Public interest disclosure procedures

1 Introduction

The Office of the Australian Information Commissioner (OAIC) is committed to a culture that encourages reporting of wrongdoing and inefficiency.

The OAIC’s Public Interest Disclosure Procedures (Procedures) outline the OAIC’s approach to managing matters which arise under the Public Interest Disclosure Act 2013(PID Act). This includes support and protection for public officials who report suspected wrongdoing. These procedures are established in accordance with section 59(3) of the PID Act for the OAIC.

The purpose of the PID Act is to provide a legislative scheme for the making of disclosures about serious wrongdoing in the Commonwealth public sector, investigating those disclosures, and protecting persons who make those disclosures (known as ‘disclosers’) and others from legal action and reprisals for disclosing.

These procedures:

• deal with the assessment of risks that reprisals may be taken in relation to disclosures under the PID Act (see section 5 below)
• provide for confidentiality of investigative processes (see section 3.4 below), and
• comply with standards in force under section 74(1) of the PID Act (Public Interest Disclosure Standard 2013 [PID Standard]).

The OAIC is committed to the highest standards of ethical and accountable conduct. The OAIC encourages the reporting of wrongdoing under the PID Act, and will act on disclosures where appropriate and protect disclosers and others from any reprisals or threats of reprisals as a result of making a disclosure.

The operation of these procedures will be reviewed regularly to ensure their continued effectiveness.

2 What is a public interest disclosure?

Not all disclosures of information made to the OAIC will be public interest disclosures (PIDs) for the purposes of the PID Act. A disclosure of information will only be a PID if:

• it is made by a discloser – a current, former or deemed public official (see section 2.1 below)
• it is made to a supervisor of the discloser or to an authorised internal recipient (see section 2.2 below)
• the information tends to show, or the discloser believes on reasonable grounds that the information tends to show, one or more instances of disclosable conduct (see section 2.3 below), and
• the disclosure is not made in the course of performing the discloser’s ordinary functions as a public official.

Only if each of the above requirements has been met will the disclosure be covered by the PID Act and the discloser have the benefit of the protections that it confers.

Accordingly, it is important that persons contemplating making a disclosure of information carefully review the contents of the PID Act and seek legal advice where appropriate in order to determine whether the disclosure can be made in a way that attracts the protections of the PID Act.

There are 5 kinds of PID:

1. internal, a PID made by a current or former public official to their supervisor or an authorised internal recipient, providing information that they believe tends to show, on reasonable grounds, disclosable conduct within an Australian Government agency or by a public official
2. external, a PID made by a current or former official to any person other than a foreign public official, providing information that they believe tends to show, on reasonable grounds, disclosable conduct within an Australian Government agency or by a public official. Further requirements apply in order for a disclosure to be considered an external PID, including that on a previous occasion, the discloser made an internal disclosure of information that consisted of, or included, the information now disclosed, the disclosure is not, on balance, contrary to public interest and no more information is publicly disclosed than is reasonably necessary to identify one or more instances of disclosable conduct. All requirements are set out in section 26 of the PID Act
3. emergency, a PID made by a current or former official to any person other than a foreign public official, providing information the discloser believes, on reasonable grounds, concerns a substantial and imminent danger to the health and safety of one or more persons or to the environment. Further requirements apply in order for a disclosure to be considered an emergency PID. All requirements are set out in section 26 of the PID Act
4. legal practitioner, a PID made by a current or former official to an Australian legal practitioner, made for the purpose of obtaining legal advice, or professional assistance, from the recipient in relation to the discloser having made, or proposing to make, a PID. Further requirements apply in order for a disclosure to be considered a legal practitioner PID. All requirements are set out in section 26 of the PID Act
5. National Anti-Corruption Commission (NACC) disclosures, a disclosure to the NACC which provides information about a corruption issue. See section 23 of the National Anti-Corruption Commission Act 2022 (NACC Act).

These procedures focus on internal disclosures under the PID Act. Further information on other types of disclosures is available on the Commonwealth Ombudsman’s website: Public interest disclosure (whistleblowing) | Commonwealth Ombudsman.

The full definition of ‘public interest disclosure’ is in section 26 of the PID Act.

2.1 Who is a public official?

A person must be a current, former or deemed public official to make a PID.

The term ‘public official’ is broadly defined in the PID Act and includes (but is not limited to):

• the principal officer of an agency (i.e. in the case of the OAIC, the Australian Information Commissioner (AIC))
• a member of staff of an agency (including an APS employee in the agency)
• a service provider under a Commonwealth contract, along with their officers and employees who provide services directly or indirectly for the purposes of the Commonwealth contract
• a statutory officeholder
• a person employed under the Parliamentary Service Act 1999
• a member of the Australian Defence Force
• an appointee of the Australian Federal Police (AFP), and
• a person deemed to be a public official by an authorised officer under section 70 of the PID Act.

Judicial officers, members of a Royal Commission, members of Parliament and persons employed or engaged under the Members of Parliament (Staff) Act 1984 are not public officials for the purposes of the PID Act.

The full definition of ‘public official’ is in section 69 of the PID Act and the full definition of ‘principal officer’ is in section 73(1) (see item 10).

2.2 Who can a PID be made to?

A public official (or former public official) can make a PID to their supervisor (or manager) or to an ‘authorised internal recipient’ (an authorised officer at the agency to which the conduct relates, or an authorised officer at the agency to which the discloser belongs, or the Commonwealth Ombudsman [there are different requirements in relation to intelligence agencies and functions]).

A discloser’s ’supervisor’ is a public official who supervises or manages the person making the disclosure.

An ‘authorised officer’ is the principal officer of the agency (in the OAIC’s case, the AIC), or a public official who belongs to the agency and is appointed in writing by the principal officer of the agency.

The OAIC’s authorised officers are listed on the OAIC website, accessible at this link. Disclosures may be made by email to PID@oaic.gov.au or by post to GPO Box 5288, Sydney NSW 2001 marked ‘Confidential – PID’. The OAIC uses the above email address for PID matters only and restricts access to it to authorised officers.

If the PID relates to the conduct of another agency, it may be appropriate to make the PID to an authorised officer of that agency.

The principal officer of an agency is also an ‘authorised officer’ for the purposes of the PID Act, so a public official may also make a PID to the AIC.

If the discloser believes, on reasonable grounds, that it would be appropriate for the PID to be investigated by the Commonwealth Ombudsman – or if the PID is about the Ombudsman – then the PID should be made to the Ombudsman.

There are additional obligations for supervisors who receive PIDs (see section,4below).

For PIDs relating to intelligence agencies or agency’s intelligence functions – the PID must be made to an authorised officer of the intelligence agency in question, the Inspector‑General of Intelligence and Security (‘IGIS’) or to an investigative agency.

The full definition of ‘authorised internal recipient’ is in section 34 of the PID Act and the full definition of ‘authorised officer’ is in section 36.

