Dear Accident Compensation Corporation,

This is a request for information pertaining to ACC's rights.

In the Review a Communication Plan procedure, step (1)(a), there is a Note that reads:

NOTE Is there a limit on how many times a notice to retain the communication plan can be sent out to the client?
No. As long as the notification is sent out minimum six months apart and the client's behaviour is not improving, ACC has the right to retain the client's communication plan.

Request 1: I request the reference to the specific Act, and specific section of that Act, that gives ACC:
(a) a right to implement a care indicator; and
(b) any legislative limits to the information that may be included in the care indicator: and
(c) any legislative limits to the information as to whom may have access to the care indicator information; and
(d) any legislative requirements that ACC must fulfil before implementing a care indicator (e.g., such as consent, right to be heard and challenge the decision, right to correction, or a right of review of the decision).

Request 2: I request the reference to the specific Act, and specific section of that Act, that gives ACC
(a) a right to implement or retain a claimant's communication plan; and
(b) any legislative limits on the types of communication plans that may be imposed on a claimant; and
(c) any legislative limits on how those communication plans may be implemented.; and
(d) any legislative requirements that ACC must fulfil before implementing a communication plan.

Request 3: I request the reference to the specific Act, and specific section of that Act, that gives ACC:
(a) a right to implement or retain a plan which involves the redirection of personal communications to an unintended recipient; and
(b) any legislative limits on the redirection of personal communications to an unintended recipient; and
(c) any legislative limits on how the redirection of the personal communications may be implemented; and
(d) any legislative requirements that ACC must fulfil before redirecting claimant's personal communications to an unintended recipient.

Request 4: If there is no such enactment, that confers a right to ACC to:
(a) implement a care indicator,
(b) implement a communication plan, and/or
(c) implement a plan that involves the redirection of claimant's personal communications to an unintended recipient, then please provide me with the case law, secondary legislation or any other legal document which affirms ACC has these rights.

Request 5: I request the policy, process, guidelines, procedures, rules and all other documents, or, if no document exists, a description of the steps taken by ACC to
(a) obtain the claimant's consent to have their private communications redirected to an unintended recipient; and
(b) obtain the intended recipient's informed consent to have the personal communications redirected to an unintended recipient; and
(c) obtain the claimant's informed consent to have the claimant's care indicator accessible to all ACC employees who have access to EOS (including phone operators); and
(d) obtain the claimant’s consent to disclose the care indicator information to third parties.

If this is an argument of "necessity" or allegedly, a "health and safety" thing, please provide that argument and why it would be applicable to ACC employees spread all around NZ, including people the claimant will never meet or engage with (like the call centre personnel).

Thank you,
Sue

Dear Government Services,

You have requested
a. Your full name and confirmation of your identity, and
b. the reasons for the request

I am a NZ citizen, which is sufficient for me to make a request under the OIA.

The AC Act requires ACC to make decisions which are reasonable (s 54). The Code (right 7) states ACC will respect our privacy.

ACC is only permitted to request information that is necessary for its purpose (See the Privacy Act 2020, IPP 1).
Information privacy principle 1
Purpose of collection of personal information
(1) Personal information must not be collected by an agency unless—
(a) the information is collected for a lawful purpose connected with a function or an activity of the agency; and
(b) the collection of the information is necessary for that purpose.
(2) If the lawful purpose for which personal information about an individual is collected does not require the collection of an individual’s identifying information, the agency may not require the individual’s
identifying information.

