With respect to retention of personal information, the standard is set out in the privacy regulations, and it's two years from the last administrative use. It's in relative terms and not absolute terms. So the information may be collected on day X. In terms of the last administrative use, it's use by the department in order to make a decision. The decision can happen shortly after the application is made, but there can be some other interaction throughout the life cycle of the information. With respect to the 15 years, that's not a standard that is set out in the Privacy Act or the regulations. Usually when you deal with retention of personal information, it's set out in what we call a retention schedule. There are usually discussions with the Office of the Privacy Commissioner as to what is an appropriate retention period with respect to this type of information.
On November 19th, 2012. See this statement in context.