Dealing with anonymous voluntary PIDs

Even though there is a duty on agencies to keep the identity of public interest disclosure (PID) makers confidential, some public officials may still not wish to identify themselves when making PIDs for fear of detrimental action or other negative consequences, or because they do not wish their colleagues or employer to know they have made a disclosure.

Given that the Public Interest Disclosures Act 2022 (PID Act) allows for anonymous PIDs to be made, it is important for agencies to have an appropriate policy and procedure in place for dealing with anonymous PIDs as well as for protecting the identity of PID makers. With such policies and procedures in place, agencies can encourage staff to disclose serious wrongdoing when they otherwise would not be confident to do so.

This guideline provides an overview of the features of an anonymous voluntary PID. The guideline also provides an overview on an agency’s responsibilities once the anonymous report has been received including assessment of the report, deciding what action to take and assessing the risk of detrimental action.

A voluntary PID can be made orally or in writing and can be made anonymously.¹

‘Anonymous’ in the PID Act does not just mean that the name or identity of the person is not known. Rather, a PID is an anonymous PID only if, after considering the circumstances of the PID and any material which relates to it, it is determined that there is no reasonable or practical way of communicating with the maker of the disclosure.²

This means that the test to determine whether a PID is anonymous is not whether the agency or person receiving the disclosure knows the name of the maker of the report, but rather whether there are reasonable or practical means of communicating with the maker.

In practice, it can be difficult for an agency to progress an investigation into a voluntary PID, if the agency cannot contact the PID maker for further information or for clarification of the content of the report. Even if the PID maker chooses not to disclose their name and identity, they may be able to provide a reasonable and practical way for the investigator to communicate with them.

There are strategies that an agency can implement to assure the makers of PIDs that their identity will not be revealed or to maintain lines of communication in a way that may be acceptable to the PID maker. These may include:

• the recipient of the PID could have an agreed time and/or day at which time the PID maker will contact them if they do not want to provide contact details. They may also be able to use a mutually agreed pseudonym so that the PID maker will feel more confident in speaking about the matter

• the recipient could ask the PID maker for a telephone number or private email address at which they can contact the PID maker at an agreed time and/or day.

Agencies have an obligation to include in their PID policy their procedures for how they will deal with voluntary PIDs.³ This should include how they intend to deal with anonymous PIDs, and the limitations anonymous PIDs may have on the ability to investigate. It would also be beneficial to advise that if a public official intends to remain anonymous (in the sense used in the PID Act — that is, unable to be communicated with), that their report should contain comprehensive details of all information they have about the serious wrongdoing, including potential witnesses and any documentary evidence.

It should also highlight that anonymous makers of PIDs may not be able to be kept informed about the progress of the matter or the outcome of the matter. The PID policy should also note that it may not be possible for an anonymous PID maker to be effectively protected from detrimental action (if others suspect that the anonymous PID maker did in fact make the report).

Including this information in the agency’s PID policy allows public officials who intend to make an anonymous complaint to consider the following before making an anonymous PID:

• whether they want to receive updates on how the PID is being dealt with and whether an agency can provide updates, for example by using pseudonyms, code words or encrypted technology if allowed within the agency

• their ability to access support mechanisms after they make the PID

• the likelihood that their identity will still become known, either through the investigation into the wrongdoing, speculation or some other circumstance

• the possibility that one of their colleagues might be mistakenly identified as the maker of the PID.

Important note: Agencies should attempt to assure public officials associated with the agency that while any anonymous reports will be acted upon wherever possible, makers of PIDs should consider identifying themselves, or at least providing a means of further communication, because:

• it allows the agency to seek clarification or further information about the PID

• the maker can be updated about what steps the agency is taking to deal with the report, including being provided with regular updates if an investigation is conducted

• agencies may be better able to assess and minimise the risk of detrimental action.

__________

^1. Public Interest Disclosures Act 2022, s 24(2).
^2. Public Interest Disclosures Act 2022, Sch 2 Dictionary.
^3. Public Interest Disclosures Act 2022, s 43(1)(a).