ACC's purpose is outlined in section 3 of the AC Act.
3 Purpose
The purpose of this Act is to enhance the public good and reinforce the social contract represented by the first accident compensation scheme by providing for a fair and sustainable scheme for managing personal injury that has, as its overriding goals, minimising both the overall incidence of injury in the community, and the impact of injury on the community (including economic,
social, and personal costs), through—
(a) establishing as a primary function of the Corporation the promotion of measures to reduce the incidence and severity of personal injury:
(b) providing for a framework for the collection, co-ordination, and analysis of injury-related information:
(ba) ensuring that the Corporation monitors access to the accident compensation scheme by Māori and identified population groups in order to deliver services under this Act in a manner that supports access to the scheme by injured Māori and injured persons in those population groups:
(c) ensuring that, where injuries occur, the Corporation’s primary focus should be on rehabilitation with the goal of achieving an appropriate quality of life through the provision of entitlements that restores to the maximum practicable extent a claimant’s health, independence, and participation:
(d) ensuring that, during their rehabilitation, claimants receive fair compensation for loss from injury, including fair determination of weekly compensation and, where appropriate, lump sums for permanent impairment:
(e) ensuring positive claimant interactions with the Corporation through the development and operation of a Code of ACC Claimants’ Rights:
(f) ensuring that persons who suffered personal injuries before the commencement of this Act continue to receive entitlements where appropriate.

There is no reason for you to request my full name or confirmation of my identity. It does not serve ACC's legislative purpose, nor is it necessary for ACC to comply with an OIA request.

If it were necessary for ACC to make a request for my personal information, ACC can only do so after meeting the requirements set out in IPP 3 of the Privacy Act 2020.

Information privacy principle 3
Collection of information from subject
(1) If an agency collects personal information from the individual concerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of—
(a) the fact that the information is being collected; and
(b) the purpose for which the information is being collected; and
(c) the intended recipients of the information; and
(d) the name and address of—
(i) the agency that is collecting the information; and
(ii) the agency that will hold the information; and
(e) if the collection of the information is authorised or required by or under law,—
(i) the particular law by or under which the collection of the information is authorised or required; and
(ii) whether the supply of the information by that individual is voluntary or mandatory; and
(f) the consequences (if any) for that individual if all or any part of the requested information is not provided; and
(g) the rights of access to, and correction of, information provided by the IPPs.
(2) The steps referred to in subclause (1) must be taken before the information is collected or, if that is not practicable, as soon as practicable after the information is collected.

ACC has not provided me with the information required under IPP 3 of the Privacy Act 2020, and thus is not permitted to request my personal identifying information. This is a breach of obligations under the Privacy Act (IPP 3) and the Code (right 7).

The Privacy Act 2020 (IPP 4) states:
Information privacy principle 4
Manner of collection of personal information
An agency may collect personal information only—
(a) by a lawful means; and
(b) by a means that, in the circumstances of the case (particularly in circumstances where personal information is being collected from children or young persons),—
(i) is fair; and
(ii) does not intrude to an unreasonable extent upon the personal affairs of the individual concerned.

The Code (right 2) states: “(a) We will treat you fairly.”

I note that ACC has responded to many other OIA requests without requiring the information you have requested from me. This is not fair, and thus a breach of your obligations under the Code and the Privacy Act (IPP 4).

The only difference I can see between me and others that you have not requested personal identifiers from, is my sex. I see ACC does not require this information from men. ACC is prohibited under the Human Rights Act 1993 (s 21)from discrimination based on sex.

I have read enough of your publicly available policies and process to know that you will record these communications in EOS under my party file if I provide you with my full information. I have read enough to know that ACC has no controls in place to mitigate against unauthorised access to my personal information (required under IPP 5). Given ACC has nearly 4000 employees, with no access control, this means that I am at risk of more than 4000 people having access to my OIA requests and communications with ACC, which would occur without my knowledge or consent, without any authorisation or legitimate reason.

If I were to comply with ACC's unreasonable, unfair, and unlawful request, the result would be further breaches of my privacy (see IPP 5 and IPP 10).

As for my reason for making an OIA request. I do not have to provide you with a reason, because I am not a government employee nor do I represent a government agency. It is only government agencies, or agencies that hold personal information, that must provide reasons for decisions and requests. I refer to the OIA, the AC Act and the Privacy Act.

As a private, NZ citizen, I am entitled under the OIA - as in I have a legislative right - to request information from any NZ government agency(e.g., ACC) and ACC has a legislative obligation to provide that information.

An unfair, invasion of my privacy is not a legal reason to deny me the information.

Sue