Dear Accident Compensation Corporation,

I am a NZ citizen. Please transfer this request for information to ACC's Privacy Officer for response.

I request a list of ACC's policies, procedures, guidelines, rules, processes and other documents for:
(A) contracting external legal counsel to represent ACC in disputes with claimants, and
(B) notification to claimant of ACC having contracted external legal counsel and the limits of the external legal counsel's representation, and
(C) ACC employees cc'ing external legal counsel into communications to the claimant about matters that are not under review or before the Court.

The Code says you will provide honest and accurate answers to claimant's questions. I am a claimant.

Please explain specify which of ACC's policies, processes, rules, guidelines or other documents, advise employees to cc external legal counsel in email correspondence with claimants, when that correspondence is not related to decision that was referred to review or a matter before the Court, and how that document is consistent with ACC's obligations under the Code (right 1, 2, 5, 6, 7) and the Privacy Act (IPP 3, IPP 5, IPP 11).

Thank you for your help.

S.L.

Dear Government Services,

You have requested
a. Your full name and confirmation of your identity, and
b. the reasons for the request

I am a NZ citizen, which is sufficient for me to make a request under the OIA.

The AC Act requires ACC to make decisions which are reasonable (s 54). The Code (right 7) states ACC will respect our privacy.

ACC is only permitted to request information that is necessary for its purpose (See the Privacy Act 2020, IPP 1).
Information privacy principle 1
Purpose of collection of personal information
(1) Personal information must not be collected by an agency unless—
(a) the information is collected for a lawful purpose connected with a function or an activity of the agency; and
(b) the collection of the information is necessary for that purpose.
(2) If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s
identifying information.

ACC's purpose is outlined in section 3 of the AC Act.
3 Purpose
The purpose of this Act is to enhance the public good and reinforce the social contract represented by the first accident compensation scheme by providing for a fair and sustainable scheme for managing personal injury that has, as its overriding goals, minimising both the overall incidence of injury in the community, and the impact of injury on the community (including economic,
social, and personal costs), through—
(a) establishing as a primary function of the Corporation the promotion of measures to reduce the incidence and severity of personal injury:
(b) providing for a framework for the collection, co-ordination, and analysis of injury-related information:
(ba) ensuring that the Corporation monitors access to the accident compensation scheme by Māori and identified population groups in order to deliver services under this Act in a manner that supports access to the scheme by injured Māori and injured persons in those population groups:
(c) ensuring that, where injuries occur, the Corporation’s primary focus should be on rehabilitation with the goal of achieving an appropriate quality of life through the provision of entitlements that restores to the maximum practicable extent a claimant’s health, independence, and participation:
(d) ensuring that, during their rehabilitation, claimants receive fair compensation for loss from injury, including fair determination of weekly compensation and, where appropriate, lump sums for permanent impairment:
(e) ensuring positive claimant interactions with the Corporation through the development and operation of a Code of ACC Claimants’ Rights:
(f) ensuring that persons who suffered personal injuries before the commencement of this Act continue to receive entitlements where appropriate.

There is no reason for you to request my full name or confirmation of my identity. It does not serve ACC's legislative purpose, nor is it necessary for ACC to comply with an OIA request.

If it were necessary for ACC to make a request for my personal information, ACC can only do so after meeting the requirements set out in IPP 3 of the Privacy Act 2020.

Information privacy principle 3
Collection of information from subject
(1) If an agency collects personal information from the individual concerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of—
(a) the fact that the information is being collected; and
(b) the purpose for which the information is being collected; and
(c) the intended recipients of the information; and
(d) the name and address of—
(i) the agency that is collecting the information; and
(ii) the agency that will hold the information; and
(e) if the collection of the information is authorised or required by or under law,—
(i) the particular law by or under which the collection of the information is authorised or required; and
(ii) whether the supply of the information by that individual is voluntary or mandatory; and
(f) the consequences (if any) for that individual if all or any part of the requested information is not provided; and
(g) the rights of access to, and correction of, information provided by the IPPs.
(2) The steps referred to in subclause (1) must be taken before the information is collected or, if that is not practicable, as soon as practicable after the information is collected.

ACC has not provided me with the information required under IPP 3 of the Privacy Act 2020, and thus is not permitted to request my personal identifying information. This is a breach of obligations under the Privacy Act (IPP 3) and the Code (right 7).

The Privacy Act 2020 (IPP 4) states:
Information privacy principle 4
Manner of collection of personal information
An agency may collect personal information only—
(a) by a lawful means; and
(b) by a means that, in the circumstances of the case (particularly in circumstances where personal information is being collected from children or young persons),—
(i) is fair; and
(ii) does not intrude to an unreasonable extent upon the personal affairs of the individual concerned.

The Code (right 2) states: “(a) We will treat you fairly.”

I note that ACC has responded to many other OIA requests without requiring the information you have requested from me. This is not fair, and thus a breach of your obligations under the Code and the Privacy Act (IPP 4).

The only difference I can see between me and others that you have not requested personal identifiers from, is my sex. I see ACC does not require this information from men. ACC is prohibited under the Human Rights Act 1993 (s 21)from discrimination based on sex.

I have read enough of your publicly available policies and process to know that you will record these communications in EOS under my party file if I provide you with my full information. I have read enough to know that ACC has no controls in place to mitigate against unauthorised access to my personal information (required under IPP 5). Given ACC has nearly 4000 employees, with no access control, this means that I am at risk of more than 4000 people having access to my OIA requests and communications with ACC, which would occur without my knowledge or consent, without any authorisation or legitimate reason.

If I were to comply with ACC's unreasonable, unfair, and unlawful request, the result would be further breaches of my privacy (see IPP 5 and IPP 10).