2.3 What is disclosable conduct?

Disclosable conduct is conduct by:

• an agency (a Commonwealth entity or a prescribed authority)
• a public official in connection with their position (see section 2.1 above), or
• a contracted service provider for a Commonwealth contract (in connection with that contract)

if that conduct involves:

• illegal conduct
• corruption (including corrupt conduct)
• maladministration
• abuse of public trust
• fabrication, falsification, plagiarism or deception relating to scientific research
• wastage of public money or public property
• unreasonable danger, or increased risk of danger, to health and safety
• danger, or an increased risk of danger, to the environment
• a public official abusing their position
• conduct that could (if proved) give reasonable grounds for disciplinary action resulting in the termination of the public official’s engagement or appointment, or
• any conduct prescribed by the PID Rules.

The full definition of ‘disclosable conduct’ is in section 29 of the PID Act.

Contracted service provider for a Commonwealth contract

A ‘contracted service provider for a Commonwealth contract’ is:

• a person who is a party to a Commonwealth contract, and is responsible for the provision of goods or services under that contract, or
• a subcontractor who is responsible under a subcontract for the provision of goods or services for the purposes (whether direct or indirect) of the Commonwealth contract.

A ‘Commonwealth contract’ does not include a grant covered by an instrument made under section 105C of the Public Governance, Performance and Accountability Act 2013 (instruments relating to grants).

The full definition of ‘contracted service provider for a Commonwealth contract’ is set out in section 30 of the PID Act.

Corrupt conduct

A person can make a disclosure directly to the NACC providing information about a corruption issue which will be called a ‘NACC disclosure’ (the full definition of NACC disclosure is set out in section 23 of the NACC Act). A NACC disclosure is a PID (see section 26(1A)(c) of the PID Act).

Authorised officers (and PID investigators) must refer a PID which raises a corruption issue to the NACC if they received the PID in the course of their functions under the PID Act, the corruption issue concerns conduct of a person who is or was a staff member of the agency while that person is or was a staff member of that agency, and the authorised officer (or PID investigator) suspects the issue could involve serious or systemic corrupt conduct. More detail can be found in Part 5.4 of these Procedures.

Section 8(1) of the NACC Act states that each of the following is ‘corrupt conduct’:

• any conduct of any person (whether or not a public official) that adversely affects, or that could adversely affect, either directly or indirectly:
  • the honest or impartial exercise of any public official’s powers as a public official
  • the honest or impartial performance of any public official’s functions or duties as a public official
• any conduct of a public official that constitutes or involves a breach of public trust
• any conduct of a public official that constitutes, involves or is engaged in for the purpose of abuse of the person’s office as a public official, or
• any conduct of a public official, or former public official, that constitutes or involves the misuse of information or documents acquired in the person’s capacity as a public official.

Conduct involving a public official may be corrupt conduct even if the conduct is not for the person’s personal benefit.

2.4 What is not disclosable conduct?

The following is not disclosable conduct:

• disagreement with government policies or government action or expenditure
• certain conduct connected with courts, Commonwealth tribunals and intelligence agencies, or
• personal work-related conduct (subject to the exceptions set out below).

Personal work-related conduct

Personal work-related conduct is conduct (by act or omission) engaged in by a public official (the first official) in relation to another public official (the second official) that:

• occurs in relation to, or in the course of, either or both of the following:
  • the second official’s engagement or appointment as a public official
  • the second official’s employment, or exercise of functions and powers, and
• has, or would tend to have, personal implications for the second official.

The following are some examples of personal work-related conduct:

• conduct relating to an interpersonal conflict between the first official and the second official (including, but not limited to, bullying or harassment)
• conduct relating to the transfer or promotion of the second official
• conduct relating to the terms and conditions of engagement or appointment of the second official
• disciplinary action taken in relation to the second official
• the suspension or termination of the second official’s employment or appointment as a public official, or
• conduct in relation to which the second official is, or would have been, entitled to review under section 33 of the Public Service Act 1999 (Public Service Act).

Personal work-related conduct will be disclosable conduct if the conduct:

• would constitute taking a reprisal against another person
• would constitute an offence against section 19 of the PID Act, or
• is of such a significant nature that it would undermine public confidence in an agency (or agencies) or has other significant implications for an agency (or agencies).

The full definition of ‘personal work-related conduct’ is in section 29A of the PID Act. Sections 31, 32 and 33 of the PID Act provide more detail about conduct that is not disclosable conduct.

Other mechanisms to report and resolve issues relating to conduct

The OAIC has other mechanisms for public officials to report and resolve some of the above types of conduct. For example, in relation to grievances relating to an employee’s own employment there are:

• Suspected Breaches of the APS Code of Conduct Procedures
• Work Health and Safety Policy
• Talking about performance (TAP): forms and templates
• Appropriate Workplace Behaviours policy

3 Making an internal disclosure under the PID Act

3.1 How do you make an internal disclosure under the PID Act?

Where a public official is considering making a PID they may wish to, in the first instance, contact an authorised officer to get information about making a disclosure under the PID Act.

A PID may be made by a public official to their supervisor or to an authorised internal recipient (see section 2.2 above):

• orally or in writing
• anonymously or openly, and
• with or without the discloser asserting that the disclosure is made for the purposes of the PID Act – a PID may be made even without the discloser knowing about the PID Act.

Where possible, OAIC officials are encouraged to make a PID to an authorised officer rather than to their supervisor (or manager) because of the additional training given to authorised officers in the OAIC. This paragraph does not prevent an OAIC official from making a PID to their supervisor or manager.

To make a PID in writing, OAIC officials have the option of emailing PID@oaic.gov.au. The OAIC also maintains a list of current authorised officers which can be accessed here. OAIC officials or former officials can make a PID directly to one of the authorised officers.

Once a PID has been made it cannot be withdrawn, but a discloser may tell the authorised officer that they do not want the PID to be investigated. This will be a relevant consideration in the investigator deciding whether or not to investigate the PID.

A person who is considering making a PID should be aware that making a PID does not entitle them to protection from the consequences of their own wrongdoing.

A disclosure made in the course of performing the discloser’s ordinary functions as a public official is not a PID.

3.2 What information should be provided when making a PID?

The information contained in a PID should be clear and factual, and should, as far as possible, avoid speculation, personal attacks and emotive language. It should contain supporting evidence where available to the discloser and should, where possible, identify any witnesses to the disclosable conduct.

A public official making a PID may wish to include the following details:

• their name and contact details (but they do not have to do this, and they can use a pseudonym instead of their real name)
• the details of the suspected wrongdoing
• the name of the person or entity who they believe committed the suspected wrongdoing
• the place, time and date of the suspected wrongdoing
• whether the suspected wrongdoing has been reported to anyone else
• whether there were any witnesses to the wrongdoing, and if so, who the witnesses are, and
• whether they have any concerns that anyone might take reprisal action against them for having made the PID.

