Sensitive information about another person (a third party) relevant to a dispute can be collected with the consent of the other person. It can also be collected without consent if it is necessary for the establishment, exercise or defence of a legal and equitable claim.

Legal claims refer to rights arising out of common law principles or rights conferred or obligations imposed by legislation. Equitable claims refer to claims that arise by virtue of the principles of equity. For example, a claim under an insurance policy becomes a legal claim when the event insured against occurs.

This means sensitive information can be collected if that information is necessary in some way to set up, use, act on, or challenge the existence or nature of such a claim. An example would be where an individual complains about an insurance company's response to his or her insurance claim. A dispute resolution scheme would be able, in most circumstances, to collect sensitive information about another person if it is both relevant to the substance of a complaint about the insurance claim, and necessary to resolve the dispute about that claim. More information on collection of sensitive information obligations can be found at the Guidelines to the National Privacy Principles.