"Legitimate purpose" provides no protection under 167 form
17 April 2014
"Relevance" and "legitimate purpose" provides no protection under 167 form
On Radio New Zealand today, the Privacy Commissioner indicated that ACC could only request information that was "relevant" for a "legitimate purpose". His view was therefore that the ACC167 form is not a "blank cheque" or "carte blanche".
While the form does suggest that information must be relevant, the duration of the information consent and the way the form is used mean that these requirements provide no protection for claimants.
ACC claimants who are required to sign a 167 form give their consent once and it applies for the life of their claim. ACC refuses to negotiate a limited time frame, despite what is recorded on the form. ACC is able to decline to provide entitlements, including weekly compensation, if a claimant insists on a limited time frame. The only way to challenge the reasonableness of ACC's position on your consent is by legal challenge, which is difficult when ACC is withholding your primary source of income.
Once the form is signed, ACC obtains administrative freedom, and is largely left to its own devices.
Significantly, the form does not require ACC to notify a claimant what information is being collected or disclosed. There is therefore no opportunity for a claimant to monitor the relevance requirement, or object as to whether the information is relevant before it is collected or disclosed.
Considering the scale of ACC's disclosure of this information, for example to potential employers, it is not entirely clear they can effectively monitor the relevance of that information before disclosing it. Certainly, a claimant is not given that chance.
The form enables information to be collected, used, and disclosed regardless of relevance, and without notification to the claimant. The requirement for blanket consent (rather than on a case-by-case basis as Judge Powell specifically endorsed) means that irrelevant information can be collected, used, and disclosed for an illegitimate purpose before a claimant is even aware what has taken place.
Claimants also routinely suffer abuse even for a "legitimate purpose". The ACC167 form enables fraud investigators to contact any number of third parties for the "legitimate purpose" of investigating and disclosing information in relation to alleged fraud. Situations exist where claimants have been forced to leave small communities because the inquiries of a fraud investigator have irreparably harmed their reputation. The number and scale of these investigations undertaken each year is unclear.
When it comes to the ACC167 form, with its lengthy time-frame and broad consent, the Privacy Commissioner is unfortunately incorrect in saying that "relevance" and "legitimate purpose" provide any protection for claimants.
ACC167 gives ACC a blank cheque to do as they wish with claimants' information, including providing it to 36,000 potential employers in the past year alone. It is unclear whether ACC was paid for this service.