Wanting more money from ACC for privacy breach

The SST reports:

Sex abuse survivors are planning to sue ACC to force a significantly boosted payout for breaching their privacy in the ongoing Bronwyn Pullar whistleblower saga.

ACC sent apology letters in June to sensitive-claims clients and offered to pay them $250 if they agreed to stay silent, after one of New Zealand’s biggest privacy breaches in August last year.

The “insulting” offer came after ACC mistakenly released the names and details of 6500 claimants, including 250 sensitive-claims clients who are victims of sexual abuse and violent crimes, to claimant Pullar.

Wellington lawyer John Miller, a specialist in taking on ACC, said more than 100 claimants affected by the massive Pullar breach had approached him to take the case. He said those wanting to pursue ACC were sensitive claimants who generally had long simmering feelings of being poorly treated by the ACC system.

Although a claimant with a normal injury could shrug off the privacy breach, for sensitive claimants “this is the last straw”.

“It’s a corrosive environment they are in with ACC, frankly. The people I have spoken to, they are insulted by $250, it is a derisory amount for the torment they have gone through.”

Worse was ACC’s requirement that claimants sign a confidentially agreement if they took the payment. “They feel they are being told ‘now go away and shut up and sign a document to say you are going to shut up forever more’.”

He said that although technically class action claims were not possible in New Zealand, the process worked with one claim taken and if it won it set a precedent. ACC would be asked to settle with everyone, or face losing case after case with legal costs compounding the settlement payouts.

He said the process had worked before and usually ACC saw sense.

Miller would not be drawn on what level of compensation would satisfy claimants, but said past privacy breaches had won payouts of anything from $2000 to $40,000. It depended on the severity of the consequences.

In 2003 he said ACC paid $8000 for sending a man’s earnings details to his wife, resulting in divorce because he had kept his income secret from her.

A large amount is appropriate when there has been significant harm from the privacy breach.

But bearing in mind it is employees, employers and motorists who will effectively pay for any compensation, let us look at the harm done in this breach.

One person in Auckland, a stranger to all these people, was sent a spreadsheet with some details about them. The report into the breach details what this info was:

• Client Name
• Claim Number
• Branch handling claim
• Review number

No information beyond that was disclosed. So yes it did breach privacy by revealing they were a client of ACC, they they were having their claim reviewed, and which branch was handling their claim – which can reveal it was a sensitive claim.

This is not inconsequential, but neither it is in any way detailed. And this was a breach not on a website, but to one person.

I’m not convinced the offers of $250 is inappropriate.