Our privacy notice

If you’re injured, you and your treatment provider complete an ACC claim form. This may include: 

• biographic information like your name and date of birth
• contact information like your address, phone numbers and email address
• details about your injury
• your employer’s information
• information about how the injury affects your ability to work.

If your injury is more complex, we may ask for more information from you and others.

You can talk to us if you don’t want us to collect your personal information. However, under the Accident Compensation Act 2001, you must provide information that is relevant to your claim when we reasonably require you to provide it. If you unreasonably refuse to provide relevant personal information, this may affect your entitlements. 

When you are injured, we may need to obtain information about you from a third party, such as:

• your GP
• your other medical professionals or rehabilitation providers
• your employer.

If ACC determines that these third parties hold information that is necessary or relevant for the above-listed purposes, including our functions and activities under the Accident Compensation Act 2001, we will collect this information from them.

Jane makes a claim for tennis elbow and believes this has occurred through their work tasks. Before we make a decision to cover Jane’s claim, we’ll ask them if we can collect further information from their doctor and their employer. This is because tennis elbow is a gradually occurring condition and we can only cover this type of injury when it has occurred as a result of their paid employment.  

Some large employers manage at work injury claims themselves. In these cases, we pass the claim and your information to your employer or their nominated third-party administrator, and we won’t be involved unless needed. These employers will transfer information to ACC in certain circumstances to enable us to meet our functions and activities. This includes when an employer-managed claim is still active after five years.

If your claim is considered by an independent reviewer, dispute resolution practitioner, tribunal, or court, ACC will also collect information from them that is necessary or relevant to the above-listed purposes.

ACC may also collect your personal and health information from other agencies, including:

• the New Zealand Police and Oranga Tamariki in certain circumstances, such as where we have safety or welfare concerns
• other public sector agencies, including Inland Revenue, the Department of Corrections and the Ministry of Social Development.

Some of these information sharing arrangements are monitored by the Office of the Privacy Commissioner, to ensure that we comply with our obligations. You can learn more about these arrangements in the Sharing your information section of this privacy notice.

You can talk to us if you don’t want us to collect your personal information from other agencies. However, under the Accident Compensation Act 2001, you must authorise us to collect information that is relevant to your claim when we reasonably require you to do so. If you unreasonably refuse to authorise us to collect this information, this may affect your entitlements.

When we collect information about you from others, you have the right to request access to and correction of that information.

We may collect information from you or others for other lawful purposes connected with our functions and activities under the Accident Compensation Act 2001. This means we may collect your personal information in contexts other than helping you recover from an injury, such as:

• when you pay levies
• when you provide services to injured people we’re supporting
• when you apply to work, and work, at ACC
• for fraud prevention and investigation.

We’ll only collect the information we need and will collect it directly from you where possible.

Levies

When you pay levies, we may collect your personal information from you and from other public sector agencies. For example, we receive information from Inland Revenue to help us work out which self-employed people or businesses need to pay levies.

Our information sharing arrangement with Inland Revenue is monitored by the Office of the Privacy Commissioner, to ensure that we comply with our obligations. You can learn more about this arrangement in the Sharing your information section of this privacy notice.

If we do not hold your current address and cannot collect the levy you owe, we may work with debt collection agencies. If a debt collection agency identifies your address, we will collect this address from them.

We collect this information to meet our legal obligations and to ensure levy payers are correctly identified. 

Service providers

We may also collect your information from third-party organisations we have formal agreements with, including injury prevention partners.

If you help us by providing services to the injured people we’re supporting or by providing corporate services, we may collect information about you to establish and maintain our working relationship.

We may also receive complaints about you from clients or other health sector agencies, including the Health and Disability Commissioner and other regulatory authorities. Unless otherwise permitted by law, we will let you know when we receive a complaint about you.

Employment

If you apply to work at ACC, we will collect information about you to determine your suitability for the role. If they hold information relevant to this purpose, we will also collect information about you from other people and agencies. Unless otherwise permitted by law, we will ask for your permission before collecting your information from these people and agencies including:

• your former or current employers, including other public sector agencies
• your referees
• credit checking agencies (such as Equifax).

If you work at ACC, we will collect information about you relevant to your employment. We will collect information from public sector agencies to determine your relevant payroll deductions. These agencies include Inland Revenue, the Ministry of Social Development and the Ministry of Justice. If ACC needs your health information for an employment-related process, we will collect information from your GP or health provider. We will ask for your consent before doing so.

