Our privacy notice

If you’re injured, you and your treatment provider (for example, your doctor or counsellor) will complete an ACC claim form. The form may contain: 

• information about you
• information about your employer
• information about your injury
• information about your ability to continue working. 

The ACC claim form gives us permission to collect your basic information, and most of the time this is enough to manage your claim. However, if your injury is more complicated, we may need to ask for more information from you or others.

We’ll help you keep as much control over your information as possible, including collecting it directly from you when we can. You can also expect us to only collect information:

• when we deliver services to you
• when we fulfil our legal functions
• where the law requires or allows us to.

You don’t have to give us any of your information if we ask for it. However, under the Act, you must provide information that is relevant to your claim when we reasonably require you to provide it. This means we may decline to provide any entitlement if you unreasonably refuse to give us relevant information. 

We may need to obtain information about you from other agencies, such as:

• your general practitioner (GP)
• your treatment provider
• your employer
• other government agencies, such as Inland Revenue.

Unless otherwise permitted by law, we will ask for your consent before collecting information about you from other parties.

Jane makes a claim for tennis elbow and believes this has occurred through their work tasks. Before we make a decision to cover Jane’s claim, we’ll ask them if we can collect further information from their doctor and their employer. This is because tennis elbow is a gradually occurring condition and we can only cover this type of injury when it has occurred as a result of their paid employment. 

You can talk to us if you don’t want us to collect information in this way. However, under the Act, you must provide information that is relevant to your claim when we reasonably require you to provide it. We may decline to provide any entitlement if you unreasonably refuse to authorise us to collect relevant information.

We may collect information from you for other lawful purposes connected with our functions and activities under the Act. This means we may collect your personal information in contexts other than helping you recover from an injury, such as:

• when you pay levies
• when you provide services to injured people we’re supporting
• when you apply to work at ACC.

Our handling of this information is guided by the same legal requirements and principles as information about injured people. This means we’ll only collect the information we need and will collect it directly from you where possible. Unless otherwise permitted by law, we will ask for your consent before collecting information about you from other parties.

Levies

When you pay levies, we may collect your personal information from you and from other agencies. For example, we receive information from Inland Revenue to help us work out which self-employed people or businesses need to pay levies.

ACC websites

When you visit our websites, we collect information about your site usage.

You can learn more about how our websites handle your information by reading Privacy when you use our site.

Privacy when you use our site

Social media

When you engage with us on social media, we ask that you do not share any of your own, or anyone else’s, private information. Instead, please call us.

However, we may collect your personal information in certain circumstances (for example, if you choose to direct message us). Remember, the social media service you use may also have access to the information you share with us, and this information will be governed by that service’s privacy policy. 

You can learn more about our approach to social media by reading our Social media terms and conditions.

Social media terms and conditions

Integrity Services

You pay levies to us, and we want to ensure these funds are spent appropriately. This means we also collect information for the purpose of preventing, detecting and/or responding to potential fraud, waste, and abuse of the ACC Scheme. When we do so, we take care to exercise our information gathering powers lawfully and appropriately.

You can learn more about how our Integrity Services handle your information by reading our Integrity Services Transparency Statement.

Integrity Services Transparency Statement

If you’re injured, we’ll use your information to assess your claim and decide what support we’re able to provide. This may include funding your appointments, transport, home help, and medication.

We may use information we already hold about you to assess your new claims. We only use this information where we believe it is relevant and necessary, or where the law permits us.

Bella fractured their back in 1998. Recently, their back has been playing up and they think this old injury might be the cause. By comparing previous scans to their current results, we can see that the new injury is linked to the old one, and we are able to provide the right support.

You can learn more about how we use your information by visiting this page on our website:

How we collect and use your information 

Using algorithms

Algorithms are computer-coded systems that help to carry out calculations quickly. We use algorithms to improve how we help you. We’re careful to keep human oversight where appropriate.

You can expect us to be open and transparent about our use of algorithms. We use tools and processes to ensure that we always consider privacy, ethics, and human rights in our algorithm design.

You can learn more about our use of algorithms by reading:

• How we use algorithms to improve customer experience
• How we use predictive analytics to improve our client’s experience

We use an algorithm to automatically approve around 90% of ACC claims. By using an algorithm, we get quicker and more consistent decisions. 

Our algorithm can only approve claims. Claims that it can’t approve are always referred to a staff member.

We may use your personal information to carry out activities that improve our services, such as

• training our staff
• research
• developing policy and informing changes to the way we work.

