Printed from https://fyi.org.nz/request/24167-acc-policies-rules-and-advice-inconsistent-with-acc-privacy-policies-and-legislation?unfold=1 on May 16, 2024 21:49

ACC policies, rules and advice inconsistent with ACC Privacy Policies and legislation

AS Van Wey (Account suspended) made this Official Information request to Accident Compensation Corporation

Response to this request is long overdue. By law Accident Compensation Corporation should have responded by now (details and exceptions). The requester can complain to the Ombudsman.

From: AS Van Wey (Account suspended)

Dear Accident Compensation Corporation,

Your Policy "When to save emails in Eos Policy v16.0" includes a list of types of email communications in which ACC advises employees not to save. These emails clearly contain information about a claimant, and thus, would be considered personal information that is subject to the Privacy Act. Furthermore, these communications are all subject to the Public Records Act.

If ACC employees are making a habit of deleting client personal information (the types of emails listed in your policy), please explain how these actions are consistent with the requirements under IPP 5 & IPP 6 of the Privacy Act, as well as the legal requirements to maintain information, as set out under the Public Records Act. If these emails are not being saved to the claimant's file or in EOS (the "Task" or "Contacts" sections), where is the information being saved and how does a claimant obtain access, pursuant to the Privacy Act, OIA, and the Code of ACC Claimants' Rights?

I note that your your Authority Principles document (GOV-026284, Appendix, p 52) states: "We don't need authority to use or disclose information for the purpose of establishing a client's eligibility entitlements."

ACC's Authority Principle has me quite concerned, as it is clearly inconsistent with the Privacy Act 2020 and Health Information Privacy Code 2020, which is all about the legal obligation of government agencies to seek the informed consent of the individual prior to obtaining or disclosing information.

Further, ACC's internal policies specify that prior to seeking or disclosing information, ACC is to discuss this with the claimant and obtain their consent. See:
- Report a Privacy Breach,
- Summary of the Information Privacy Principles Policy,
- Personal Information and Privacy Guidelines,
- Privacy Policy
- Privacy check before disclosing information Policy,
- Client Choice of Providers Policy
- Seek External Clinical Advice
- Arrange Medical Single Discipline Assessment
-ACC Privacy Maturity Action Plan

Please note again, neither the ACC6300 form nor the ACC45 form include consent for ACC to disclose any information. Thus, checking to see if these forms are on file is insufficient to verify consent for disclosure. These forms also do not satisfy IPP 3 of the Privacy Act, and thus are not adequate documents to claim that ACC has obtained a claimant's informed consent. One cannot provide informed consent if the one is not informed. Even the ACC45 and ACC46 form start with the statement, "The form collects the basic information we need about your injury to help us decide if we can provide cover. If we need more information about his claim we will contact you later." Thus, this form does not give the consent to seek information without ACC contacting the claimant and specifying the records ACC needs. Please refer to:
- Request Clinical Records for Treatment Injury v16.0
- Request medical or clinical records Policy
- (NGCM) Request Clinical Records v100.0
- Request and Obtain External Agency Records
- Obtain Client Authority to Collect Information

So for instance, if ACC doesn't explicitly state that ACC intends to disclose information to a particular person (such as a particular ECA) and what information they intend to disclose (with specificity), prior to obtaining the information, then ACC has not obtained the information for the purpose of disclosing to another. ACC is required to obtain the consent of the claimant prior to any disclosure, with rare exceptions.

I note that a key point of having ensured the claimant's informed consent, which would be to ensure the claimant knows exactly what is being sought or disclosed to whom, mitigates the risk of ACC employees disclosing or obtaining information unrelated to the claim, which ACC has done in many of my claims.

Please ensure the response comes from ACC's Privacy Officer, rather than attempting to "wing it".

Yours faithfully,

AS Van Wey

Link to this

From: Government Services
Accident Compensation Corporation

Kia ora

 

Thank you for contacting ACC; this is an automatic reply to confirm we
have received your email.

 

We will try to respond your query as quickly as possible. However,
depending on the nature of your request you may not receive a response for
up to 20 working days. You can check the [1]Ombudsman OIA response
calculator to find when your request for official information will be due

 

In cases where ACC’s response provides information that is identified to
be of general public interest, the response may also be published on the
ACC’s website. If ACC publishes the response to your OIA request, all
personal information, including your name and contact details, will be
removed.

 

The information you have requested may involve documents which contains
the names of our staff. Please let us know whether you require these
names. We may need to consult our staff before deciding whether we can
release this information, and this may take a bit more time. If we do not
hear from you, we will assume that you do not require staff names.

 

Our [2]website provides up to date news and information about our work.
You can also follow us on [3]Facebook and [4]Twitter. Further information
about how to contact us is also available [5]here.

 

Ngâ mihi,

Government Engagement Team

 

Government Engagement, ACC

' 0800 101 996
* Box 242, Wellington 6011

[6]www.acc.co.nz

 

 

Disclaimer:

"This message and any attachments may contain confidential and privileged
information. If you believe you have received this email in error, please
advise us immediately by return email or telephone and then delete this
email together with all attachments. If you are not the intended
recipient, you are not authorised to use or copy this message or any
attachments or disclose the contents to any other person."