A discloser who knowingly makes a false or misleading statement or knowingly contravenes a designated publication restriction without reasonable excuse in a PID will not have immunity from civil, criminal or administrative liability under the PID Act (see section 3.6 below for further information on disclosers’ immunity from liability).

3.3 How are anonymous disclosures dealt with?

A discloser may wish to make an anonymous disclosure. A disclosure is anonymous if the identity of the discloser is not revealed and if no contact details for the discloser are provided. It is also anonymous if the discloser does not disclose their name but provides anonymous contact details. Providing a de-identified email address for correspondence will allow the authorised officer or AIC (or delegate) to contact the discloser anonymously where required.

Receiving an anonymous disclosure does not mean that it cannot be treated as a disclosure for the purposes of the PID Act. However, the disclosure will only be a PID if the discloser is a public official (see section 2.1 above).

Where a supervisor (or manager) receives an anonymous disclosure for the purposes of the PID Act they must refer it to an authorised officer as soon as reasonably practicable.

3.4 What are the confidentiality obligations under the PID Act?

The OAIC’s authorised officers and the AIC (or delegate), and any other persons who are aware of a PID, should take all reasonable steps to protect the identity of a public official who has made a PID for the purposes of the PID Act.

Only individuals directly involved in dealing with the PID (such as the authorised officer and the AIC, and any persons assisting them) may be advised of the details of the PID. These individuals must not disclose the identity of the discloser or any information which is likely to reveal the identity of the discloser (identifying information) without the consent of the discloser or where permitted under the PID Act.

Any interviews conducted for the purpose of an investigation under the PID Act should be conducted in private and avoid the identification of the discloser by other staff of the OAIC.

A person commits an offence if they disclose or use identifying information about a discloser, unless one or more of the following applies:

• the disclosure or use is for the purposes of the PID Act – that is for the purpose of providing assistance in relation to a PID, providing legal advice, or other professional assistance in relation to a PID, or in the performance or exercise (or purported performance or exercise) of a function or power conferred by the PID Act
• the disclosure or use is in connection with the performance of the Commonwealth Ombudsman’s functions or the IGIS’s functions
• the disclosure or use is for the purposes of a law of the Commonwealth of Australia or a prescribed law of an Australian State or a Territory
• the person likely to be identified by the information has consented to the disclosure or use of the information, or acted in a way that is inconsistent with keeping that person’s identity confidential, or
• the information has previously been lawfully published.

Identifying information about a discloser is not required to be disclosed to a court or tribunal except where it is necessary to do so for the purposes of giving effect to the PID Act.

The offences regarding the use or disclosure of identifying information are set out in sections 20 and 21 of the PID Act.

3.5 What are the recordkeeping obligations?

Where an authorised officer or the AIC (or delegate) is required to keep a record under these procedures, the record must be kept in hard copy or electronic form or both. Access to these records must be restricted to only those officers who require access in order to perform some function under the PID Act or for the purposes of another law of the Commonwealth (for example, under the Work Health and Safety Act 2011 or the Public Service Act).

Appropriate written records must be kept of the allocation decision (see section 5 below) and of the investigation (see section 6.3 below).

3.6 What protections and support are available under the PID Act?

Protection against reprisals

The PID Act provides a range of protections for persons who make a PID and others who may be affected. Chief among these is that reprisal action cannot be taken or threatened against a discloser or any other person (for example, a witness) because of a PID.

Reprisal occurs when someone causes, by an act or omission, detriment to another person because they believe or suspect that person, or anyone else, may have made, intends to make, or could make a PID. This could include an action or omission (or threat of action or omission), or detriment, that results in:

• disadvantage to a person, including dismissal, injury in their employment, discrimination between them and other employees or alteration of their position to their disadvantage
• a physical or psychological injury, including a stress-related injury
• intimidation, harassment or victimisation
• loss or damage to property, or
• disadvantage to a person’s career (for example, denying them a reference or a promotion without appropriate reasons).

It is a criminal offence to take or threaten to take a reprisal action against anyone in relation to a PID and the penalty is up to two years imprisonment. An OAIC official who commits a reprisal action may also be subject to disciplinary procedures, for example for breaching the Australian Public Service Code of Conduct.

The AIC must take reasonable steps to protect public officials against reprisals that have been, or may be, taken in relation to PIDs that have been made, may have been made, are proposed to be made or could be made to an authorised officer or supervisor belonging to the OAIC. This firstly requires that the authorised officers or Commissioner undertake an assessment of the risk of reprisals against the discloser or anyone related to a PID.

Following the reprisal risk assessment, a strategy for providing an appropriate level of support will be developed by the authorised officer (see section 5.2 below).

A person does not take a reprisal against another person to the extent that the person takes administrative action that is reasonable to protect the other person from detriment.

What constitutes ‘taking a reprisal’ is set out in section 13 of the PID Act.

Disclosers’ immunity from liability

If an individual makes a PID they are not subject to any civil, criminal or administrative liability (including disciplinary action) for making the PID and no contractual or other remedy may be enforced, and no contractual or other right may be exercised, against the individual on the basis of the PID (it should be noted that this immunity applies where an individual makes any of the 5 types of PID – see section 2 above).

The discloser has absolute privilege in proceedings for defamation in respect of the PID, and a contract to which the discloser is a party must not be terminated on the basis that the PID constitutes a breach of the contract.

However, these immunities do not apply if the discloser:

• makes a statement which they know is false or misleading
• commits an offence under specific sections of the Criminal Code by:
  • providing false or misleading information
  • giving false or misleading documents
  • making a false document
  • using a forged document, or
• contravenes a ‘designated publication restriction’ (for example, a court or Tribunal order to protect the identity of people) if they know the PID contravenes that restriction and do not have a reasonable excuse for that contravention (see the definition of ‘designated publication restriction’ in section 8).

If a discloser provides information that relates to their own conduct, their liability for that conduct is not affected.

The details of the immunity from liability for disclosers are set out in sections 10, 11, 11A and 12 of the PID Act.

Witnesses’ immunity from liability

An individual is a ‘witness’ if they provide assistance in relation to a PID, if they give information or produce a document or other thing, or answer a question, that they consider on reasonable grounds to be relevant to:

• the making of a decision in relation to the allocation of a PID
• a PID investigation or a proposed PID investigation, or
• a review or proposed review by the Commonwealth Ombudsman or the IGIS.

A witness is not subject to any civil, criminal or administrative liability (including disciplinary action) because of the assistance provided. No contractual or other remedy may be enforced, and no contractual or other right may be exercised, against the witness on the basis of the assistance provided.

A witness has absolute privilege in proceedings for defamation in respect of the assistance provided, and a contract to which the witness is a party must not be terminated on the basis that the assistance provided constitutes a breach of the contract.