Recording your calls with us

We know your communication with us is particularly sensitive. We record a portion of your phone calls for training, research and service improvement. Our staff may also listen in to your calls live, for the same purposes. While the audio recording of your conversation may be used to ensure that our customer service is high quality, it will not impact your claim. Instead, we use written notes about your call when working on your claim. We also protect your privacy by:

• carefully managing who can access these audio recordings
• ensuring that they are deleted when they are no longer needed (for example, after 90 days for our Client Contact Centre).

Using generative artificial intelligence (AI)

Generative AI is a rapidly developing area of technology, with transformative potential for the public sector. We use and are actively exploring generative AI tools to enhance the quality of our service. Your personal information and health information may be processed by these systems.

When using generative AI tools to fulfil our functions under the Act, we implement appropriate safeguards to ensure we treat your personal information with respect. Our staff are responsible for checking any generative AI responses for accuracy and appropriateness before we use them for decision making. This means, similar to our handling of algorithms, a human is always involved before making a decision about you.

When exploring generative AI tools, we have policies and processes to ensure that we consider their use from relevant perspectives including privacy, ethics, and human rights.

Learn more about our use of generative AI

We may use your information for other lawful purposes connected with our functions and activities under the Act. For example:

• if you provide services to injured people we’re supporting, we may use your information to connect you with them.
• if you apply for a job at ACC, we may use your information to decide whether you are the right fit for the role.
• our Integrity Services may use your information to prevent, detect and respond to potential fraud, waste, and abuse of the ACC Scheme. You can read our Integrity Services Transparency Statement for more information about this.
  
  Integrity Services Transparency Statement

Our handling of this information is guided by the same legal requirements and principles as when we help people recover from an injury. Unless otherwise permitted by law, this means we will only use your information for the reason we collected it and will anonymise it where practicable and possible.

When helping you recover from an injury, we may need to share your information with other agencies (for example, treatment providers like physiotherapists). We do this to:

• deliver support to you during and after your injury
• ensure we make appropriate decisions about your claim.

When we share your information, you can expect us to only include relevant information. Unless otherwise permissible, we will let you know beforehand, giving you the opportunity to raise any concerns.

Rocky has had a serious injury. We organise an assessment to decide whether their house needs any modifications, such as installing a ramp.

After talking with Rocky about this, we provide their injury information to the assessor. This gives the assessor the context they need to understand how to best support Rocky.

We also share information with other government agencies to ensure you’re receiving the correct support (for example, to make sure you aren’t at risk of incurring debt). Some of these information sharing arrangements are monitored by the Office of the Privacy Commissioner, to ensure that we comply with our obligations. 

If you’re injured at work, we share some information about your claim with your employer. This allows them to review the decision about where the injury happened. We’ll let them know:

• the date of your injury
• how it happened
• the description of the injury according to your claim form.

Some large employers manage these claims themselves. When this happens, we pass the claim to them, and we won’t be involved unless needed.

When you’re injured outside of work, we don’t share information with your employer unless it relates to your return to work. For example, we may share information if you will need further support when you return to work.

Ash got a concussion and broke their wrist playing softball on the weekend. They need time off work. When they return to work, they’ll also require special equipment to do their job.

They can only work part-time to begin with. We work with Ash and their employer to make sure they get the appropriate equipment. 

We share your information with other government agencies where the law allows or requires us to.

For example, if there has been a family violence incident, we may share relevant information about your previous injuries. Involved agencies may use this to assess the level of risk to your safety or the safety of others.

Oranga Tamariki has concerns about Noah’s wellbeing. They contact us and ask for any relevant information we hold about Noah and their parents.

We have records of two recent injuries to Noah which may be relevant, and we are also managing their parent’s claim for a serious head injury. The law requires us to share this information with Oranga Tamariki so they can consider it as part of their investigation. 

If your information was collected for a reason other than supporting you with an injury, we may also be allowed or required to share your information. For example, the law requires us to share information with relevant government agencies when a medical professional may present a risk to the public.

We’re committed to being transparent with you about how we share your information. We regularly release reports showing the information we collect and share with other government agencies. You can find this information, along with other ACC reports, by exploring our corporate documents.  

We may share your information for other lawful purposes connected with our functions and activities under the Act. This includes activities like collecting levies and working with researchers.

Our handling of this information is guided by the same legal requirements and principles as when we help people recover from an injury. Unless otherwise permitted by law, this means we will only share your information for the reason we collected it and will anonymise it where practicable and possible.

Collecting levies

We may share information with debt collection agencies if we cannot collect the levy you owe. We have a process we follow to attempt to collect your levy before we approach a debt collection agency. This process includes attempting to contact you and sending you letters.