References

Visible links
1. http://www.ombudsman.parliament.nz/agenc...
2. http://www.acc.co.nz/
3. http://www.facebook.com/ACCNewZealand/
4. https://twitter.com/accnz
5. http://www.acc.co.nz/contact/
6. https://aus01.safelinks.protection.outlo...

Link to this

From: AS Van Wey (Account suspended)

Dear Accident Compensation Corporation,

To avoid any doubt, I make my request under the Code of ACC Claimants' Rights as well as the OIA.

Yours faithfully,

AS Van Wey

Link to this

From: Government Services
Accident Compensation Corporation

Kia ora

 

Thank you for contacting ACC; this is an automatic reply to confirm we
have received your email.

 

We will try to respond your query as quickly as possible. However,
depending on the nature of your request you may not receive a response for
up to 20 working days. You can check the [1]Ombudsman OIA response
calculator to find when your request for official information will be due

 

In cases where ACC’s response provides information that is identified to
be of general public interest, the response may also be published on the
ACC’s website. If ACC publishes the response to your OIA request, all
personal information, including your name and contact details, will be
removed.

 

The information you have requested may involve documents which contains
the names of our staff. Please let us know whether you require these
names. We may need to consult our staff before deciding whether we can
release this information, and this may take a bit more time. If we do not
hear from you, we will assume that you do not require staff names.

 

Our [2]website provides up to date news and information about our work.
You can also follow us on [3]Facebook and [4]Twitter. Further information
about how to contact us is also available [5]here.

 

Ngâ mihi,

Government Engagement Team

 

Government Engagement, ACC

' 0800 101 996
* Box 242, Wellington 6011

[6]www.acc.co.nz

 

 

Disclaimer:

"This message and any attachments may contain confidential and privileged
information. If you believe you have received this email in error, please
advise us immediately by return email or telephone and then delete this
email together with all attachments. If you are not the intended
recipient, you are not authorised to use or copy this message or any
attachments or disclose the contents to any other person."

References

Visible links
1. http://www.ombudsman.parliament.nz/agenc...
2. http://www.acc.co.nz/
3. http://www.facebook.com/ACCNewZealand/
4. https://twitter.com/accnz
5. http://www.acc.co.nz/contact/
6. https://aus01.safelinks.protection.outlo...

Link to this

From: Government Services
Accident Compensation Corporation

Kia ora Amy,

The best way to make a complaint about our privacy process is to contact
ACC’s Privacy Officer.

[1]https://www.acc.co.nz/privacy/make-a-com...

 

Please note this forum is used for Official Information requests and their
response will not be posted here.

 

Ngâ mihi,

 

Sara Freitag (she/her)

Acting Manager | OIA Services

' 027 973 7330
* PO Box 242, Wellington 6011

 

-----Original Message-----
From: AS Van Wey <[FOI #24167 email]>
Sent: Saturday, September 16, 2023 9:53 AM
To: Government Services <[email address]>
Subject: Official Information request - ACC policies, rules and advice
inconsistent with ACC Privacy Policies and legislation

 

[You don't often get email from
[2][FOI #24167 email]. Learn why this is
important at [3]https://aka.ms/LearnAboutSenderIdentific... ]

 

Dear Accident Compensation Corporation,

 

Your Policy "When to save emails in Eos Policy v16.0" includes a list of
types of email communications in which ACC advises employees not to save.
These emails clearly contain information about a claimant, and thus, would
be considered personal information that is subject to the Privacy Act.
Furthermore, these communications are all subject to the Public Records
Act.

 

If ACC employees are making a habit of deleting client personal
information (the types of emails listed in your policy), please explain
how these actions are consistent with the requirements under IPP 5 & IPP 6
of the Privacy Act, as well as the legal requirements to maintain
information, as set out under the Public Records Act. If these emails are
not being saved to the claimant's file or in EOS (the "Task" or "Contacts"
sections), where is the information being saved and how does a claimant
obtain access, pursuant to the Privacy Act, OIA, and the Code of ACC
Claimants' Rights?

 

I note that your your Authority Principles document (GOV-026284, Appendix,
p 52) states: "We don't need authority to use or disclose information for
the purpose of establishing a client's eligibility entitlements."

 

ACC's Authority Principle has me quite concerned, as it is clearly
inconsistent with the Privacy Act 2020 and Health Information Privacy Code
2020, which is all about the legal obligation of government agencies to
seek the informed consent of the individual prior to obtaining or
disclosing information.