Fraud prevention and investigation

We may collect information to help assess a claimant’s eligibility for entitlements under the Accident Compensation Act 2001. We may also collect information to prevent, detect, and respond to potential fraud, misuse, or waste.

When we collect information for fraud prevention and investigation, we do so lawfully, appropriately, and in line with our policies and procedures. 
You can learn more about how our Fraud Prevention and Investigations team handle your information.  

Fraud prevention transparency statement

Voice verification

When you call our phone lines and use our voice verification service, we collect your biometric information. This helps us confirm your identity and reduce the risk of unauthorised access to your information. You can learn more about how we handle your biometric information.

Voice verification and your privacy

Recording your calls with us

We record a portion of your phone calls for training, research, and service improvement. Our staff may also listen in to your calls live, for the same purposes. While the audio recording of your conversation may be used to ensure that our customer service is high quality, it will not impact your claim.

We also protect your privacy by:

• carefully managing who can access these audio recordings
• ensuring that they are deleted when they are no longer needed (for example, after 90 days for our Client Contact Centre).

ACC websites

When you visit our websites, we collect information about your site usage. You can learn more about how our websites handle your personal information.

Privacy when you use our site 

Tracking Pixels

We use a range of digital tools to help us understand how people engage with our emails. This may include technology such as pixels, or pixel tracking, which can collect information such as:

• your IP address
• the general location associated with your device
• the time an email was opened.

We use this information to understand whether our communications and services are effective, to improve how we deliver information, and to ensure our systems are functioning as expected.  

Social Media

When you engage with us on social media, we ask that you do not share any of your own, or anyone else’s, private information. Instead, please contact us directly.

We may collect your personal information in certain circumstances, such as when you choose to send us a direct message. Remember, the social media service you use may also have access to the information you share with us, and this information will be governed by that service’s privacy policy.

You can learn more about our approach to social media by reading our social media terms and conditions.

Social media terms and conditions 

If you’re injured, we’ll use your information to assess your claim and decide what support we’re able to provide. This may include funding your appointments, transport, home help, and medication.

We may use information we already hold about you to assess your new claims. We only use this information where we believe it is relevant and necessary, or where the law permits us.

Bella fractured their back in 1998. Recently, their back has been playing up and they think this old injury might be the cause. By comparing previous scans to their current results, we can see that the new injury is linked to the old one, and we are able to provide the right support.

We may use your information for other lawful purposes connected with our functions and activities under the Accident Compensation Act 2001. For example, if you:

• pay levies, we may use your information to determine that you are paying the correct amount
• provide services to injured people we’re supporting, we may use your information to connect you with them
• apply for a job at ACC, we may use your information to decide whether you are the right fit for the role.

Our Fraud Prevention and Investigations team may also use your information to prevent, detect and respond to potential fraud, waste, and abuse of the ACC Scheme. You can read Fraud Prevention Statement for more information about this.

Fraud prevention transparency statement

Our handling of this information is guided by the same legal requirements and principles as when we help people recover from an injury. Unless otherwise permitted by law, this means we will only use your information for the reason we collected it and will anonymise it where practicable and possible.

We may use your personal information to carry out activities that improve our services, such as

• training our staff
• research
• developing policy and informing changes to the way we work

We use artificial intelligence (AI) to support and improve the quality and efficiency of our services. Your personal information and health information may be processed by these systems. When using these systems, we are careful to keep human oversight where appropriate.

You can expect us to be open and transparent about our use of AI. We use tools and processes to ensure that we always consider privacy, ethics, and human rights in our algorithm design.

You can learn more about our use of AI by reading:

• How we use algorithms to improve customer experience
• How we use predictive analytics to improve our client’s experience
• Generative Artificial Intelligence (Gen AI)

When using AI tools whether algorithms, predictive analytics, or generative AI, to fulfil our functions, we implement appropriate safeguards to ensure we treat your personal information with respect.

When helping you recover from an injury, we may need to share your information with other agencies (for example, treatment providers like physiotherapists). We do this to:

• deliver support to you during and after your injury
• ensure we make appropriate decisions about your claim.

When we share your information, you can expect us to only include relevant information. Unless otherwise permissible, we will let you know beforehand, giving you the opportunity to raise any concerns.

Rocky has had a serious injury. We organise an assessment to decide whether their house needs any modifications, such as installing a ramp.

After talking with Rocky about this, we provide their injury information to the assessor. This gives the assessor the context they need to understand how to best support Rocky.

We also share information with other government agencies to ensure you’re receiving the correct support (for example, to make sure you aren’t at risk of incurring debt). Some of these information sharing arrangements are monitored by the Office of the Privacy Commissioner, to ensure that we comply with our obligations. 