Working with researchers

We may share information with other agencies for statistical and research purposes. Where possible, this information will not identify individuals. 
We have our own ethics staff and an Ethics Panel who review projects to safeguard the rights, interests and safety of people who have given their information to us.

A university approaches us asking for certain claim information to help with a research project. Because of the type of information requested, we identify that our Ethics Panel should review the project. They help ensure that any information we provide is appropriate. 

You have the right to access information that we hold about you. This can range from a simple request which we can answer over the phone, to providing a copy of all the information that we hold about you. Your information might relate to your injuries or levies. It might also relate to other times you have engaged with us, such as if you were previously employed by ACC.

You can request your information via our online tool

Responding to your request

If you’re asking for your full claim file or another complex set of information, it may take us time to get it ready for you. We will respond with a decision within 20 working days. If your request is particularly large or complicated, we may get in touch about extending the timeframe.

We’ll talk to you about how you would like to have your information sent to you (for example, whether you would like a digital or hard copy). We won’t charge you for this service.

Withholding your information

In some circumstances, there will be reasons why we can’t release all the information you request. For example, if a family member’s sensitive information appears in your file, it may be withheld to protect their privacy. Sometimes we won’t be able to provide your information because we have lawfully disposed of it. If we withhold any information, we’ll tell you the reason why and the legal basis for doing so.

If you have concerns about our response, you can contact the Office of the Privacy Commissioner for help. 

Office of the Privacy Commissioner

You have the right to ask us to correct to your information. If you believe that we hold information about you which is out of date or incorrect, please let us know. A straightforward change can usually be done immediately, whereas complicated requests may take longer.

Responding to your request

We will respond with a decision within 20 working days. If your request is particularly large or complicated, we may get in touch about extending the timeframe.

Statements of correction

Sometimes we are unable to make changes to your information (for example, if the information you want to correct is someone else’s opinion). If this is the case, we will inform you of our decision and let you know that we can attach a copy of the changes you want to make to your file. This is called a statement of correction. This will always be read alongside the information you have asked us to correct.

If you have concerns about our response, you can contact the Office of the Privacy Commissioner for help.

Office of the Privacy Commissioner

Jack doesn’t agree with their doctor’s report and asks for some changes to be made. We approach the doctor, but they won’t change what they wrote.

In this situation, we can attach Jack’s corrections. We ask them to write a short statement about what they believe the information should be. We attach this statement to the front of the doctor’s report, so they’re always read together. 

An assessor has recently received a copy of the original report for an upcoming appointment, and we include a copy of Jack’s statement of correction.

We design our processes to keep your information safe. We:

• protect it from unauthorised access
• regularly backup the information we hold
• use secure systems and technology
• train our people to securely handle your information.

All our staff must follow our Code of Conduct. It requires us to be responsible for the security and privacy of the information we’ve been trusted with. We regularly review staff access to our systems and information and assess whether they still need access.

To learn more about how and when our staff access your information, you can read this article.

Protecting our clients’ privacy.

If your injury is particularly sensitive, we call your claim a ‘sensitive claim’ and use additional protections to make sure your information is kept confidential.

Learn more about how we protect sensitive claims.

We recognise that ACC supports many people across New Zealand, and some people we support may know members of our staff. To ensure we are fair and accountable, our Code of Conduct has rules to manage conflicts of interest like this when they arise.

Miro has had an injury that they feel ashamed of. Their relative, Kerry, works at ACC and Miro is worried that their whānau will find out about the claim. Kerry works in human resources, so is not able to see anyone’s injury information. Kerry isn’t given access to the systems that hold this information because they don’t need it to do their job. 

Like other government agencies, we often store our data using cloud services. This is consistent with the New Zealand government’s Cloud First policy.

This policy acknowledges that cloud storage can improve efficiency and security, while offering increased resilience in case of natural disasters. For most of our information held by cloud services, we use datacentres in Australia owned by Microsoft and Amazon. We use contractual arrangements to protect your information while it is stored, ensuring that it remains under our control.

We keep your information as long as is required under our governing legislation, such as the Public Records Act 2005. We keep different types of information for different lengths of time. For example, we are required to keep your health information for 75 years from the date it was last used. This helps us consider your past claims when assessing your current injury. It also means we can be accountable for the decisions we make.

When your information is no longer required, we dispose of it securely.

You can also ask us to delete your information at any time. If you ask us to delete information we are legally required to keep, we may need to refuse your request. However, you can expect us to work with you where practicable to minimise the information we hold. For example, we may be able to remove irrelevant information that isn’t needed to manage your claim.

From time to time, we may receive information that is not relevant to our work. Where reasonably practicable and legally permissible, we will return or destroy this information.