 

Further, ACC's internal policies specify that prior to seeking or
disclosing information, ACC is to discuss this with the claimant and
obtain their consent. See:

- Report a Privacy Breach,

- Summary of the Information Privacy Principles Policy,

- Personal Information and Privacy Guidelines,

- Privacy Policy

- Privacy check before disclosing information Policy,

- Client Choice of Providers Policy

- Seek External Clinical Advice

- Arrange Medical Single Discipline Assessment -ACC Privacy Maturity
Action Plan

 

Please note again, neither the ACC6300 form nor the ACC45 form include
consent for ACC to disclose any information. Thus, checking to see if
these forms are on file is insufficient to verify consent for disclosure.
These forms also do not satisfy IPP 3 of the Privacy Act, and thus are not
adequate documents to claim that ACC has obtained a claimant's informed
consent. One cannot provide informed consent if the one is not informed.
Even the ACC45 and ACC46 form start with the statement, "The form collects
the basic information we need about your injury to help us decide if we
can provide cover. If we need more information about his claim we will
contact you later." Thus, this form does not give the consent to seek
information without ACC contacting the claimant and specifying the records
ACC needs. Please refer to:

- Request Clinical Records for Treatment Injury v16.0

- Request medical or clinical records Policy

- (NGCM) Request Clinical Records v100.0

- Request and Obtain External Agency Records

- Obtain Client Authority to Collect Information

 

So for instance, if ACC doesn't explicitly state that ACC intends to
disclose information to a particular person (such as a particular ECA) and
what information they intend to disclose (with specificity), prior to
obtaining the information, then ACC has not obtained the information for
the purpose of disclosing to another. ACC is required to obtain the
consent of the claimant prior to any disclosure, with rare exceptions.

 

I note that a key point of having ensured the claimant's informed consent,
which would be to ensure the claimant knows exactly what is being sought
or disclosed to whom, mitigates the risk of ACC employees disclosing or
obtaining information unrelated to the claim, which ACC has done in many
of my claims.

 

Please ensure the response comes from ACC's Privacy Officer, rather than
attempting to "wing it".

 

Yours faithfully,

 

AS Van Wey

 

-------------------------------------------------------------------

 

This is an Official Information request made via the FYI website.

 

Please use this email address for all replies to this request:

[4][FOI #24167 email]

 

Is [5][ACC request email] the wrong address for Official
Information requests to Accident Compensation Corporation? If so, please
contact us using this form:

[6]https://aus01.safelinks.protection.outlo...

 

Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:

[7]https://aus01.safelinks.protection.outlo...

 

If you find this service useful as an Official Information officer, please
ask your web manager to link to us from your organisation's OIA or LGOIMA
page.

 

 

-------------------------------------------------------------------

Disclaimer:

"This message and any attachments may contain confidential and privileged
information. If you believe you have received this email in error, please
advise us immediately by return email or telephone and then delete this
email together with all attachments. If you are not the intended
recipient, you are not authorised to use or copy this message or any
attachments or disclose the contents to any other person."

References

Visible links
1. https://www.acc.co.nz/privacy/make-a-com...
2. mailto:[FOI #24167 email]
3. https://aka.ms/LearnAboutSenderIdentific...
4. mailto:[FOI #24167 email]
5. mailto:[ACC request email]
6. https://fyi.org.nz/change_request/new?bo...
7. https://fyi.org.nz/help/officers

hide quoted sections

Link to this

From: AS Van Wey (Account suspended)

Dear Government Services,

Thank you for the suggestion to make a complaint to the privacy officer at ACC, which I have done and ACC has not addressed. However, I still request the information in my request.

Yours sincerely,

AS Van Wey

Link to this

From: Government Services
Accident Compensation Corporation

Kia ora

 

Thank you for contacting ACC; this is an automatic reply to confirm we
have received your email.

 

We will try to respond your query as quickly as possible. However,
depending on the nature of your request you may not receive a response for
up to 20 working days. You can check the [1]Ombudsman OIA response
calculator to find when your request for official information will be due

 

In cases where ACC’s response provides information that is identified to
be of general public interest, the response may also be published on the
ACC’s website. If ACC publishes the response to your OIA request, all
personal information, including your name and contact details, will be
removed.

 

The information you have requested may involve documents which contains
the names of our staff. Please let us know whether you require these
names. We may need to consult our staff before deciding whether we can
release this information, and this may take a bit more time. If we do not
hear from you, we will assume that you do not require staff names.

 

Our [2]website provides up to date news and information about our work.
You can also follow us on [3]Facebook and [4]Twitter. Further information
about how to contact us is also available [5]here.

 

Ngâ mihi,

Government Engagement Team

 

Government Engagement, ACC

' 0800 101 996
* Box 242, Wellington 6011

[6]www.acc.co.nz

 

 

Disclaimer:

"This message and any attachments may contain confidential and privileged
information. If you believe you have received this email in error, please
advise us immediately by return email or telephone and then delete this
email together with all attachments. If you are not the intended
recipient, you are not authorised to use or copy this message or any
attachments or disclose the contents to any other person."

References

Visible links
1. http://www.ombudsman.parliament.nz/agenc...
2. http://www.acc.co.nz/
3. http://www.facebook.com/ACCNewZealand/
4. https://twitter.com/accnz
5. http://www.acc.co.nz/contact/
6. https://aus01.safelinks.protection.outlo...

Link to this

Things to do with this request

Anyone:
Accident Compensation Corporation only: