

There is a comfort in finding and being yourself. Video games offer opportunities for this comfort. They all...

Times Magazine

Headless CMS in Digital Twins and 3D Product Experiences

Image by freepik As the metaverse becomes more advanced and accessible, it's clear that multiple sectors will use digital twins and 3D product experiences to visualize, connect, and streamline efforts better. A digital twin is a virtual replica of ...

The Decline of Hyper-Casual: How Mid-Core Mobile Games Took Over in 2025

In recent years, the mobile gaming landscape has undergone a significant transformation, with mid-core mobile games emerging as the dominant force in app stores by 2025. This shift is underpinned by changing user habits and evolving monetization tr...

Understanding ITIL 4 and PRINCE2 Project Management Synergy

Key Highlights ITIL 4 focuses on IT service management, emphasising continual improvement and value creation through modern digital transformation approaches. PRINCE2 project management supports systematic planning and execution of projects wit...

What AI Adoption Means for the Future of Workplace Risk Management

Image by freepik As industrial operations become more complex and fast-paced, the risks faced by workers and employers alike continue to grow. Traditional safety models—reliant on manual oversight, reactive investigations, and standardised checklist...

From Beach Bops to Alpine Anthems: Your Sonos Survival Guide for a Long Weekend Escape

Alright, fellow adventurers and relaxation enthusiasts! So, you've packed your bags, charged your devices, and mentally prepared for that glorious King's Birthday long weekend. But hold on, are you really ready? Because a true long weekend warrior kn...

Effective Commercial Pest Control Solutions for a Safer Workplace

Keeping a workplace clean, safe, and free from pests is essential for maintaining productivity, protecting employee health, and upholding a company's reputation. Pests pose health risks, can cause structural damage, and can lead to serious legal an...

The Times Features

Distressed by all the bad news? Here’s how to stay informed but still look after yourself

If you’re feeling like the news is particularly bad at the moment, you’re not alone. But many of us can’t look away – and don’t want to. Engaging with news can help us make ...

The Role of Your GP in Creating a Chronic Disease Management Plan That Works

Living with a long-term condition, whether that is diabetes, asthma, arthritis or heart disease, means making hundreds of small decisions every day. You plan your diet against m...

Troubleshooting Flickering Lights: A Comprehensive Guide for Homeowners

Image by rawpixel.com on Freepik Effectively addressing flickering lights in your home is more than just a matter of convenience; it's a pivotal aspect of both home safety and en...

My shins hurt after running. Could it be shin splints?

If you’ve started running for the first time, started again after a break, or your workout is more intense, you might have felt it. A dull, nagging ache down your shins after...

Metal Roof Replacement Cost Per Square Metre in 2025: A Comprehensive Guide for Australian Homeowners

In recent years, the trend of installing metal roofs has surged across Australia. With their reputation for being both robust and visually appealing, it's easy to understand thei...

Why You’re Always Adjusting Your Bra — and What to Do Instead

Image by freepik It starts with a gentle tug, then a subtle shift, and before you know it, you're adjusting your bra again — in the middle of work, at dinner, even on the couch. I...