However, these immunities do not apply if the witness:

• makes a statement which they know is false or misleading
• commits an offence under specific sections of the Criminal Code by:
  • providing false or misleading information
  • giving false or misleading documents
  • making a false document
  • using a forged document, or
• contravenes a designated publication restriction (see the definition of ‘designated publication restriction’ in section 8).

If a witness provides information that relates to their own conduct, their liability for that conduct is not affected.

The details of the immunity from liability for witnesses are set out in sections 12A and 12B of the PID Act.

Good faith exemption for officers involved in PID processes

The AIC (or delegate), an authorised officer, a supervisor (or manager) of a person who makes a PID, or a person assisting the AIC (or delegate) is not liable to any criminal or civil proceedings, or any disciplinary action (including any action that involves imposing any detriment), for or in relation to an act or matter done, or omitted to be done, in good faith:

• in the performance, or purported performance, of any function conferred on the person by the PID Act
• in the exercise, or purported exercise, of any power conferred on the person by the PID Act, or
• in the case of a person assisting the AIC (or delegate) — in assisting the AIC (or delegate) in performing any function or exercising any power under the PID Act.

This exemption does not apply to a breach of a designated publication restriction (see the definition of ‘designated publication restriction’ in section 8).

The details of this good faith exemption are in section 78 of the PID Act.

Support for public disclosers

The OAIC has a number of support mechanisms available to disclosers, including but not limited to the Employee Assistance Program, the OAIC People and Culture team and the OAIC’s Harassment Contact Officers.

Regardless of the outcome of any risk reprisal assessment, the authorised officer, investigator, manager or supervisor will take all reasonable steps to protect public officials who have made a disclosure from detriment or threats of detriment.

This may include taking one or more of the following actions:

• if the discloser wishes, appointing a support person to assist the discloser who is responsible for checking on the wellbeing of the discloser regularly
• informing the discloser of the progress of the investigation
• advising the discloser of the availability of the Employee Assistance Program
• advising the discloser of the role and responsibilities of the OAIC’s Harassment Contact Officers, whose job it is to provide support and information to people who believe they are being harassed.
• where there are any concerns about the health and wellbeing of the discloser, liaising with the OAIC’s People and Culture team
• transferring the discloser to a different area within the workplace.

4 Procedures for supervisors receiving a disclosure

A ‘supervisor’ is a public official who supervises or manages the public official making the disclosure. This can be the discloser’s direct supervisor or another person up the line of reporting. A supervisor (or manager) who receives a disclosure of disclosable conduct (see section 2.3 above) from a public official is required under the PID Act to take the following steps.

Where a public official discloses information to their supervisor or manager (who is not an authorised officer) and the supervisor (or manager) has reasonable grounds to believe that the information concerns, or could concern, disclosable conduct they must:

• inform the discloser that the disclosure could be treated as a PID
• explain to the discloser that the procedures under the PID Act require:
  • the supervisor (or manager) to give the disclosure to an authorised officer
  • the authorised officer to decide whether to allocate the disclosure to the AIC or to another agency, and
  • if the PID is allocated, the principal officer (or delegate) must investigate it
• advise the discloser about the circumstances (if any are applicable) in which a disclosure must be referred to another agency or person under another law of the Commonwealth
• explain to the discloser the protections under the PID Act (see section 3.6 above), and
• as soon as reasonably practicable after the disclosure is made, give the information to an authorised officer.

The supervisor (or manager) should also seek the discloser’s consent to provide the authorised officer with the discloser’s identity. If the discloser declines, the supervisor (or manager) will need provide the authorised officer with as much information as possible, without revealing the discloser’s identity and will need to conduct the reprisal risk assessment (see section 5.2 below).

If the disclosure is not in writing, the supervisor or manager must make a written record of the substance of the disclosure and of the time and date of the disclosure, and ask the discloser to sign the written record of the disclosure (where this is practicable).

The obligations of supervisors are set out in section 60A of the PID Act.

5 Procedures for authorised officers receiving and allocating a disclosure

An authorised officer who receives a disclosure of disclosable conduct (see section 2.3 above) from a public official must deal with the disclosure in accordance with the PID Act, PID Standard and these procedures.

5.1 Receiving a disclosure

Where:

• an individual discloses, or proposes to disclose, information to an authorised officer, which the authorised officer has reasonable grounds to believe may be disclosable conduct (see section 2.3 above), and
• the authorised officer has reasonable grounds to believe that the person may be unaware of the consequences of making the disclosure,

the authorised officer must:

• inform the individual that the disclosure could be treated as an internal disclosure for the purposes of the PID Act
• explain what the PID Act requires in order for the disclosure to be an internal disclosure (see section 2 above)
• advise the individual about the circumstances (if any) in which a PID must be referred to an agency, or other person or body, under another law of the Commonwealth, and
• advise the individual of any orders or directions of which the authorised officer is aware that are designated publication restrictions that may affect disclosure of the information.

If the disclosure is not in writing, the authorised officer must make a written record of the substance of the disclosure and of the time and date of the disclosure, and ask the discloser to sign the written record of the disclosure (where this is practicable).

The authorised officer should ensure that they do not have an actual or perceived conflict of interest in making any decisions about the disclosure including whether or not to allocate the disclosure. A conflict of interest could arise, for example, where information suggests they or a family member of the discloser or persons against whom allegations are made or are implicated in the alleged wrongdoing the subject of the disclosure.

5.2 Conducting a reprisal risk assessment

An authorised officer must conduct a risk assessment of the risk of reprisals being taken against the discloser (and other public officials who belong to the OAIC, if applicable) as a result of the PID. This should be conducted as soon as possible after a potential PID is received by an authorised officer.

If the disclosure is first made to a supervisor (or manager) then the authorised officer may ask the supervisor (or manager) for further assistance in carrying out the risk assessment.

Reprisal risk must be assessed in all cases however the way in which a risk assessment is conducted may vary depending on the circumstances. The risk assessment can include the risk of direct reprisal against the discloser and the risk of related workplace conflict or difficulties.

Early and open communication with the discloser is critical. Sensitivity needs to be applied in talking about the risks with the discloser. The authorised officer conducting the risk assessment should be alert to the possibility that the discloser may feel that the discussion of reprisal risk is intended to discourage them from proceeding with their disclosure. As part of the risk assessment, any concerns of the discloser about the reprisal risks should be discussed with them and addressed, taking into account all of the circumstances. The discloser should also be informed of the protections afforded to them under the PID Act (see section 3.6 above).

The following framework may be used for assessing the risk of reprisals being taken:

• Identifying the risks – the authorised officer should identify the risk factors relating to the particular disclosure, taking into account the individual and organisational circumstances. Some risk factors may include (but are not limited to) those listed in the first column of the table below. Considerations for the risk assessment are listed in the second column:

• Assessing the risks – the authorised officer should consider the likelihood and consequence of reprisal or related workplace conflict occurring. For example, the likelihood of a risk may be high where threats have been made, there is already conflict in the workplace or the discloser’s identity would be obvious because of the nature of the disclosure.
• Controlling the risks – the authorised officer should identify strategies to be put in place to prevent or contain reprisals or related workplace conflict. Any decision affecting the discloser should be made in consultation with them and should be reasonable and appropriate in all of the circumstances.
• Monitoring and reviewing the risk management process – the risk assessment should be monitored, reviewed and updated as circumstances change throughout the course of the investigation.

Regardless of the outcome of the risk assessment, if it has been determined that a discloser will require support, the authorised officer should develop a strategy for providing an appropriate level of support. This may include taking one or more of the following actions:

• with the discloser’s consent, appointing a support person to assist the discloser, who is responsible for checking on the wellbeing of the discloser regularly
• informing the discloser of the progress of the investigation
• advising the discloser of the availability of the Employee Assistance Program and access to workplace Harassment Contact Officers, and
• where there are any concerns about the health and wellbeing of the discloser, liaising with officers responsible for health and safety in the OAIC.

If the situation is serious enough, protecting the discloser may require significant action such as a transfer, relocation, a leave of absence, physical protection or an injunction.

For further information on carrying out reprisal risk assessments, see the Commonwealth Ombudsman’s Agency Guide to the Public Interest Disclosure Act 2013: www.ombudsman.gov.au.

5.3 Allocating a disclosure

An authorised officer who receives a disclosure (either directly from the discloser or from the discloser’s supervisor) must either:

• allocate the disclosure to one or more agencies, or
• decide not to allocate the disclosure to any agency if they are satisfied, on reasonable grounds, that:
  • there is no reasonable basis on which the disclosure could be considered an internal disclosure (see section 2 above), or
  • the conduct disclosed would be more appropriately investigated under another Commonwealth law or power.

The authorised officer must use their best endeavours to make a decision about the allocation of the disclosure within 14 days of the disclosure being made or given to the officer. This 14-day period is subject to any stop action direction issued under the NACC Act to stop taking action in relation to a corruption issue.

Deciding whether or not to allocate the disclosure

An authorised officer who receives a disclosure must allocate the disclosure to the AIC or a principal officer of another agency unless:

• they are satisfied, on reasonable grounds, that there is no reasonable basis on which the disclosure could be considered an internal disclosure – the grounds on which an authorised officer could be satisfied of this include that:
  • the disclosure has not been made by a person who is, or was, a public official (see section 2.1 above)
  • the disclosure was not made to an authorised internal recipient or supervisor (see section 2.2 above)
  • the disclosure does not include disclosable conduct (see section 2.3 above)
  • the person who is alleged to have carried out the disclosable conduct was not a public official at the time that they are alleged to have carried out that conduct, or
  • the disclosure is not otherwise a PID within the meaning of the PID Act, or
• the conduct would be more appropriately investigated under another Commonwealth law or power.

In making a decision about allocation, the authorised officer must have regard to the following considerations:

• generally, an agency should not handle a PID unless some or all of the conduct disclosed relates to that agency (i.e. generally the OAIC should not handle the PID if it does not relate to the OAIC)
• any other matters the authorised officer considers relevant, including:

if another agency in the same portfolio would be better able to handle the PID (for example, the Attorney-General’s Department),the authorised officer may allocate the PID to another agency in the same portfolio as the recipient agency if they consider that the other agency would be better able to handle the PID. However, the allocation may not be made to another agency unless an authorised officer in that agency consents to the allocation

• any recommendation made by the Commonwealth Ombudsman or the IGIS about the allocation of the PID, and
• whether the obligations in section 60(1) of the PID Act (Additional obligations of authorised officers) has been satisfied in relation to the PID.

The authorised officer may obtain information from such persons, and make such inquiries, as the authorised officer thinks fit, in order to make a decision about the allocation of the disclosure.

A disclosure that includes information relating to a number of instances of conduct, some of which may be considered disclosable conduct, and some of which may not (for example, because that conduct is personal work-related conduct) must still be allocated.

If the information disclosed concerns conduct alleged to be related to an intelligence agency, Australian Criminal Intelligence Commission (ACIC) or the Australian Federal Police  (in respect of their intelligence functions) then the IGIS must be notified and the process in section 45A of the PID Act must be followed.

The requirements for making a decision about allocating a disclosure are set out in section 43 of the PID Act.

Decision not to allocate

Where an authorised officer decides not to allocate a disclosure to any agency, they must, as soon as reasonably practicable, give written notice to:

• the discloser (if reasonably practicable) of:
  • the decision
  • the reasons for the decision
  • any action the authorised officer has taken or proposes to take to refer the conduct for investigation under another Commonwealth law or power (if any), and
  • any courses of action that might be available to the discloser under another Commonwealth law or power (if any), and
• the Commonwealth Ombudsman (unless the conduct disclosed relates to an intelligence agency, or ACIC or the AFP in relation to that agency’s intelligence functions) of:
  • the decision
  • the reasons for the decision, and
  • any action the authorised officer has taken or proposes to take to refer the conduct for investigation under another Commonwealth law or power (if any).

If the conduct disclosed relates to an intelligence agency, or ACIC or the AFP in relation to that agency’s intelligence functions, the authorised officer must also give written notice to the IGIS.

The authorised officer must keep an appropriate written record of the following:

• the decision
• the reasons for the decision
• whether the notice (or a copy of the notice) of the decision not to allocate was given to the discloser, and if not, why not, and
• if the notice (or a copy of the notice) of the decision not to allocate was given to the discloser – the following matters:
  • the day and time the notice (or copy) was given to the discloser
  • the means by which the notice (or copy) was given to the discloser, and
  • the matters included in the notice.

The requirements for the notice of a decision to not allocate a disclosure are set out in section 44A of the PID Act. The requirements for written records are set out in section 6 of the PID Standard.

Decision to allocate

Where an authorised officer decides to allocate a disclosure (to the AIC or to another agency) they must, as soon as reasonably practicable, give written notice to:

• the principal officer of each agency to which the PID is allocated (so where an authorised officer decides to allocate an internal public interest disclosure to the OAIC for handling, the authorised officer must give notice of the allocation to the Information Commissioner), and
• the Commonwealth Ombudsman (or to the IGIS if the PID is allocated to an intelligence agency or ACIC or the AFP, in relation to their intelligence functions).

The notice must include the following matters:

• the allocation to the agency
• the information that was disclosed
• the conduct disclosed, and
• the discloser’s name and contact details (if these are known to the authorised officer and the discloser consents to these details being provided).

If reasonably practicable, the authorised officer must give a copy of the notice to the discloser as soon as reasonably practicable.

The authorised officer should also ask the discloser whether they consent to the officer giving the discloser’s name and contact details to the AIC (or to the principal officer of another agency if the PID is allocated to another agency).

The IGIS must also be notified if the PID is allocated to an intelligence agency, ACIC or the AFP in relation to that agency’s intelligence functions.

The authorised officer must keep an appropriate written record of the following:

• the decision (including the name of each agency to which the PID is to be allocated)
• the reasons for the decision
• if the PID has been allocated to another agency — the consent given by an authorised officer in the agency to which the PID is allocated
• whether the notice (or a copy of the notice) of the decision to allocate was given to the discloser, and if not, why not and
• if the notice (or a copy of the notice) of the decision to allocate was given to the discloser – the following matters:
  • the day and time the notice (or copy) was given to the discloser
  • the means by which the notice (or copy) was given to the discloser, and
  • the matters included in the notice.

The requirements for the notice of a decision to allocate a PID are set out in section 44 of the PID Act. The requirements for written records are set out in section 6 of the PID Standard.

Reallocation of PIDs

The authorised officer may, after making a decision to allocate a PID, decide to reallocate the PID to one or more agencies (which may include an agency to which the PID had formerly been allocated). The processes set out above must be followed if a decision is made to reallocate the PID.

5.4 Mandatory referral to the NACC

In addition to considering whether or not to allocate the disclosure, the authorised officer must consider whether the PID involves a ‘corruption issue’, as defined in s 9 of the NACC Act. A ‘corruption issue’ involves ‘corrupt conduct’, as defined in s 8 of the NACC Act and set out above in Part 2.3.

A staff member includes an agency head, employees, contracted service providers for Commonwealth contracts and their employees and officers, secondees, statutory officeholders, and others performing functions under a Commonwealth law (see section 12 of the NACC Act).

If the authorised officer, in the course of dealing with a PID, becomes aware of a corruption issue that:

• concerns the conduct of a person who is, or was, a staff member of the OAIC while that person is, or was a staff member, and
• the authorised officer suspects it could involve corrupt conduct that is serious or systemic,

they must refer the PID to the National Anti-Corruption Commissioner (the NACC Commissioner) as soon as reasonably practicable. The authorised officer must inform the discloser of the referral as soon as reasonably practicable after the referral.

An authorised officer is not required to provide information to the NACC Commissioner if:

• the authorised officer has reasonable grounds to believe that the NACC Commissioner is already aware of the information, or
• the NACC Commissioner has advised the authorised officer that the provision of information about the corruption issue is not required.

The NACC Commissioner may direct an agency head (including the AIC) to stop the agency taking specified action, including allocating the PID.

If the authorised officer does not allocate the PID because of a stop action direction under the NACC Act, the authorised officer must, as soon as reasonably practicable:

• give written notice to the Commonwealth Ombudsman (or the IGIS regarding intelligence agencies and functions) of:
  • the information that was disclosed
  • the conduct disclosed
  • if the discloser’s name and contact details are known to the authorised officer, and the discloser consents to the Commonwealth Ombudsman (or IGIS) being informed—the discloser’s name and contact details, and
  • the stop action direction under the NACC Act that prevents allocation of some or all of the PID, and
• inform the discloser and give the discloser a copy of the notice if the AIC (or delegate) considers that it is reasonably practicable or appropriate to do so.

The authorised officer must keep an appropriate written record of the following:

• details of the direction, including when the direction was made and when the stop action direction no longer applies, and
• whether the AIC (or delegate) considers that it is reasonably practicable or appropriate for the discloser to be given a copy of the notice (and whether the discloser was given a copy of the notice).

The above requirements for written records are set out in section 6 of the PID Standard.

Even where a referral is made to the NACC, the authorised officer (or PID investigator) should continue to handle a disclosure in line with obligations under the PID Act, unless a stop action direction has been issued under section 43(1) of the NACC Act. If a stop action direction is issued but subsequently revoked, the timeframes stipulated under the PID Act recommence from the date the authorised officer (or PID investigator) becomes aware that a stop action direction no longer applies.

The NACC Act and the PID Act offer different protections to disclosers. The NACC Act protections are available to any person who provides information or evidence related to a corruption issue to the Commission. Importantly, a public official will be able to access protections under both schemes where the information or evidence disclosed to the Commission also constitutes disclosable conduct under the PID Act.

6 Procedures for investigating an internal disclosure

The AIC (or delegate) must, as soon as reasonably practicable, after being allocated a PID decide whether to:

• investigate the PID
• not investigate the PID further, or
• investigate the PID under another Commonwealth law or power.

If the NACC Commissioner issues a stop action direction under the NACC Act, which prevents the investigation of some or all of the PID, the AIC must inform the Commonwealth Ombudsman of the stop action direction (or the IGIS, if the PID concerns conduct relating to an intelligence agency, the IGIS, or ACIC or the AFP in relation to those agencies’ intelligence functions).

The AIC (or delegate) must, as soon as reasonably practicable, give written notice to the discloser stating:

• information about the AIC’s powers to:
  • decide not to investigate the PID
  • decide not to investigate the PID further, or
  • decide to investigate the PID under a separate investigative power.

The AIC (or delegate) must ensure that, where it is reasonably practicable to do so, the discloser is given the above information within 14 days after the PID is allocated to the agency.

6.1 Deciding whether or not to investigate

The AIC (or delegate) may decide not to investigate the PID, or (if the investigation has started) not to investigate further if one of the following considerations apply:

• the discloser is not, and has not been, a public official (see section 2.1 above)
• the information does not, to any extent, concern serious disclosable conduct (see section 2.3 above)
• the PID is frivolous or vexatious
• the information is the same, or substantially the same, as information previously disclosed under the PID Act, and:
  • a decision was previously made not to investigate the earlier PID further or at all, or
  • the earlier PID has been, or is being, investigated as a PID investigation
• the conduct disclosed, or substantially the same conduct, is being investigated under another Commonwealth law or power, and the AIC (or delegate) is satisfied, on reasonable grounds, that it would be inappropriate to conduct an investigation under the PID Act at the same time
• the conduct disclosed, or substantially the same conduct, has been investigated under another Commonwealth law or power, and the AIC (or delegate) is satisfied, on reasonable grounds, that there are no further matters concerning the conduct that warrant investigation
• the AIC (or delegate) is satisfied, on reasonable grounds, that the conduct disclosed would be more appropriately investigated under another Commonwealth law or power (that the conduct disclosed raises a corruption issue is not sufficient alone for this)
• the AIC (or delegate) has been informed that the discloser does not wish the investigation of the PID to be pursued and the AIC (or delegate) is satisfied, on reasonable grounds, that there are no matters concerning the PID that warrant investigation, or
• it is impracticable for the PID to be investigated because:
  • the discloser’s name and contact details have not been disclosed
  • the discloser refuses or fails, or is unable, to give, for the purposes of the investigation, such information or assistance as the person who is or will be conducting the investigation asks the discloser to give, or
  • of the age of the information.

