Public interest disclosures - frequently asked questions
- What is the Public Interest Disclosures Act 2022?
- What role does the Information Commissioner have in relation to public interest disclosures?
- What role does the Privacy Commissioner have in relation to public interest disclosures?
- What sort of matters should be reported to the Information Commissioner under the GIPA Act?
- What sort of matters should be reported to the Privacy Commissioner under the PPIP Act and HRIP Act?
- How are the Commissioner's roles different from other investigating authorities such as the Ombudsman or ICAC?
- Reporting wrongdoing - what to report?
- What do I need to say in my report?
- What will the Information Commissioner or Privacy Commissioner do with my report?
- Will my identity be kept confidential?
- Other complaints?
- Do all the same protections apply if I mistakenly report wrongdoing?
- How can I make a report?
1. What is the Public Interest Disclosures Act 2022?
The Public Interest Disclosures Act 2022 (PID Act) sets out a system under which people working within the NSW public sector can report serious wrongdoing in a way that gives them protection from reprisal action and liability. The things people can make a public interest disclosure about are corrupt conduct, serious maladministration, serious and substantial waste, a failure to properly fulfil functions and responsibilities under the Government Information (Public Access) Act 2009 (GIPA Act), a pecuniary interest contravention under the Local Government Act 1993, and a failure to properly fulfil functions under the Privacy and Personal Information Protection Act 1998 (PPIP Act), or Health Records and Information Privacy Act 2002 (HRIP Act).
2. What role does the Information Commissioner have in relation to public interest disclosures?
Role of Information Commissioner under the PID Act
A disclosure may be made to the Information Commissioner under the PID Act. For such a disclosure to be protected from reprisal it must:
- be made in accordance with the Government Information (Information Commissioner) Act 2009, and
- (b) be disclosure of information that the person making the disclosure honestly believes, on reasonable grounds, shows or tends to show that a public authority or another public official has engaged, is engaged or proposes to engage in government information contravention.
You can make a public interest disclosure to the Information Commissioner. Details of how to do so can be found under the "How can I make a report?" section of this page.
Role of Information Commissioner as CEO of the NSW Information and Privacy Commission
As the CEO of the Information and Privacy Commission NSW (IPC), the Information Commissioner can receive public interest disclosures.
The PID Act requires that the head of an organisation is responsible for ensuring that:
- The organisation has an internal reporting policy, see IPC’s current internal reporting policy
- Their staff are aware of the policy and protections of the PID Act
- Their organisation complies with the policy and its obligations under the PID Act
- At least one officer is responsible for receiving public interest disclosures for their organisation.
3. What role does the Privacy Commissioner have in relation to public interest disclosures?
A disclosure may be made to the Privacy Commissioner under the PID Act. For such a disclosure to be protected from reprisal it must:
- be made in accordance with the Privacy and Personal Information Protection Act 1998 (PPIP Act), or Health Records and Information Privacy Act 2002 (HRIP Act).
- (b) be disclosure of information that the person making the disclosure honestly believes, on reasonable grounds, shows or tends to show that a public authority or another public official has engaged, is engaged or proposes to engage in a privacy contravention.
You can make a public interest disclosure to the Privacy Commissioner. Details of how to do so can be found under the "How can I make a report?" section of this page.
4. What sort of matters should be reported to the Information Commissioner under the GIPA Act?
The Information Commissioner has powers under the Government Information (Information Commissioner) Act 2009 (the GIIC Act) to conduct investigations into how agencies fulfil their functions under the GIPA Act. Under section 17 of the GIIC Act, any person may complain to the Information Commissioner about the conduct (including action or inaction) of an agency which is exercising its functions under the GIPA Act. The only exception is where an agency has made a reviewable decision, in which case this cannot be the subject of a complaint to the Information Commissioner.
A disclosure to the Information Commissioner under the PID Act must be made in accordance with the complaint process to the Information Commissioner in the GIIC Act. The Information Commissioner’s powers to deal with a PID disclosure are provided by the GIIC Act.
A general complaint (i.e. a complaint that is not a public interest disclosure) made to the Information Commissioner under the GIIC Act does not afford the same protections as those that are given to an individual making a public interest disclosure under the PID Act.
