In the last few years, our industry has experienced significant changes in ensuring that we align with privacy guidelines.

In this video, Drake of Renti is joined by Paul Holmes, Managing Director of INFO by Design, and Jo Rae, Senior Consultant at the Real Estate Institution of New Zealand (REINZ). They discuss the connection between privacy and property management, providing answers to the questions you've always had.

The information provided in this video is for general informational purposes only and is not intended as legal advice.

Resources

The organization obtains individuals' information with their consent, given in exchange for goods or services, based on the principle of tiakitanga (that it will be valued, respected and protected). As the kaitiaki (guardian), the organization is responsible for ensuring the proper care, protection, and respect of this information, mirroring the treatment one would expect for personal and familial data.

Privacy revolves around personally identifiable information, which extends beyond just names; even without names, individuals can still be identified from other details. Governed by the Privacy Act 2020, the handling of personal information, encompassing collection, usage, management, and sharing, is regulated universally across businesses and individuals. Recognizing past deficiencies within the rental sector, the Commissioner has issued guidance to address poor practices. However, it's important to note that legislation such as the Residential Tenancy Act and other regulations supersedes the Privacy Act.

The Privacy Commissioner outlines clear expectations for Property Managers and Landlords, accessible via the provided link (click here). It's expected that all property managers comprehend and adhere to these requirements. Monitoring is conducted actively through audits and mystery shopper visits. Failure to comply could lead to various consequences, including warning letters, investigations, compliance notices, privacy breaches with associated costs, public statements naming the agency, and referral to Human Rights Proceedings.

The privacy framework entails a structured approach, delineating roles and responsibilities for managing privacy breaches effectively. Additionally, it includes procedures to address access and correction requests promptly and offers explicit guidance to staff regarding privacy compliance during inspections, including handling photographs. A defined consent management process outlines when and how consent should be obtained from clients. Moreover, protocols are in place to manage tenancy withdrawals stemming from family violence incidents. Privacy Impact Assessments are conducted to ensure system compliance, and third-party service providers and tradespeople are assessed to guarantee their adherence to privacy regulations.

✅ Privacy Officer appointed.

✅ External Privacy Policy up to date and accessible.

✅ Internal Privacy Policy current and communicated to all staff.

✅ Application forms reviewed and only collecting what is needed.

✅ Records management processes in place and operating.

✅ Supporting processes in areas of high risk.

✅ Monitoring and ongoing validation to identify areas of non-compliance.

The Human Rights Act safeguards various personal characteristics, including sex (including pregnancy or childbirth), relationship or family status, political opinion, religious or ethical belief, colour, race, ethnicity (including nationality or citizenship), physical or mental disabilities or illness, age (excluding if the tenant is over 18), employment status (whether unemployed, receiving benefits, or on ACC), sexual orientation, gender identity, experiences of or ongoing exposure to family violence, spending habits evidenced by bank statements, employment history, and social media URLs.

The organization has established internal reporting procedures for privacy incidents, complaints, and access and correction requests. Staff undergo regular training sessions to understand the Privacy Act's requirements and their obligations under the OPC Compliance Strategy. Periodic reviews are conducted to ensure compliance with the strategy, including spot checks on staff information collection practices and evaluations of third-party service providers and tradespeople.

Mystery shopper visits are now underway, conducted randomly nationwide. However, during these visits, a concerning trend emerged as many property managers were unable to articulate the rules when questioned, often claiming ignorance or directing inquiries to their website. Furthermore, some property managers indicated a willingness to consider applicants who voluntarily disclosed excessive personal information, such as bank statements or unnecessary details like loan information and vehicle details. Additionally, instances of over-collection were noted, including requests for an excessive number of references or prematurely contacting referees at the onset of the application process.

Can we ask for proof of Visa length in relation to fixed-term tenancy?

Yes, because this information determines whether the tenant has the legal right to enter into the contract and stay for the duration of the tenancy. You can request them to provide documentation to support their right to be here. While it's not recommended to take photos or make copies of the documents, you should instead take note of any relevant information.

Does an owner have the right to know a tenant's surname when a new tenant leases their property?

Property owners typically have the right to know the full names of their tenants, whether the property is managed by a property manager or not. However, in situations where property owners have enlisted a property manager to oversee their property, it is wise to inquire about the purpose behind needing the tenant's surname and whether it serves a legitimate reason. It's important that the applicant is informed, either verbally or as part of the application process, about any information that may or will be shared with the owner. Also, it is advisable that you communicate clear expectations with owners so they are informed about your obligations regarding the Privacy Act and information sharing and how this affects them.

What are we allowed to ask for as proof of income?

In Renti, we request applicants to provide employment references or supporting evidence demonstrating their ability to pay the rent. They can select a supporting document they believe best represents their situation. It's best to give the applicant the opportunity to prove their ability to pay the rent without asking for specific pieces of evidence. If you require more evidence, you can ask the applicant if you require more information.

Every situation varies, and it's good to have a conversation with the applicant regarding their circumstances and the supporting evidence they can provide.

If a lawyer approaches a property manager on behalf of their client, the owner, and asks for copies of the tenancy application, should you agree?

The lawyer in this situation has the same rights as the client because they are working on their behalf. Therefore, give the lawyer the same information you would give to the owner or respond to the lawyer the same way you would an owner. If you are not sure or not comfortable about sharing the information, ask for clarification about what they want and why they want it. If you need further clarification, speak directly with the owner. Having a company policy for this scenario is recommended, as it provides a reference point for handling the situation when it occurs.

What if the police ask for information?

Always ask for requests in writing. Inquire about the grounds for their request—are they using their policing powers to compel the information? Take notes of the provided information and when it was given. Make sure they are compelled to request the information and not just investigate. Giving information without a formal request could breach privacy as it implies proactive disclosure. Having a company policy for this situation could help avoid any accidental breaches.

How do I manage it if a tenant asks for a copy of their personal information?

Having a company process for this is crucial because, under the Privacy Act 2020, individuals have the right to inquire about the information you hold about them and request a copy of it. While it can be complex, the key requirements are clear: you must provide the information. There are limited grounds for withholding information, and they have a reasonably high threshold; merely embarrassing or mean comments noted on an application or file are not sufficient reasons to withhold it. Ensure all property managers are trained to refrain from documenting anything they wouldn't be comfortable sharing with the individual. It's important to note that this request is time-bound. Upon receiving a request, you must provide the information as soon as practically possible, and no later than 20 working days. The request doesn't have to be in writing; other methods such as verbal communication or via messenger or text message are acceptable.

Can I keep a copy of photo identification just in case it is needed for debt collection?

"Just in case" is not a valid reason for collecting information. Accurate information about the individual is necessary, and what you have on file is often sufficient. Debt collection agencies do not require a copy of photo identification to conduct debt collection activities. However, they may need validation information, so recording some details from the identification could aid in the process.

Can I share the tenancy agreement with an owner?

Firstly, consider the purpose for which they are requesting it. Merely wanting to see it is not sufficient. However, if they need to provide it to their insurance company for their insurance policy, then it is warranted. It is advisable to inform the tenant that this information is being shared for this purpose. Additionally, ensure clear communication with the owner, clarifying that the information is provided solely for that purpose.