The circumstances where the principal officer may decide not to investigate a PID are set out in section 48 of the PID Act.

6.2 Decision not to investigate

Discloser and Commonwealth Ombudsman must be notified

If the AIC (or delegate) has decided not to investigate the PID (or not to investigate the PID further) they must, as soon as reasonably practicable, give written notice to the discloser (if contacting the discloser is reasonably practicable) and to the Commonwealth Ombudsman stating that:

• the AIC (or delegate) has decided not to investigate the PID (or not to investigate the PID further)
• the reasons for that decision, and
• if the AIC (or delegate) has taken action, or proposes to take action, in relation to the referral of the conduct disclosed for investigation under another Commonwealth law or power, details of:
  • the other Commonwealth law or power
  • the agency or other person or body to which the conduct has been, or is to be, referred, and
  • the steps taken, or proposed to be taken, for the conduct to be referred or to facilitate its referral.

The AIC (or delegate) may delete from the copy of the reasons given to the discloser anything that would cause the document to:

• be exempt for the purposes of Part IV of the Freedom of Information Act 1982 (FOI Act)
• have, or be required to have, a national security or other protective security classification, or
• contain intelligence information.

The notification requirements are set out in sections 50 and 50A of the PID Act.

Referral for investigation under another Commonwealth law or power

The AIC (or delegate) must, as soon as reasonably practicable, take reasonable steps to refer the conduct disclosed, or to facilitate its referral, for investigation under another Commonwealth law or power, if the AIC (or delegate):

• decides not to investigate the PID, or not to investigate the PID further
• does not decide to investigate the PID under a separate investigative power, and
• is satisfied, on reasonable grounds, that the conduct disclosed would be more appropriately investigated under another Commonwealth law or power (other than a separate investigative power).

The requirements for referral of a PID for investigation under another Commonwealth law or power are set out in section 50AA of the PID Act.

6.3 Decision to investigate

The investigation must be completed within 90 days

An investigation must be completed within 90 days after the day when the PID was initially allocated.

If the PID was reallocated, the investigation must be completed 90 days after the day when the PID was reallocated. In the case of a reinvestigation, the investigation must be completed 90 days after the day when the AIC (or delegate) decided to reinvestigate the relevant PID.

The Commonwealth Ombudsman may extend the 90‑day period by an additional period that the Ombudsman considers appropriate on the Ombudsman’s own initiative or on application made by the AIC (or delegate) or the discloser. If an extension is granted, the AIC (or delegate) must, as soon as reasonably practicable, inform the discloser (if contacting the discloser is reasonably practicable).

Failure to complete the investigation within the 90-day time limit does not affect the validity of the investigation.

Time limit requirements for investigations are in section 52 of the PID Act.

Conduct of the investigation

An investigation is to be conducted as the AIC (or delegate) thinks fit and they may, for the purposes of the investigation, obtain information from such persons, and make such inquiries, as they think fit. If it is reasonably practicable to contact the discloser, the investigator should keep them updated as to the progress of the investigation.

The steps that should be undertaken for conducting investigations are outlined in the OAIC’s Investigation steps under the Public Interest Disclosure Act 2013 and should be followed unless contrary to any requirement of the PID Act or PID Standard, or an alternative direction is provided by the NACC Commissioner, or the AIC; in relation to any or all of the steps.

When conducting an investigation, the AIC (or delegate) must:

• ensure that a PID is investigated on the basis that a decision whether evidence is sufficient to prove a fact must be determined on the balance of probabilities
• ensure that a finding of fact is based on logically probative evidence
• ensure that the evidence relied on in an investigation is relevant
• act in accordance with any rules relating to fraud that are made for the purposes of the Public Governance, Performance and Accountability Act 2013, to the extent that the investigation relates to one or more instances of fraud, and those rules are not inconsistent with the PID Act, and
• comply with any standards in force under the PID Act (i.e. the PID Standard).

Subject to restrictions imposed by any other law of the Commonwealth, the AIC (or delegate) (PID investigator) must ensure that, if a person is interviewed as part of the investigation of a PID, the interviewee is informed of the following:

• the identity and function of each individual conducting the interview
• the process of conducting an investigation
• the authority of the AIC (or delegate) under the PID Act to conduct the investigation, and
• the protections provided by Part 2 (Protection of disclosers and witnesses) of the PID Act (see section 3.6 above).

The AIC (or delegate) must ensure that:

• an audio or visual recording of the interview is not made without the interviewee’s knowledge
• when an interview ends, the interviewee is given an opportunity to make a final statement or comment, or express a position, and
• any final statement, comment or position by the interviewee is included in the record of the interview.

The AIC (or delegate) conducting an investigation may adopt a finding set out in the report of an investigation or inquiry under another Commonwealth law or power, another investigation under Division 2 of Part 3 of the PID Act.

The requirements for conducting investigations are in sections 53, 54, and 56 of the PID Act and in Part 3 of the PID Standard.

Mandatory reporting during the investigation – corruption issues (see section 5.4)

At any time during the course of the investigation, if the AIC (or delegate) becomes aware of a corruption issue that:

• concerns the conduct of a person who is, or was, a staff member of the agency while that person is, or was, a staff member (see section 5.4 above for the meaning of staff member), and
• the officer suspects could involve corrupt conduct that is serious and systemic,

they must refer the corruption issue to the NACC Commissioner, or in the case of an intelligence agency, to the IGIS.

The AIC (or delegate) must notify the discloser that the PID has been referred to the NACC Commissioner, as soon as reasonably practicable, after the referral.

Mandatory reporting during the investigation – criminal conduct

At any time during the course of the investigation, if the AIC (or delegate) suspects on reasonable grounds that the information in the PID or any other information obtained in the course of the investigation is evidence of the commission of an offence against a law of the Commonwealth of Australia, State or Territory:

• they may give the information to a member of an Australian police force responsible for the investigation of the offence, and
• they must give the information to a member of an Australian police force responsible for the investigation of the offence if the offence is punishable by imprisonment for life or by imprisonment for a period of at least 2 years, unless (relevantly) the information raises a corruption issue that has already been referred or which the NACC Commissioner/IGIS is already aware.

Report of investigation

In preparing a report of an investigation under the PID Act, the AIC (or delegate) must comply with the PID Act, the PID Standard and these procedures.

On completing an investigation, the AIC (or delegate) must prepare a report that sets out:

• whether there have been one or more instances of disclosable conduct
• any regulations, rules, administrative requirements or similar matters to which the disclosable conduct relates
• the steps taken to gather evidence and a summary of the evidence
• the matters considered in the course of the investigation
• the AIC’s findings (if any) based on the evidence
• the duration of the investigation
• the action (if any) that has been, is being, or is recommended to be, taken, and
• claims of any reprisal taken against the discloser, or any other person, that relates to the matters considered in the course of the investigation, together with any related evidence, and the agency’s response to any claims or evidence.

