A complainant alleged that a consent form used by ACC to collect personal information breached the Privacy Act. The complainant believed that the consent form was 'too wide' for ACC's purposes of ascertaining or assessing compensation entitlement.

I declined to investigate the complaint because the complaint did not appear to involve an interference with the complainant's privacy. I noted that ACC has a statutory basis for collecting information about claimants.

Section 64 of the Accident Rehabilitation and Compensation Insurance Act 1992 (ARCI Act) (since repealed) requires every person who claims for or receives any rehabilitation, compensation, grant or allowance, when reasonably required to do so by ACC, to authorise ACC to obtain medical and other records which are or may be relevant to the claim.

Where the collection of personal information is required or authorised by law, that collection will not breach the collection rules set out in the Health Information Privacy Code (Privacy Act 1993, section 7(4)). The complainant was required by the ARCI Act to authorise the collection of relevant information, so ACC would not breach the collection rules when collecting information as a result of that authorisation.

Despite this, the complainant was concerned that the consent form would allow ACC to collect any information, not just information relevant to the claim. I noted that, although the words on the consent form seemed wide, ACC was bound by rule 1 of the Health Information Privacy Code, which provides that health information must not be collected by any health agency unless:

• it is collected for a lawful purpose connected with the function or activity of the health agency; and
• the collection is necessary for that purpose.

If ACC collected information other than for a lawful purpose connected with its functions and activities (as set out in the ARCI Act) that collection would breach rule 1. Similarly, collecting that information was not necessary for those purposes would also breach rule 1. Signing the consent form does not preclude claimants from making a complaint to the Privacy Commissioner if they consider that ACC has collected or disclosed personal information in circumstances that appear to breach the Privacy Act.

Having raised these points with the complainant, I declined to investigate further.

Indexing terms: Collection of personal information - ACC - Consent forms - Effect of consent form on compliance with collection rules - Accident Rehabilitation and Compensation Insurance Act 1992, s 64 - Privacy Act 1993, s 7(4) - Health Information Privacy Code 1994, rule 1

June 2001