How specific does authorisation need to be to use or disclose personal information?

There is a general obligation under the Privacy Act not to use or disclose personal information, unless an exception applies.

One of the exceptions which allows use or disclosure of personal information is where the individual concerned has authorised or consented to the use or disclosure.

This is a key exception, as it is often best practice to get the individual’s consent or permission before using or disclosing their personal information, particularly for unexpected purposes.

The Privacy Act doesn’t set out any specific rules around the way in which consent should be given. However, we’d suggest that, if you’ve relied on consent which was given verbally, you make a note of this (including the date and exactly what they agreed you could use or disclose the information for).

It’s also important to consider whether the consent is limited to specific purposes, or for a specific timeframe. While the Privacy Act does not specify a time that a person’s consent or authorisation for their information to be collected, used or disclosed expires, a useful policy is to seek a renewed authorisation if there is any doubt about whether the original authorisation still applies. The greater the consequences for the individual means the more regularly you should check with the individual for their consent for information to be collected, used or disclosed.

A recent authorisation to collect, use or disclose information can generally be relied on and will be unlikely to raise concerns for an individual if their circumstances haven’t changed.

An old authorisation may raise concerns for an individual if their circumstances have changed since they gave the agency approval to collect, use or disclose their information. For example, the reason they gave their consent in the first place may no longer be valid, and unexpected consequences may result from the ongoing use of their information.

A good test to keep in mind is the ‘no surprises’ test. In other words, would the way in which you’re planning to use or disclose personal information come as a surprise to the person, given what they consented to? If the answer is yes, then you will need to clarify the scope of the individual’s consent before using or disclosing their information. If it’s not possible for someone to understand what they’re agreeing to, it could also be difficult for you to rely on the authorisation exception.