An anonymous PID is a voluntary PID, so long as it has the features of a voluntary PID.

The content of an anonymous voluntary PID can usually only be assessed on the information disclosed. If it is likely that the disclosure was made by a public official (for example, because the PID asserts that it is, or because it is likely only a public official would be in a position to have provided the relevant content) and the content provides reasonable grounds for believing that it shows or tends to show serious wrongdoing, the agency must proceed and treat the disclosure as a voluntary PID.

An agency will often have little or no information about the reporter’s sources of information (because they are seeking to hide their identity). In this case, agencies should assess any other inferences that can be drawn from the information provided. For example:

• Has the maker provided detailed information about the alleged wrongdoing from which further sources of evidence can be identified, even if there is no/limited information about how they became aware of the information in the disclosure?

• Is it likely that they are a public official based on what they have disclosed?

Once an anonymous report has been assessed as a voluntary PID, an agency must then decide how it will deal with the disclosure, in line with the procedures followed for all voluntary PIDs.

If there is doubt whether an anonymous report is a voluntary PID, it will be prudent to assess the report as a PID. If it subsequently becomes clear that the disclosure is not a PID (for example, the identity of the maker becomes known, and they are not a public official), then the agency can change its assessment. If, however, it is a PID but the agency failed to recognise it as such, then the agency will risk not complying with its obligations under the PID Act.

Agencies must decide how to deal with an anonymous voluntary PID in the same way as other voluntary PIDs where the maker is known. This could be by investigating the disclosure, referring it to a relevant integrity agency or arranging for another agency to investigate it.

While investigating anonymous PIDs may be more difficult, agencies should pursue all available avenues while investigating the disclosure.

An agency should consider the available evidence and decide on the most appropriate action to take in response to the PID, in accordance with the PID Act and the agency’s PID policy.

If the report contains sufficient information to warrant further inquiries or an investigation, they should be conducted. Of course, the fact that the PID has been made anonymously may affect the ability to effectively investigate the matter — especially if insufficient detail has been given in the report. Agencies also need to consider whether the anonymous nature of the PID will affect whether and how it could put the allegations to the person(s) alleged to have engaged in serious wrongdoing for response, and therefore afford them procedural fairness.

Regardless of this, an agency cannot refuse or fail to investigate a PID merely on the basis that it was made anonymously, nor should an adverse inference be made about whether the PID maker was telling the truth because they have chosen to remain anonymous.

Important note: As agencies cannot communicate with the maker of an anonymous PID, they are unable (and are therefore not required) to provide the maker with information that is otherwise required under section 59 of the PID Act.

If the identity of the maker of the PID is known at the outset, relevant risk assessments can be conducted to determine the required levels of support and protection.

In the case of anonymous PIDs, where the maker’s identity is unknown and where they cannot otherwise be communicated with, it is difficult for agencies to ensure the safety of the PID maker and for the agency to comply with its obligations to minimise the risk of detrimental action occurring.

Where an agency receives an anonymous PID, it should not seek to investigate who made the PID or otherwise seek to ‘out’ the person who the agency thinks did so. However, it is important for the agency to recognise that there may still be a risk of detrimental action and that the agency has an obligation to protect its staff against this risk. This includes not only the person who made the PID, but also any person who might be suspected by others of having done so.

Accordingly, even where the PID is anonymous, the agency should conduct a risk assessment to determine whether:

• anyone has indicated an intention to report or has complained about the wrongdoing before
• the information or issues raised can readily be attributed to a known public official
• the identity of the maker may be inadvertently discovered when dealing with the PID
• other public officials may speculate, correctly or otherwise, about who made the PID
• the subjects of the PID or other public officials may inadvertently, or perhaps deliberately, discover the identity of the PID maker
• a person who did not make the report, but is believed to have done so, is at risk of detrimental action.

If the identity of the maker of the PID does become known at any stage, the risks associated with the PID may escalate and require the implementation of prevention or mitigation strategies.