When does a privacy waiver expire?

Firstly, the Privacy Act doesn’t use the term ‘privacy waiver’. Rather, it allows agencies to collect, use or disclose personal information where there are reasonable grounds to believe that the individual has authorised the use of their information. However, an individual might at any point withdraw that consent and the agency has to respond accordingly.

While the Privacy Act does not specify a time that a person’s consent or authorisation for their information to be collected, used or disclosed expires, a useful policy is to seek a renewed authorisation if there is any doubt about whether the original authorisation still applies. The greater the consequences for the individual means the more regularly you should check with the individual for their consent for information to be collected, used or disclosed.  

A recent authorisation to collect, use or disclose information can generally be relied on and will be unlikely to raise concerns for an individual if their circumstances haven’t changed.

An old authorisation may raise concerns for an individual if their circumstances have changed since they gave the agency approval to collect, use or disclose their information. For example, the reason they gave their consent in the first place may no longer be valid, and unexpected consequences may result from the ongoing use of their information.