The Real Estate Institute of Australia (REIA) has called on Attorney General Mark Dreyfus to keep the Privacy Act small business exemption, saying it would be “regulatory overreach” if it were removed.
A wide-ranging evaluation of the Act has resulted in 116 recommendations being proposed in the Privacy Act Review Report, including scrapping the 20-year-old exemption that currently means small businesses with an annual turnover of $3 million or less are shielded from the strictest compliance measures in the Act.
“In recognition of the increasing privacy risks posed by small businesses and the benefits of improved privacy protection for Australians and the economy, the small business exemption should be removed,” the report says.
“This would require all Australian businesses to comply with the Act, regardless of annual turnover.”
But the REIA doesn’t agree, stating the proposals would have “major implications” for the real estate industry for no real gain.
REIA President Hayden Groves said up to 80 per cent of the 116 recommendations would have unique implications for Australian real estate practitioners and agencies given their interactions with vendors, buyers, tenants, investors and third-party service providers.
“We estimate that up to 65 per cent or around 30,000 real estate businesses would fall within the current exemption, with IBIS World identifying the average turnover of a standard real estate practice sitting at around $700,000 per year,” he said.
“REIA does not support the exemption for small business being removed and argues that the introduction of this exemption is unlikely to lead to any further beneficial outcomes for consumer protection.
“Real estate businesses provide an essential service to Australia’s renters, investors, homeowners, and home buyers, transacting each year around $350 billion in home sales and collecting $78 billion in rent receipts. This service is delivered by 45,000 small businesses.”
In its submission to the Privacy Act Review Report the REIA said the proposed changes to the Act would have a day-to-day operational impact on real estate businesses, such as:
- Update and publication of privacy policies and requirements.
- Update of opt out requirements and disclosures within real estate marketing.
- Development, adoption, and training of internal protocols.
- Development of incident response plans, including notification protocols to meet 72- hour notifiable data breach period.
- Complaint policies and procedures.
- Any audits and remedial actions with third-party providers that are required.
- Alignment and integration with State and Territory legislation including consultation with local Institutes and regulators.
- Alignment with current and proposed Federal legislation.
- Broad scale industry and business level adoption and awareness programs including communications with vendors, buyers, investors and tenants.
- Development of an industry specific code of practice.
“REIA notes the need for absolute transparency and high levels of customer service to Australian property customers but argues that some approaches identified by the Review Report equate to extreme regulatory overreach which will not lead to any greater benefits to consumer privacy,” Mr Groves said.
The REIA has tabled key recommendations to the Attorney General which includes keeping the exemption for small businesses with a turnover of less than $3 million and a multi-year moratorium for compliance and penalties to apply to any changes to the Privacy Act.
They’ve also recommended a cost benefit analysis for removal of the small business exemption be conducted and that a tailored direct-to-business real estate program be funded and implemented.
The REIA also suggests federal and state governments develop a standard pro forma to be attached to contracts and MOUs on mutual privacy obligations and that the Attorney General’s Department work with them to scope a real estate code of conduct.
O*NO Legal – The Real Estate Agent’s Lawyer Founder Kristen Porter said the 116 recommendations were not yet law, but even if they were, developing a privacy framework was not as difficult as it may first appear to be.
“Essentially the rules in the act are just around how you collect, use and disclose personal information,” she said.
“If we think of it like that – collect, use and disclose – it’s actually quite simple to build a framework around that.
“Privacy land can seem super complicated but if we really break it down like that, it’s not.”
Ms Porter said complying with the Privacy Act would mean agencies tell their clients that they are collecting data through a collection notice and introduce a privacy policy that not only has more detail on the collection of information but says how they will disclose and use the data.
“So when someone gives you data they are making an informed decision, knowing how you’re going to use it,” she said.
A privacy policy would also contain information on how an agency will store and keep clients’ data safe, as well as how an enquiry or complaint can be made if required.
Ms Porter said agencies would also need a data breach response plan covering what will happen if clients’ data is breached.
She said many of her real estate clients had already voluntarily opted to comply with the Privacy Act despite not legally having to due to the small business exemption.
“If you’re a small player and your competitors are promising to protect personal information then they’ve already got a competitive advantage over you,” Ms Porter said.
“So it could be showing your clients that you care about their data and it can be a point of difference.
“A lot of my clients are opting in to show that they care and they’re saying, ‘We’re going to comply anyway because we think it’s the right thing to do’.”
Ms Porter also pointed out that most surveys showed the public did not always trust the real estate industry and complying with the Privacy Act could go some way to rebuilding that trust.
According to the Deloitte Australia Privacy Index 2022, consumers are most comfortable sharing personal information with government agencies and least comfortable sharing with the retail and real estate industries.
“How can we expect to change the way the community sees the real estate industry and appear more trustworthy, if we don’t show that we care about the protection of our clients’ data,” Ms Porter said.
- If you have thoughts on this issue you’d like to share with us please email [email protected].