5. What sort of matters should be reported to the Privacy Commissioner under the PPIP Act and HRIP Act?
The Privacy Commissioner (PC) is an integrity agency for the purposes of the PID Act and disclosures concerning serious privacy contraventions should be made to the Privacy Commissioner. For more information on privacy contraventions see: Fact sheet – Offences under NSW Privacy Laws
6. How are the Commissioners’ roles different from other investigating authorities such as the Ombudsman or ICAC?
The Information Commissioner can only investigate public interest disclosures in relation to concerns about the government information system (GIPA Act) while the Privacy Commissioner can only investigate public interest disclosures in relation to concerns about the PPIP Act and HRIP Act. If your complaint is about other serious conduct, you should report it to the following organisations:
- Serious maladministration – NSW Ombudsman
- Corrupt conduct – Independent Commission Against Corruption
- Serious and substantial waste – NSW Auditor General
- Serious wrongdoing in a council (of any of the above categories) to the Office of Local Government or Department of Planning, Industry and Environment.
- Serious wrongdoing by a police officer (of any of the above categories) – Law Enforcement Conduct Commission.
7. Reporting wrongdoing - what to report?
The Information Commissioner encourages NSW public officials to report any concerns about a failure to comply with the system through which people can access government information under the GIPA Act. Some examples that a public official may encounter are:
- Intentionally overlooked documents that are clearly covered by an access application
- Records that are destroyed, concealed or altered to prevent them from being released
- Decisions knowingly made that are contrary to the GIPA Act
- A person being directed to make a decision that is contrary to the GIPA Act.
The Privacy Commissioner encourages NSW public officials to report any concerns about a failure to properly fulfil functions under the PPIP Act or HRIP Act. Some examples that a public official may encounter are:
- the use of personal information in a manner for which it was not collected
- failure to obtain appropriate consent for the collection of personal information
- unlawful disclosure of personal information
8. What do I need to say in my report?
You should disclose information that you honestly believe shows, or tends to show, the wrongdoing you allege. You must also have reasonable grounds for that belief. You may want to provide documents or evidence in support of your allegations.
It is important that any information you provide is clear, accurate and establishes the facts you allege. You should not investigate the matter yourself and do anything that is illegal (for example, unlawfully accessing information).
9. What will the Information Commissioner or Privacy Commissioner do with my report?
Depending on whether your report alleges a government information contravention or privacy contravention, the Information Commissioner or Privacy Commissioner, respectively, will acknowledge receipt of your report within 45 days and tell you what she, or her delegated PID investigator, has decided to do in response (within six months of you reporting).
10. Will my identity be kept confidential?
The Information Commissioner and Privacy Commissioner recognise that NSW public officials are more likely to report wrongdoing when they believe their identity can and will be kept confidential, especially if they fear they may encounter reprisals for making a report. The Commissioners or their delegates will keep the identity of a person who makes a public interest disclosure confidential, where this is practical and appropriate. However, there may be circumstances where it may be necessary for information to be disclosed that may identify the person who has reported wrongdoing. In this situation, we will always discuss this with you prior to us taking any action.
11. Other complaints?
The protections under the public interest disclosure system are only available to people who work in the public sector that have concerns about wrongdoing that are so serious that it would clearly be in the interests of NSW citizens to report it. There may be other suitable complaint processes available to you instead of the process under the PID Act, for example, a workplace complaint or grievance may be dealt with in accordance with an agency’s grievance policy, or bullying policy or performance improvement processes. For these types of matters you may wish to consult your agency’s Human Resources team.
12. Do all the same protections apply if I mistakenly report wrongdoing?
If a disclosure is mistakenly made to the Information Commissioner or Privacy Commissioner rather that the appropriate investigating authority to deal with, the Commissioner will refer the disclosure to the appropriate authority and the same protections will apply to the person who has reported wrongdoing.
13. How can I make a report?
You can report serious wrongdoing about a failure to comply with the GIPA Act to the Information Commissioner or a failure to comply with the PPIP Act and HRIP Act to the Privacy Commissioner at:
- Phone 1800 472 679
- Write to GPO Box 7011, Sydney NSW 2001
- Email ipcinfo@ipc.nsw.gov.au
