Dealing with mandatory PIDs

Some public officials have a legal duty to report certain types of serious wrongdoing, while others may hold a position where it is an ordinary requirement of their roles, or the functions they undertake, to report serious wrongdoing.

When a public official makes a report about serious wrongdoing because of one of these obligations, they may be making a mandatory public interest disclosure (PID).

Many public officials have a legal obligation (under legislation or otherwise) to report serious wrongdoing.

Some public officials have particular roles, or hold particular positions with certain functions, for which it is an ordinary requirement for them to report serious wrongdoing.

Even though these public officials have complied with legal and other duties by coming forward, they might be concerned about any potential detrimental action for having reported the serious wrongdoing. It is important that public officials feel confident in executing their legal duties or the requirements of their role, and act with integrity, without fear of detrimental action.

For this reason, the Public Interest Disclosures Act 2022 (PID Act) extends many of the same protections that apply to a voluntary PID so that they also apply to mandatory PIDs.

This is consistent with the objects of the PID Act, which include facilitating the disclosure by public officials of serious wrongdoing in or affecting the public sector, and protecting them from detriment when they do.¹

For a disclosure to be a mandatory PID it must be:

• made by a public official
• be about serious wrongdoing, and
• made either:
  • while meeting the ordinary requirements of the official’s role or functions, or
  • under a statutory or other legal obligation.

The codes of conduct of many agencies provide that their staff must report serious wrongdoing whenever they become aware of it. This is good practice.

For the purposes of the PID Act, a disclosure made in compliance with such a code of conduct obligation is not considered to be a mandatory PID. The mere fact that an agency’s code of conduct states that staff must report all serious wrongdoing does not mean that the staff of that agency are never able to make a voluntary PID and can only be considered as having made a mandatory PID.

Instead, if a public official (whose agency’s code of conduct requires them to report serious wrongdoing) makes a public interest disclosure, that will be a voluntary PID.²

This means that, for the purposes of the PID Act, public officials are in no different a position if their agency’s code of conduct expressly says that they should report serious wrongdoing or not.

Examples of legal obligations to report serious wrongdoing

There are various legislative regimes that impose mandatory reporting duties on different public officials. Agencies should ensure that relevant public officials are aware of the duties that apply to them. An example of mandatory reporting is the duty on police officers to report serious maladministration pursuant to section 211F of the Police Act 1990.

Another example is section 11 of the Independent Commission Against Corruption Act 1988, which requires heads of agencies to report any matter to the Independent Commission Against Corruption that they suspect, on reasonable grounds, concerns or may concern corrupt conduct. Such a report will be a mandatory PID.

The PID Act places a legal obligation on managers who receive a voluntary PID to communicate that PID to a disclosure officer. When managers do so, they have made a mandatory PID. Likewise, a Minister or a member of a Minister’s staff who receives a voluntary PID must communicate that disclosure to a disclosure officer or an integrity agency, and in doing so will also be making a mandatory PID. This means that, like the person who originally made the voluntary PID, those people are also protected under the PID Act against detriment and liability.

Examples of roles or functions with an ordinary requirement to report serious wrongdoing

The following are examples of circumstances which may result in a mandatory PID (that is, where a public interest disclosure is made while meeting the ordinary requirements of the public official’s role or functions):

• an auditor comes across serious mishandling of government money while conducting an audit or review

• an investigator conducting an internal investigation comes across serious wrongdoing and communicates it as part of their findings

• a public official who is a manager comes across a serious privacy breach by a staff member and communicates it internally in line with their obligations under policy and procedure to deal with the outcome of the privacy breach.

__________

^1. Public Interest Disclosures Act 2022, s 3.
^2. Provided, of course that it has all the relevant features and is not a mandatory PID.

By recognising reports of serious wrongdoing by public officials as public interest disclosures — even where the disclosure is done under a legal duty or as an expected part of an official’s ordinary role or function — the PID Act ensures that these officials are appropriately protected and not fearful of performing their duties or functions.

While most of the same protections that apply to voluntary PIDs also apply to mandatory PIDs, the same obligations do not apply when dealing with mandatory PIDs.

