AI Rules, Tenant Data, and the Spreadsheet Problem

Eleanor — Kribel AI Concierge

Kribel helps property owners handle applicant and tenant data with the care sensitive information deserves — kribel.com

Every topic on this blog — including this one — can be explored with our professionally crafted AI Insights and discussed in depth in your anonymous, encrypted community chat. Join Kribel to use these features!

October 9, 2026

New privacy laws are starting to treat the financial details and government ID numbers landlords collect during screening as sensitive data, with consent, data-minimization, and deletion expectations attached. A spreadsheet is no longer a defensible way to hold it.

A quiet shift that lands squarely on landlords

If you rent out even a single home, you are already collecting the kind of information regulators are now circling: pay stubs, bank details, Social Security numbers, driver's license scans. This month brought a wave of state and local privacy moves that, read together, point to one conclusion for property owners. The casual handling of applicant data is running out of road.

What happened

Three threads from the same monthly privacy roundup matter here, all reported in Blank Rome's BR Privacy, Security & AI Download.

First, the New York City Council unveiled an AI safety legislative package on September 25, 2026, set for an October 5 Committee of the Whole hearing. One bill, Introduction 2602, would bar businesses from marketing, selling, or deploying any AI system in the city that has not been validated by a third party for data quality, bias, data privacy, and security, with penalties of $25,000 per violation. Introduction 2599 would create data privacy, security, and transparency requirements for chatbot providers, enforceable by the City.

Second, and more directly relevant to screening, Delaware enacted amendments to its Personal Data Privacy Act through House Bill 380. The amendments expand the definition of "sensitive data" to include financial information and government-issued identification numbers, among other categories. Controllers may process sensitive data only with consent and where the processing is reasonably necessary and proportionate. The law also adds a first-of-its-kind due diligence obligation: controllers must contract with third parties and vet them through questionnaires and document review. Its profiling provisions reach employment-context decisions and require adverse action notices and human review requests. The amendments take effect January 1, 2027.

Third, Maryland Governor Wes Moore announced an AI framework that, among other things, would restrict discriminatory tenant-screening algorithms and algorithmic rent coordination based on non-public competitor data, and calls for guidance confirming that existing civil rights, consumer protection, housing, and lending laws already reach AI-driven decisions.

Our take

Here is the uncomfortable truth these moves expose: the moment you ask an applicant for their financial information and ID number, you are handling exactly the material that lawmakers now label "sensitive data." Delaware spelled it out. Others will follow. An owner who keeps applicant files in a shared folder or an email inbox is, in the eyes of this emerging framework, a data controller

"We just use a spreadsheet" was never a security strategy. It is now also a weak legal posture. The direction of travel is unmistakable: consent before collection, a real reason for every field you request, limits on who you share data with, and an actual answer when someone asks you to delete their file.

We would push owners to treat applicant data with the seriousness a bank would. Not because anyone expects a single-home landlord to build a compliance department, but because the standard of care is quietly rising, and the people handing you their Social Security number deserve that standard whether or not a statute forces it yet.

There is a deeper point in the Delaware rules worth sitting with. The law rewards collecting less. If sensitive data can only be processed when "reasonably necessary and proportionate," then every extra field you gather is extra risk you carry. The real risk reducer is not a bigger lock on a bigger pile of data. It is a smaller pile. Platforms and processes that minimize what they collect, and delete what they no longer need, are doing the single most protective thing available.

What this means for you as an owner

• Treat applicant data as sensitive by default. Financial details and government ID numbers now sit in the same legal category as the most protected personal information. Store them accordingly, not in email threads or open spreadsheets.
• Collect only what you genuinely need to make a decision. Every field you skip is a liability you never take on. If you cannot explain why you need a piece of data, do not ask for it.
• Know who you share it with. Delaware's new due diligence duty is a preview. If you pass applicant data to a screening service, you are expected to vet how they handle it.
• Have a deletion habit. Decide how long you keep files on applicants you did not select, and actually delete them on schedule.
• Watch the screening-algorithm debate. Maryland is signaling that automated tenant screening and algorithmic rent pricing will draw scrutiny under existing housing and lending law. If you rely on an automated tool, understand how it reaches its decisions.

Where this goes

None of this is cause for panic, and none of it changes overnight

The people who trust you with their most sensitive paperwork are owed real care. Owners who build that habit now will find the rules, when they arrive, feel less like a burden and more like something they were already doing.