If you’re injured at work, we share some information about your claim with your employer. This allows them to review the decision about where the injury happened to support us to have an accurate and shared understanding of your claim. We’ll let them know:

• the date of your injury
• how it happened
• the description of the injury according to your claim form.

Some large employers manage at work injury claims themselves. In these cases, we pass the claim and your information to your employer or their nominated third-party administrator, and we won’t be involved unless needed.
When you’re injured outside of work, we don’t share information with your employer unless it relates to your return to work. For example, we may share information if you will need further support when you return to work.

Ash got a concussion and broke their wrist playing softball on the weekend. They need time off work. When they return to work, they’ll also require special equipment to do their job. They can only work part-time to begin with. We work with Ash and their employer to make sure they get the appropriate equipment.  

We share your information with other public sector agencies where the law allows or requires us to. We do this regularly in some cases, for example, to ensure you’re receiving the correct support and aren’t at risk of incurring debt.

We may also share information with public sector agencies in specific circumstances. For example, if there has been a family violence incident, we may share relevant information with the public sector agencies involved to assess the level of risk to your safety or the safety of others.

Oranga Tamariki has concerns about Noah’s wellbeing. They contact us and ask for any relevant information we hold about Noah and their parents. 

We have records of two recent injuries to Noah which may be relevant, and we are also managing their parents’ claim for a serious head injury. The law requires us to share this information with Oranga Tamariki so they can consider it as part of their investigation.

If your information was collected for a reason other than supporting you with an injury, we may also be allowed or required to share your information. For example, the law requires us to share information with relevant public sector agencies when a medical professional may present a risk to the public.

Some of our regular cross-government information sharing arrangements are authorised by Information Matching Agreements (IMAs) and Approved Information Sharing Agreements (AISAs). Some are monitored by the Office of the Privacy Commissioner, to ensure that we comply with our obligations.

ACC are party to three AISAs: 

• Privacy (Information Sharing Agreement Facilitating Customer Nominated Services) Order 2020
•   Privacy (Information Sharing Agreement between New Zealand Gang Intelligence Centre Agencies) Order 2018
• Privacy (Information Sharing Agreement Facilitating Services for Veterans and Other Claimants) Order 2024

ACC are party to three IMAs:

• IR / ACC Compensation and Levies (Accident Compensation Act 2001 s246; Tax Administration Act 1994 Schedule 7 cl 41)
• Corrections / ACC Prisoners (Accident Compensation Act 2001 s280)
• ACC / MSD Benefits Eligibility (Accident Compensation Act 2001 s281)
  You can read about IMAs on the Office of the Privacy Commissioner’s website.

Office of the Privacy Commissioner | Information matching/Data matching

We’re committed to being transparent with you about how we share your information. We regularly release reports, strategic plans, and agreements with the government, for example the independent review into care of personal information.  You can find this information, along with other ACC reports, by exploring our corporate documents.

We may share your information to fulfil our other lawful purposes connected with our functions and activities under the Accident Compensation Act 2001, or for other lawful purposes. This includes activities like collecting levies and working with researchers.

Our sharing of this information is guided by the same legal requirements and principles as when we help people recover from an injury. Unless otherwise permitted by law, this means we will only share your information for the reason we collected it and will anonymise it where practicable and possible.

Third-party Partnership

We may share information with third-party organisations we have formal agreements with, including:

• Injury prevention partners
• Statistics New Zealand

Collecting levies

We may share information with debt collection agencies if we cannot collect the levy you owe. We have a process we follow to attempt to collect your levy before we approach a debt collection agency. This process includes attempting to contact you and sending you letters.

Working with researchers

We may share information with other agencies for statistical and research purposes. Where possible, this information will not identify individuals. We have our own ethics staff and an Ethics Panel who review projects to safeguard the rights, interests and safety of people who have given their information to us.

A university approaches us asking for certain claim information to help with a research project. Because of the type of information requested, we identify that our Ethics Panel should review the project. They help ensure that any information we provide is appropriate.  

You have the right to access the personal information that we hold about you. This includes information we have collected directly from you, as well as information we have collected from others. Your information might relate to your injuries or levies. It might also relate to other times you have engaged with us, such as if you were previously employed by ACC.

If you would like someone else to act on your behalf, and access the information we hold about you, you can give them an Authority to Act (ATA). This allows them to talk to us including about your claim - either a single claim or all your claims – and update details such as your bank account or contact information. The authority stays in place until you tell ACC to remove it. 
For claims relating to a child, we rely on their parent, legal guardian, or a court appointed guardian to act on their behalf.

