A judge has overturned ACC's policy of cutting off accident claimants' compensation if they refuse to approve widespread gathering of information about themselves.
The Accident Compensation Corporation's actions were "without basis and wrong in law", District Court Judge Grant Powell says in two just-released verdicts.
The decisions come two and a half years after ACC's mass privacy breach.
ACC said, when asked if it was following the judge's advice to re-write the ACC167 form, that the form was "not illegal". ACC was "amending the relevant processes to address the matters raised by the court".
A spokeswoman refused to answer questions about the number of claimants affected and if its initial claim form ACC45 filled in by accident victims would have to be re-written.
ACC argued prior to the court cases that the blanket consent form provided "administrative efficiency".
Claimants Denise Powell, a part-time university lecturer who had a back injury, and "K" a sexual abuse victim and brain injury claimant whose name is suppressed, appealed against ACC cutting off their entitlements after they repeatedly refused to sign the ACC167 form.
Their entitlements were reinstated after they eventually signed but they said they only signed because they were put under duress.
Both claimants previously had arrangements with ACC to give it consent to obtain specific information relating to their claims case-by-case.
This system ran for several years until 2009 and 2010 when case managers indicated the corporation could no longer accept those arrangements and they would have to sign the form or lose their entitlements.
But Judge Powell said the ACC167 form was much broader in its consent to gather information than the requirement in the Accident Compensation Act that claimants approve the release of "medical and other records that may be relevant to the claim".
ACC was justified to seek a wide range of information and could request consent for this from claimants. But it could use section 117/3 of the act to cut off entitlements for refusing consent only for the "medical and other records" specified in the act, and not for the wider information search that ACC167 enabled.
The judge cites, as an example of the kind of wider information sought, Dr Powell's ACC case manager asking her GP if the medical certificates he wrote accurately reflected the amount of work she was capable of doing.
"... it would appear," the case manager wrote, "that the hours both paid and unpaid combined could almost exceed a full week's work. If you do not agree will you please provide your reasons."
Dr Powell, a spokeswoman for an ACC claimants' support group, told the Herald the case manager's letter was inappropriate and after a complaint she was assigned to a different case manager.
"It was her getting nasty, and it was the process - the form - that allowed her to do that."
Before her entitlements were briefly suspended, she told ACC its request for a blanket consent for the life of her claim "disregards my fundamental human rights to exercise control over my health and personal information. If that had been Parliament's intention, it would have said so. It has not."
"K" told the corporation he was concerned about its use or possible misuse of private information including details about his sensitive claim with ACC.
Warren Forster, the advocate for both claimants, said there had been a "long line" of failed appeals against having ACC payments stopped because of refusing to sign the ACC167 form, but there had not been full legal argument on the issue before the K and Powell cases.
ACC is setting up a dedicated phone line for clients with historical consent concerns from today - it can be reached at 0800 745 254.