Dear Accident Compensation Corporation,

I request clarification to your response GOV-029712.

Jason Hope, Acting Manager Official Information Act Service, wrote on 29/01/2024:

ACC has 75 client email addresses subject to email redirection. These email addresses are either linked to at least one client in EOS or are not linked to a client in EOS but we have otherwise determined are emails used by clients. Some of these may also be linked to non-client records. We have identified a further nine email addresses subject to email redirection, which were previously linked to a client in EOS.

Thank you for specifying the number of emails that are currently being affected by email redirection by ACC employees.There is no information about email redirection in any of the available documents ACC disclosed on this subject.

I request the following:

1. In which of ACC's databases the information on claimant email redirection is held at ACC, which allowed Jason Hope to provide very specific numbers of email addresses that are being subjected to email redirection.

2: ACC's documents that describe
(a) the meaning of "email redirection",
(b) how the email redirection is to be implemented, and
(c) the approval process for the email redirection.

3: ACC's methodology to determine the ownership of email addresses not linked to a claimant in EOS. (How was ACC able to verify the email address belonged to the claimant and not to the claimant's family, friends, advocate, or other representative?)

4. A copy of ACC's notice to claimants and non-claimants which clearly describes the implementation of the email redirection and the effect of that email redirection.

For each year from 01/01/2014 to present, I request:

1. The number of claimants and non-claimants whose email communications were subjected to redirection, and please specify the numbers into categories of
(a) claimant,
(b) claimant's family, friend, advocate, or other representative; and
(c) other person.

2. The length of time each of the claimants' and non-claimants' email communications were subjected to redirection.

3: For each claimant and non-claimant email address subjected to redirection, please specify whether this email redirection was implemented as a "communication plan" or not.

4: For each claimant and non-claimant email address subjected to redirection, please specify whether the email redirection was implemented with the assistance of Datacom or other IT support (please specify the company or agency who provided the IT support).

5: For each claimant and non-claimant email address subjected to redirection, please specify whether the email redirection:
(a) occurred during transit, that is at the Datacom or ACC server, and before reaching the intended recipient, or
(b) occurred after the intended recipient opened and read the communication, which is email forwarding.

Regards,

Joe

Dera ACC,

Thank you for your response of 01/07/24, but it was incomplete.

Response 2:

My 2nd request was for:
ACC's documents that describe
(a) the meaning of "email redirection",
(b) how the email redirection is to be implemented, and
(c) the approval process for the email redirection.

Your response to Request 2 was:
“Our process documents do not specifically mention email redirection. As such, we are refusing this request under section 18(e) as the information does not exist.”

I did not request your process documents. You have already stated in other OIA responses that ACC holds no policies or process documents for email redirection (GOV-032919, GOV-029712, GOV-028030, GOV-027062).

I requested documents ACC holds which describe (a) the meaning of "email redirection", (b) how the email redirection is to be implemented, and (c) the approval process for the email redirection.

The types of documents would include, discussion notes and minutes by executives, ACC committees, ACC policy and process makers, Board members, or other employees. The documents would include correspondence with the IS Team, recommendations by the IS Team, internal Legal Counsel, or other employees, correspondence with Datacom, advice from the Ombudsman, Department of Internal Affairs, Privacy Commissioner, or any other outside agency or consulting agency.

Before making a decision to use email redirection, there must have been some internal discussion on the matter, as well as a discussion on how to implement the email redirection, who had the authority to implement email redirection, and when it would be appropriate and lawful to implement the email redirection. I seek those documents.

Documentation of discussions, planning, and implementation are standard practice in any organisation, and more so in government owned agencies.

Please make sure you obtain the requested information from the IS Team, Datacom, the Executive Team an the Owner and Expert who informed the Communication Plan Policy and processes for implementing, revisiting and removing communications plans, the persons who developed the notices you attached to your response, and any other person who contributed to the decision making to engage in email redirection during the transit of emails with the assistance of Datacom.

Response 3:

Your response to request 3 did not address how ACC determined that the emails belonged to a “claimant and not to the claimant's family, friends, advocate, or other representative”. ACC has alredy admitted that some of the emails are linked to "non-client records" (GOV-029712), which indicates that some of the email addresses belong to persons who do not have a claim with ACC such as a family member, friend or advocate.

Response 4:

My request 4 was a request for “A copy of ACC's notice to claimants and non-claimants which clearly describes the implementation of the email redirection and the effect of that email redirection.”

The notices you provided me (1) did not mention email redirection, (2) did not state the effect of the email redirection, and (3) did not include any information regarding review rights or how ACC’s decision was consistent with the Code and privacy legislation.

Again, I request “A copy of ACC's notice to claimants and non-claimants which clearly describes the implementation of the email redirection and the effect of that email redirection.”

Response 1:

My 1st request was:
"In which of ACC's databases the information on claimant email redirection is held at ACC, which allowed Jason Hope to provide very specific numbers of email addresses that are being subjected to email redirection."

Your response was: “The list of emails with email redirection rules is held within the Active Directory Database managed by the Information Security team.”

Thank you for confirming that all information about (a) whose emails are being redirected, (b) who requested the email redirection, (c) the reasons for redirection and (d) the method of redirection is all held in a single location – the Active Directory Database.

Thank you for confirming that a single team (the Information Security Team) manages all of the information about email redirection.

Response 5:

Response 5 was irrational. You have acknowledged all of the relevant information is held in a single location and managed by a single team (Response 1). The information is readily accessible because ACC could determine exactly how many email addresses are subject to redirection (GOV-029712) and that 15 of those are in the Te Ara Tika unit (GOV-032919). Clearly, the information is readily accessible and section 18(f) of the OIA does not apply.

Repeat request:

Please make sure the following request is sent to the IS Team to respond to. If they are even marginally capable IT personnel, this request will take very little time and effort for them to complete.

For each year from 01/01/2014 to present, I request from the IS Team:

1. The number of claimants and non-claimants whose email communications were subjected to redirection, and please specify the numbers into categories of
(a) claimant,
(b) claimant's family, friend, advocate, or other representative; and
(c) other person.

2. The length of time each of the claimants' and non-claimants' email communications were subjected to redirection.

3: For each claimant and non-claimant email address subjected to redirection, please specify whether this email redirection was implemented as a "communication plan" or not.

4: For each claimant and non-claimant email address subjected to redirection, please specify whether the email redirection was implemented with the assistance of Datacom or other IT support (please specify the company or agency who provided the IT support). To date ACC has only acknowledged the assistance of Datacom (GOV-028030) for email redirection.

5: For each claimant and non-claimant email address subjected to redirection, please specify whether the email redirection:
(a) occurred during transit, that is at the Datacom or ACC server, and before reaching the intended recipient, or
(b) occurred after the intended recipient opened and read the communication, which is email forwarding.

Given that ACC has stated that Datacom is assisting in the email redirection (GOV-028030), this would indicate to me that 100% of email redirection is done during transit, at the Datacom or ACC server.

In addition, please provide all of the records held by the IS Team regarding email redirection, with the names of the claimant and their email addresses redacted to protect their privacy. Please ensure that all ACC employee names, and their business groups are legible, as well as any names of persons who work for Datacom and have assisted ACC with the redirection of emails during transit.

Thank you.
Joe

Joe