As for my reason for making an OIA request. I do not have to provide you with a reason, because I am not a government employee nor do I represent a government agency. It is only government agencies, or agencies that hold personal information, that must provide reasons for decisions and requests. I refer to the OIA, the AC Act and the Privacy Act.

As a private, NZ citizen, I am entitled under the OIA - as in I have a legislative right - to request information from any NZ government agency(e.g., ACC) and ACC has a legislative obligation to provide that information.

An unfair, invasion of my privacy is not a legal reason to deny me the information.

Sue

Dear Government Services,

You have requested
a. Your full name and confirmation of your identity, and
b. the reasons for the request

I am a NZ citizen, which is sufficient for me to make a request under the OIA.

The AC Act requires ACC to make decisions which are reasonable (s 54). The Code (right 7) states ACC will respect our privacy.

ACC is only permitted to request information that is necessary for its purpose (See the Privacy Act 2020, IPP 1).
Information privacy principle 1
Purpose of collection of personal information
(1) Personal information must not be collected by an agency unless—
(a) the information is collected for a lawful purpose connected with a function or an activity of the agency; and
(b) the collection of the information is necessary for that purpose.
(2) If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s
identifying information.

ACC's purpose is outlined in section 3 of the AC Act.
3 Purpose
The purpose of this Act is to enhance the public good and reinforce the social contract represented by the first accident compensation scheme by providing for a fair and sustainable scheme for managing personal injury that has, as its overriding goals, minimising both the overall incidence of injury in the community, and the impact of injury on the community (including economic,
social, and personal costs), through—
(a) establishing as a primary function of the Corporation the promotion of measures to reduce the incidence and severity of personal injury:
(b) providing for a framework for the collection, co-ordination, and analysis of injury-related information:
(ba) ensuring that the Corporation monitors access to the accident compensation scheme by Māori and identified population groups in order to deliver services under this Act in a manner that supports access to the scheme by injured Māori and injured persons in those population groups:
(c) ensuring that, where injuries occur, the Corporation’s primary focus should be on rehabilitation with the goal of achieving an appropriate quality of life through the provision of entitlements that restores to the maximum practicable extent a claimant’s health, independence, and participation:
(d) ensuring that, during their rehabilitation, claimants receive fair compensation for loss from injury, including fair determination of weekly compensation and, where appropriate, lump sums for permanent impairment:
(e) ensuring positive claimant interactions with the Corporation through the development and operation of a Code of ACC Claimants’ Rights:
(f) ensuring that persons who suffered personal injuries before the commencement of this Act continue to receive entitlements where appropriate.

There is no reason for you to request my full name or confirmation of my identity. It does not serve ACC's legislative purpose, nor is it necessary for ACC to comply with an OIA request.

If it were necessary for ACC to make a request for my personal information, ACC can only do so after meeting the requirements set out in IPP 3 of the Privacy Act 2020.

Information privacy principle 3
Collection of information from subject
(1) If an agency collects personal information from the individual concerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of—
(a) the fact that the information is being collected; and
(b) the purpose for which the information is being collected; and
(c) the intended recipients of the information; and
(d) the name and address of—
(i) the agency that is collecting the information; and
(ii) the agency that will hold the information; and
(e) if the collection of the information is authorised or required by or under law,—
(i) the particular law by or under which the collection of the information is authorised or required; and
(ii) whether the supply of the information by that individual is voluntary or mandatory; and
(f) the consequences (if any) for that individual if all or any part of the requested information is not provided; and
(g) the rights of access to, and correction of, information provided by the IPPs.
(2) The steps referred to in subclause (1) must be taken before the information is collected or, if that is not practicable, as soon as practicable after the information is collected.

ACC has not provided me with the information required under IPP 3 of the Privacy Act 2020, and thus is not permitted to request my personal identifying information. This is a breach of obligations under the Privacy Act (IPP 3) and the Code (right 7).

The Privacy Act 2020 (IPP 4) states:
Information privacy principle 4
Manner of collection of personal information
An agency may collect personal information only—
(a) by a lawful means; and
(b) by a means that, in the circumstances of the case (particularly in circumstances where personal information is being collected from children or young persons),—
(i) is fair; and
(ii) does not intrude to an unreasonable extent upon the personal affairs of the individual concerned.

The Code (right 2) states: “(a) We will treat you fairly.”

I note that ACC has responded to many other OIA requests without requiring the information you have requested from me. This is not fair, and thus a breach of your obligations under the Code and the Privacy Act (IPP 4).

The only difference I can see between me and others that you have not requested personal identifiers from, is my sex. I see ACC does not require this information from men. ACC is prohibited under the Human Rights Act 1993 (s 21)from discrimination based on sex.

I have read enough of your publicly available policies and process to know that you will record these communications in EOS under my party file if I provide you with my full information. I have read enough to know that ACC has no controls in place to mitigate against unauthorised access to my personal information (required under IPP 5). Given ACC has nearly 4000 employees, with no access control, this means that I am at risk of more than 4000 people having access to my OIA requests and communications with ACC, which would occur without my knowledge or consent, without any authorisation or legitimate reason.

If I were to comply with ACC's unreasonable, unfair, and unlawful request, the result would be further breaches of my privacy (see IPP 5 and IPP 10).

As for my reason for making an OIA request. I do not have to provide you with a reason, because I am not a government employee nor do I represent a government agency. It is only government agencies, or agencies that hold personal information, that must provide reasons for decisions and requests. I refer to the OIA, the AC Act and the Privacy Act.

As a private, NZ citizen, I am entitled under the OIA - as in I have a legislative right - to request information from any NZ government agency(e.g., ACC) and ACC has a legislative obligation to provide that information.

An unfair, invasion of my privacy is not a legal reason to deny me the information.

Sue