Earlier this month The Office of the Privacy Commissioner (OPC) launched a new compliance monitoring programme to ensure landlords, managers and agencies are not breaching the Privacy Act when requesting and handling (prospective) tenant information. The guidance clarifies the rights and responsibilities of tenants and landlords under the Privacy Act.
What landlords should and shouldn’t collect
As part of the programme, The OPC has issued a fact sheet containing information about what information landlords can ask from their (prospective) tenants. "The guidance spells out what information may be requested at every stage of the rental process. We want to make it easy for landlords and property managers to know what they should and shouldn't collect, and for prospective tenants to understand what they can and can't be asked for," says the Privacy Commissioner, John Edwards.
And it goes further than that. The programme walks along the principles of the Privacy Act and therefore also includes information about what you need to tell your tenants, how you can collect information, tenants requesting access to and correction of information, the disclosing of personal information and much more.
Anonymous tip line and mystery shopping
According to the new programme, The Office will make regular checks of rental agencies, as well as an annual audit of application forms, collection notices, contract forms and privacy policies of letting agencies, property managers, and third-party service providers. The OPC also has included mystery shopping in their monitoring approach and they opened up an anonymous tip line for tenants to report concerns about personal information handling.
No excuses for over-collection
Edwards makes clear that this guidance means that The Office will be stricter in case of a breach. “There are no excuses for over-collection and unauthorised use of personal information and there will be consequences for non-compliance”, he said.
The Privacy Act
The Privacy Act 2020 came into force on 1 December 2020 and provides the rules in New Zealand for protecting personal information and puts responsibilities on agencies and organizations about how they must do that.
The Act requires every business to have at least one person who fulfils the role of privacy officer. Where larger businesses usually have someone in-house to do privacy work as part of their duties, this might not be feasible for smaller and medium businesses. The Information Privacy Company, led by Michelle van Straalen, helps businesses and agencies with this issue and provides information privacy and data security services. In line with the new compliance programme for the rental sector, we’re now also opening up for landlords who are looking for assistance.