Protections when making a PID
The Public Interest Disclosures Act 1994 (PID Act) encourages NSW public officials to report serious wrongdoing — such as corrupt conduct or maladministration — and provides them with certain legal protections when they do.
For definitions of the types of wrongdoing covered under the PID Act, see Assessing whether a report is a PID.
Under the PID Act, public authorities must keep the identity of a reporter of wrongdoing confidential – where practical and appropriate. This may involve keeping both the fact that a public interest disclosure (PID) has been made and the substance of the report confidential.
PID Act protections (outlined in Part 3 of the Act) are in addition to work health and safety obligations, any general or workplace obligations of confidentiality, and the common law duty of care.
Under the PID Act (section 22), information that might identify or tend to identify a person who has made a PID must not be disclosed unless:
- the person consents in writing to the disclosure of the information
- it is generally known that the person has made a PID as they have voluntarily identified themselves other than by making the PID
- it is essential to disclose the information to satisfy the principles of natural justice
- it is necessary for the information to be disclosed to allow for the matter to be effectively investigated
- it is otherwise in the public interest to do so.
If you consider that confidentiality cannot be maintained for one of these reasons, it is good practice to discuss this with the person who made the disclosure to inform them of your proposed course of action and the reasons why you consider this to be appropriate.
If the reporter's identity is likely to be kept confidential, the authority should adopt an approach that helps to maintain this confidentiality. To do this, the authority should:
- limit the number of people who are aware of the reporter's identity or information that would or could identify them
- remind each person who knows the reporter's identity that there is a statutory obligation to keep it confidential
- assess whether anyone who knows the reporter's identity may have a motive to take reprisals against them or impede the progress of the investigation
- make sure that the reporter can communicate with support people and investigators without alerting others.
For guidance on how to best maintain confidentiality, see Guideline C7 - Confidentiality
Investigators should take approaches that are least likely to identify the reporter.
Protection against reprisals
Under the PID Act (section 20), public officials who make PIDs, or are suspected of making PIDs, are protected against reprisals.
The PID Act states a person who takes detrimental action against another person that is substantially in reprisal for the other person making a PID is guilty of an offence. They may also be the subject of disciplinary action and personal liability in damages for any loss that the other person suffers as a result.
Detrimental action means action causing, comprising or involving:
- injury, damage or loss
- intimidation or harassment
- discrimination, disadvantage or adverse treatment in relation to employment
- dismissal from, or prejudice in, employment or
- disciplinary proceeding.
Maximum penalty: 2 years imprisonment or 100 penalty units, or both.
It is not necessary to determine that a PID was in fact made. The protections extend to cases where the person who takes the detrimental action does so because they believe or suspect that the other person made or may have made a PID, even if they did not in fact do so.
Obligations to protect against reprisals
The authority has obligations under the common law and work health and safety legislation to make sure that the reporter does not suffer as a result of reporting.
You must take reasonable action to protect the reporter against reprisals. However, the PID Act does not protect the reporter from reasonable disciplinary or other management action in relation to their own wrong conduct.
For guidance on providing advice to staff on the consequences of their own wrongdoing, see Guideline D3 - Internal reporters involved in wrongdoing.
The authority must refer any evidence of an offence of reprisal for making a PID to the Commissioner of Police or the Independent Commission Against Corruption (ICAC). If the investigation finds that an offence has been committed, these organisations must refer the matter to the Director of Public Prosecutions.
Identify any risk of reprisal
It is important to talk to the reporter to understand any risks they may be exposed to. Each case is different, and the questions you ask will be guided by the specific context.
Identify the processes for maintaining confidentiality by:
- asking the reporter about the likelihood of their identity being known
- assessing the likelihood of the reporter being identified during the investigation, and any adverse effects from the loss of confidentiality.
When assessing the risk, consider the following questions.
- Does an exception to maintaining confidentiality apply?
- Does anybody know the identity of the reporter?
- Has the reporter told anyone else they have made, or intended to make, the report?
- Has the reporter raised their concerns previously?
- Is there a chance other staff will infer the reporter has made the report?
- Does the reporter have any specific concerns about reprisal?
- Is the subject of the report the reporter’s supervisor?
- Does the reporter work closely with the subject of the report?
For guidance on assessing the risk, see Guideline C4 - Assessing risk of reprisals and conflict.
To document the steps you have taken to assess and manage risk, use our PID risk assessment template.
Protection against actions
Under the PID Act (section 21), the reporter does not incur any liability for making a PID. No action, claim or demand can be taken against the person for making the disclosure.
Injunctions to prevent reprisals
Under the PID Act (section 20B), the Supreme Court may grant an injunction restraining a person from engaging in reprisal action against you for making a PID.
Under the PID Act, you can sue someone for taking detrimental action against you substantially in reprisal for making a PID. This means you can take civil action and seek compensation for any detriment suffered.
Analyse and evaluate any risk of reprisal
If the reporter's identity cannot be kept confidential, agencies should put in place management strategies to protect the reporter and keep staff informed.
Let the reporter's supervisors and line managers know that they are responsible for supporting the reporter and protecting them from harassment or any other form of reprisal.
Other factors which may heighten the risk of reprisal include when:
- two or more people are the subject of the allegations of wrongdoing
- the subject of the report holds a higher position in the organisation
- the allegations of wrongdoing are serious
- there is a history of workplace conflict between the parties.
When analysing risks, consider the consequences of the risks, the likelihood they will occur, and any control measures that can be implemented to eliminate or mitigate them.
Relocation and transfer
If there are concerns about the reporter’s safety or wellbeing – or other factors that would make it impossible for them to remain in their current workplace – consider whether it is practical to move them to:
- another part of the organisation
- an equivalent position in a new organisation
- alternative employment.
In some circumstances, it may be appropriate to relocate the subject of the report.
For guidance on strategies you can implement to prevent and contain risks of reprisals and related workplace conflict, see Guideline D4 - Preventing and containing reprisals and conflict.
For guidance on responding to allegations of detrimental action in reprisal, see Guideline D5 - Responding to allegations of reprisal guidelines.
The NSW Ombudsman provides advice and assistance with handling PIDs and understanding the PID Act. Contact our Public Interest Disclosure Unit on 02 9286 1000 or email firstname.lastname@example.org