Access to your information can range from a simple request which we can answer over the phone, to providing a copy of all the information that we hold about you. 

You can request your information via our online tool

Responding to your access request

If you’re asking for your full claim file or another sizable set of information, it may take us time to get it ready for you. We will respond with a decision on your access request within 20 working days. If your request is particularly large or complicated, we may get in touch about extending the timeframe.

We’ll talk to you about how you would like to have your information sent to you (for example, whether you would like a digital or hard copy). We won’t charge you for this service.

Withholding your information

In some circumstances, there will be reasons why we can’t release all the personal information you request. For example, information about a family member or other person may appear in your file because it is relevant to your claim (such as support arrangements or information provided as part of the claims process). Where this occurs, we may withhold that information to protect the other persons privacy. Sometimes we won’t be able to provide your information because we have lawfully disposed of it.

If we withhold any information, we’ll tell you the reason why and the legal basis for doing so. If you have concerns about our response, you can contact the Office of the Privacy Commissioner. 

Office of the Privacy Commissioner

You have the right to ask us to correct your personal information. If you believe that we hold information about you which is out of date or incorrect, please let us know. A straightforward change, like a change in your contact details, can usually be made immediately. Other requests may take longer.

Responding to your correction request

Where we do not immediately correct your information, we will respond with a decision on your correction request within 20 working days. If your request is particularly large or complicated, we may get in touch about extending the timeframe.

Statements of correction

Sometimes we are unable to make corrections to your personal information (for example, if the information you want to correct is someone else’s opinion). If this is the case, we will inform you of our decision. We will let you know that we can attach a copy of the changes you want to make to your file. This is called a statement of correction. This can be read alongside the information you have asked us to correct.

If you have concerns about our response, you should contact out Privacy Officer.

Office of the Privacy Commissioner

Jack doesn’t agree with their doctor’s report and asks for some changes to be made. We approach the doctor, but they won’t change what they wrote. 

In this situation, we can attach Jack’s corrections. We ask them to write a short statement about what they believe the information should be. We attach this statement to the front of the doctor’s report, so they’re always read together.

An assessor has recently received a copy of the original report for an upcoming appointment, and we include a copy of Jack’s statement of correction.

We design our processes to keep your personal information safe. We:

• protect it from unauthorised access
• regularly backup the information we hold
• use secure systems and technology
• train our people to securely handle your information

All our staff must follow our Code of Conduct. It requires us to be responsible for the security and privacy of the information we’ve been trusted with. We regularly review staff access to our systems and information and assess whether they still need access.

To learn more about how and when our staff access your information, you can read this article.

Protecting our client’s privacy

If your injury is particularly sensitive, we call your claim a ‘sensitive claim’ and use additional protections to protect your privacy.

Learn more about how we protect sensitive claims

We recognise that ACC supports many people across New Zealand, and some people we support may know members of our staff. To ensure we are fair and accountable, our Code of Conduct has rules to manage conflicts of interest like this when they arise.

Miro has had an injury that they feel ashamed of. Their relative, Kerry, works at ACC and Miro is worried that they will find out about the claim. Kerry works in human resources. They cannot see anyone’s injury information. Kerry isn’t given access to the systems that hold this information because they don’t need it to do their job.  

Like other public sector agencies, we often store our data using cloud services. This is consistent with the New Zealand Government’s Cloud First policy.

Information about public cloud services

The Cloud First policy acknowledges that cloud storage can improve efficiency and security, while offering increased resilience in case of natural disasters. Most of our information held by cloud services, uses data centres in Australia owned by Microsoft and Amazon. We use contractual arrangements to protect your information while it is stored, ensuring that it remains under our control.

We keep your personal information as long as is required under relevant legislation, such as the Public Records Act 2005, and section 66 of the Accident Compensation Act 2001. We keep different types of information for different lengths of time. This helps us consider your past claims when assessing your current injury and ensures accountability and transparency by ensuring our decisions can be reviewed, explained, and, where necessary, reassessed.

When your information is no longer required, we dispose of it securely.

You can also ask us to delete your information at any time. If you ask us to delete information, we are legally required to keep, we may need to refuse your request. However, you can expect us to work with you where practicable to minimise the information we hold. For example, we may be able to remove information that isn’t needed to manage your claim.

From time to time, we may receive information that is not relevant to our work. Where reasonably practicable and legally permissible, we will return or destroy this information.