ACC uses the sort of form businesses use to collect and disclose personal information (eg bank loan applications and for loyalty cards like Fly-buys). ACC lost two appeals this month, around decisions to stop cover as ACC clients wouldn’t sign information waivers. With Big Data and other developments, expect greater focus for business (and for ACC) on whether a customer signing a form including authorisation to use and disclose information is legally sufficient.
The ACC appeals and how they relate to business
The appeals1 were against its decisions to terminate cover as the injured people refused to sign a standard claims form, authorising wide use and disclosure of personal information. This is the sort of wording you often see in standard forms. For example, when applying for a bank loan or credit card, the lender requires the customer to authorise activities such as checking with debt reporting agencies and providing similar information to third parties. And a primary purpose of loyalty cards such as Fly-buys is to allow use of heaps of information to market better to customers: Big Data is producing a major upsurge in that regard: see our article, Big Data in business – father learns of teenage daughter’s pregnancy from retail chain.2
What happened on the appeals?
ACC relied on earlier Court decisions vindicating use of these forms for ACC clients. Said the judge in these two new cases, that was because the client signed the form consenting to the wider use and disclosure of the information. In the new cases, the clients refused to sign the form, and had their cover terminated as a result. The clients hadn’t signed up and authorised use and disclosure by ACC, so they hadn’t waived any rights they had.
The court said that the form sought wider use and disclosure rights than permitted by the ACC legislation, and so a refusal to sign the authorisation was not a legal ground to end the cover.
All that makes sense. But:
- If an ACC client signs the bottom of a claims form which contains the authorisation wording, does that amount to legally effective consent? After all, 99% of accident victims will just sign the form, without worrying about this and without even reading the authorisation wording. They won’t refuse to sign, as happened on the two appeals.
- If a business gets a similar form signed, will that be legally effective consent?
This raises a few contract and tort issues but the issues are neatly highlighted by looking at the Privacy Act considerations. The use and disclosure of personal information about an individual is confined by the Act. But those confines can often be overridden “the use [and disclosure] of the information for that other purpose is authorised” by the individual.3
Just because someone signs a form which includes a privacy waiver doesn’t automatically mean that the waiver is binding. Say that a waiver beyond what is necessary lurks deep in plenty of printed words, and the person just signed at the bottom. This might not constitute genuinely being “authorised” by the individual and so he or she hasn’t waived the obligations. Words like “informed consent” are often used in this space.
Someone who signs something that they haven’t turned their mind to may not be giving “informed consent”. The “informed consent” overly simplifies what is involved here. By analogy with contract law, sometimes someone will give consent when signing a form, even though they haven’t ascertained what is in the form being signed. What constitutes “authorisation” is yet to be fully thrashed out. This will however vary according to the specific circumstances, such as the gravity of the authorisation being sought, whether it is more routine, more sensitive and so on. We think that there would be closer focus on entities in a position of “take it or leave it” power such as ACC. When an entity such as ACC, with its largely monopoly powers, says, “we will only cover you if you sign up to our claim form as it is”, is that really sufficient consent when the individual has no realistic option? Wise use of Privacy Commissioner and Human Rights Tribunal powers may help curtail any unreasonable use of such State powers. It doesn’t automatically follow that just because an ACC customer has signed a claims form, that the authorisation has been legally granted.
Back to businesses
With trends such as Big Data and increased focus on privacy issues, expect greater focus on whether customer buy-in in forms are adequate to meet Privacy Act and other obligations. Just because a customer signs a form including authorisation, it does not automatically follow he or she has legally consented. The more sensitive the information, the more likely greater buy-in is required.