Top Australian tenancy blacklist firm under investigation by information commissioner
The federal information commissioner is investigating a potential data breach at one of Australia’s biggest tenancy blacklists, run by Sydney company Trading Reference Australia (TRA).
TRA has moved to stymie the investigation, obtaining a federal court injunction that quashes an order from the commissioner that it hand over information about the breach.
TRA claims to run the “most comprehensive database of its kind” and is listed by consumer organisation Choice as one of the three biggest tenant blacklist operators in Australia.
Tenant blacklists contain information on people and companies that have allegedly breached rental conditions or damaged properties. TRA also offers a service where it refers “problem tenants” who leave a property owing landlords money to debt collectors.
Both the Office of the Australian Information Commissioner and TRA refused to tell Guardian Australia when any breach occurred or how many people’s personal details may have leaked or been obtained by others not authorised to view the database.
“The OAIC opened an investigation into TRA’s acts or practices in relation to the security of their database holding personal information,” an OAIC spokesman said.
“As the matter is before the court, the OAIC will not comment on the proceedings.”
The TRA managing director, Gai Williams, who has owned the company for the past 25 years, said that because the matter was before the court, it was “not appropriate for TRA to respond to your questions”.
“TRA has for many years, dealt with and continues to cooperate with the Office of the Australian Information Commissioner because of the shared interest of the two entities – primarily, people’s privacy,” she said.
Documents filed by TRA with the federal court show that the OAIC began its investigation in August 2018 and expanded it on 24 July this year.
TRA told the court the investigation was invalid because it was not an inquiry into a privacy breach, as required by the Privacy Act.
“It is, instead, a broad-ranging inquiry which is not authorised … or, in the alternative, is not wholly authorised,” TRA said in court documents.
TRA said a notice the OAIC gave to it on 7 August requiring it to hand over information as part of the investigation should be set aside.
“Compliance with the notice is onerous and costly,” TRA said.
It said the notice was not valid because it was not clear whether it required a response from TRA or from Williams personally.
The information sought under the notice was also too broad, TRA told the court.
TRA asked the court to quash the notice.
On 3 September, judge Wendy Abraham ordered the notice “stayed until further order”.
She refused Guardian Australia’s application for affidavits filed by TRA in support of its case.
The proceedings are ongoing.