Where the AIC (or delegate) in preparing the report proposes to make a finding of fact or express an opinion that is adverse to a person, the AIC (or delegate) must give that person a copy of the evidence that is relevant to the proposed finding or opinion and must give the person a reasonable opportunity to comment on it.

The investigation is ‘completed’ when the AIC (or delegate) has prepared the above report.

The AIC (or delegate) must, within a reasonable time after preparing the report, give written notice of the completion of the investigation, together with a copy of the report, to:

• the discloser, if reasonably practicable, and
• the Commonwealth Ombudsman.

The AIC (or delegate) may delete from the copy given to the discloser any material:

• that is likely to enable the identification of the discloser or another person
• the inclusion of which would:
  • result in the copy being an exempt document under Part IV of the FOI Act
  • result in the copy being a document having, or being required to have, a national security or other protective security classification
  • result in the copy containing intelligence information, or
  • result in contravene a designated publication restriction.

The AIC (or delegate) may delete from a copy of the report given to the Commonwealth Ombudsman any material:

• that is likely to enable the identification of the discloser or another person, or
• the inclusion of which would contravene a designated publication restriction.

The AIC must, as soon as reasonably practicable, ensure that appropriate action in relation to the agency is taken in response to any recommendations in the report.

Requirements for the investigation report are in section 51 of the PID Act.

7 Additional obligations of authorised officers

7.1 Protecting officials against reprisals

An authorised officer must take reasonable steps to protect public officials who belong to the OAIC against reprisals that have been, or may be, taken in relation to PIDs that the authorised officer suspects on reasonable grounds:

• have been made or given to the officer
• may have been made or given to the officer
• are proposed to be made or given to the officer
• could be made or given to the officer.

The obligations of authorised officers set out above are in section 60 of the PID Act.

8 Additional obligations of principal officers

8.1 Facilitating PIDs

The AIC must take reasonable steps to ensure that:

• the number of authorised officers of the agency is sufficient to ensure that they are readily accessible by public officials who belong to the agency
• public officials who belong to the agency are aware of the identity of each authorised officer of the agency, and
• there is an effective means for potential disclosers to find out how to contact authorised officers (i.e. a means for both current and former officials of the agency to find effectively contact authorised officers).

The AIC must take reasonable steps to encourage and support:

• public officials who make, or are considering making, PIDs relating to the agency, and
• any other persons who provide, or are considering providing, assistance in relation to such PIDs.

For further guidance, see the Commonwealth Ombudsman’s Agency Guide to the Public Interest Disclosure Act 2013: www.ombudsman.gov.au.

8.2 Providing training and education for officials

The AIC must take reasonable steps to provide ongoing training and education to OAIC officials about the PID Act including, without limitation, training and education about the following:

• integrity and accountability
• how to make a PID
• the protections available under the PID Act
• the performance by those officials of their functions under the PID Act, and
• the circumstances (if any) in which a PID must be referred to an agency, or other person or body, under another law of the Commonwealth.

The AIC must take reasonable steps to ensure that OAIC officials who are appointed to positions that require, or could require, them to perform the functions or duties, or exercise the powers, of an authorised officer or supervisor under the PID Act are given training and education appropriate for the position within a reasonable time after that appointment.

The additional obligations of principal officers are in section 59 of the PID Act.

8.3 Protecting officials against reprisals

The AIC must take reasonable steps to protect public officials who belong to the OAIC against reprisals that have been, or may be, taken in relation to PIDs that:

• have been made
• may have been made
• are proposed to be made
• could be made.

The obligations set out above are in section 59(9) of the PID Act.

8.4 Providing information to the Commonwealth Ombudsman

The AIC (or delegate) must provide the following information to the Commonwealth Ombudsman, on request by the Ombudsman, for the purpose of the Ombudsman preparing a report under the PID Act:

• the number of PIDs received by authorised officers of the agency during the period covered by the report
• the kinds of disclosable conduct to which those PIDs related
• the number of PIDs allocated to the agency during the period covered by the report
• the number of PID investigations that the AIC (or delegate) conducted during the period covered by the report
• the time taken to conduct those investigations
• the actions that the AIC (or delegate) has taken during the period covered by the report in response to recommendations in reports relating to those PID investigations, and
• any other information requested by the Ombudsman.

The AIC (or delegate) must provide the information within a time requested by the Ombudsman or as otherwise agreed with the Ombudsman.

The requirements for giving information and assistance for Ombudsman reports are set out in Part 5 of the PID Standard.

9 Obligations of all OAIC officials

All public officials who belong to the OAIC must use their best endeavours to assist:

• the AIC (or delegate) in the conduct of an investigation under the PID Act
• the Commonwealth Ombudsman and the IGIS (where relevant) in the performance of their functions under the PID Act, and
• any other public official to exercise a right, or perform a duty or function, under the PID Act.

Beyond these specific responsibilities, all OAIC officials share the responsibility of ensuring the PID Act works effectively, this includes:

• reporting matters where there is evidence that shows or tends to show disclosable conduct
• identifying areas where there may be opportunities for wrongdoing to occur because of inadequate systems or procedures and proactively raising these with management
• supporting public officials who have made PIDs, and
• keeping confidential the identity of disclosers and witnesses, where that is known.

The additional obligations of public officials are in section 61 of the PID Act.

10 What if the discloser is not satisfied with the agency’s actions?

A discloser may make a complaint to the Commonwealth Ombudsman about the OAIC’s handling of a PID. The Ombudsman may review the handling of the PID by any or all of the supervisor, authorised officer, AIC, or any other public official involved. As a result of the review, the Ombudsman may make written recommendations, including recommendations about allocation, reallocation, investigation, reinvestigation, or any other action. The AIC (or delegate) must consider and respond to any recommendation made by the Commonwealth Ombudsman in accordance with section 55 of the PID Act.

If a person who has made a PID believes, on reasonable grounds, that the investigation conducted by the OAIC was inadequate, the response to the investigation was inadequate, or the investigation was not completed within the time limit, it may be open to the person to make an external disclosure under the PID Act.

For more information on when an external disclosure may be made and how to make one, please refer to the Commonwealth Ombudsman’s website: https://www.ombudsman.gov.au/.

11 Freedom of information requests

Documents associated with a PID are not exempt from the operation of the FOI Act. Requests for access to documents under the FOI Act must be considered on a case-by-case basis. A range of exemptions may apply to individual documents or parts of documents, particularly in relation to material received in confidence, personal information, agencies’ operations, and law enforcement.

12 Further information

Further information can be found on the OAIC website accessible at this link. The OAIC also has a mailbox accessed only by the Chief Operating Officer, Assistant Commissioner Corporate and Director Governance and Risk where staff, including authorised officers, can seek advice on integrity matters, including anything in relation to the PID Act. The mailbox is integrity@oaic.gov.au.