Generally, this means that, however the agency becomes aware of serious wrongdoing, mandatory PIDs should be dealt with in line with the agency’s general policies and procedures for dealing with such wrongdoing. This may include, for example, the agency’s policies and procedures on dealing with fraud, internal investigations, and misconduct and disciplinary matters.

For example, if an employed internal auditor identifies fraud during a routine audit (and makes a report of that, which will be a mandatory PID), an agency will need to take appropriate action under its own fraud policy, such as by referring that information to an appropriate integrity agency and commencing its own internal investigation.

Even though the specific obligations in the PID Act for agencies dealing with voluntary PIDs do not apply to mandatory PIDs, agencies should also, as a matter of best practice, consider whether any of those obligations are relevant in the context of a mandatory PID.

For example, with voluntary PIDs agencies have obligations under the PID Act to:

• undertake a risk assessment
• inform the maker of the voluntary PID of the progress or outcome of any investigation
• maintain the confidentiality of the maker of the disclosure
• register and report the voluntary PID to the Ombudsman.

These obligations do not apply to mandatory PIDs.

This means that, unlike voluntary PIDs where it is imperative that agencies have in place processes to recognise and assess when a report is a voluntary PID, it may not always be necessary for agencies to identify and label a report as a ‘mandatory PID’.

That said, in some circumstances it would be best practice to consider whether some of the things that must be done if a disclosure is a voluntary PID should also be done when a mandatory PID is received — for example, undertaking a risk assessment, keeping the identity of the person who has made the disclosure confidential and informing that person of what is happening.

Take, for example, the situation where a voluntary PID is made to a manager, and that manager then (as they are legally required to do) makes a mandatory PID of the disclosure to the agency’s disclosure coordinator.

In that case, the agency is required under the PID Act to:

• undertake a risk assessment³
• take steps to mitigate the risk of detrimental action to the person who made the voluntary PID⁴
• maintain confidentiality⁵
• keep the maker of the voluntary PID informed of the progress and outcome of any investigation or other action taken in dealing with the disclosure.⁶

Although the PID Act does not require this, it would be prudent for the agency in this case to also consider whether a risk assessment should be extended to address any risks to the manager, and any steps needed to mitigate the risk of detrimental action to them. Those steps might include keeping the manager’s identity confidential as well. The agency should also consider whether the manager should also be kept informed of the progress and outcome of the matter.

Important note: Agencies that have staff who are subject to mandatory reporting requirements (and so who might be in a position of having to make mandatory PIDs) should ensure that their relevant policies and procedures provide appropriate guidance on what constitutes a mandatory PID and what protections are available. This guidance could be included either within the PID policy or as a separate policy. Other relevant policies (such as the agency’s fraud policy) should include, or cross-refer to, this guidance.

__________

^3. Public Interest Disclosures Act 2022, s 61.
^4. Public Interest Disclosures Act 2022, s 59(2).
^5. Public Interest Disclosures Act 2022, s 64.
^6. Public Interest Disclosures Act 2022, s 78.

Those who make mandatory PIDs are entitled to protections under the PID Act. These protections include:

• Immunity from civil and criminal liability that might otherwise arise because they made the report⁷
  For example, a public official when making the mandatory report, may breach a confidentiality or secrecy obligation that is a term of their employment. That person will not incur civil or criminal liability for breach of that obligation.

• Protection from detrimental action
  • it is an offence for someone to take detrimental action against a person who has made a mandatory PID⁸
  • the maker of a mandatory PID is entitled to seek compensation if they have suffered injury, damage or loss as a result of detrimental action being taken⁹
  • an order from the court (injunction) can be sought where detrimental action has been threatened or has occurred. This could include an order to prevent someone from being dismissed or seeking reinstatement if they have been dismissed. An agency or mandatory PID maker can make the application for an injunction.¹⁰

• Protection for disclosures of own past conduct
  A public official is not protected against liability for their own past conduct that is disclosed when they make a mandatory PID. For example, if a public official makes a mandatory PID and in doing so reveals their own misconduct they will not be protected from criminal or civil liability relating to that conduct.
  
  However, the Attorney General may give an undertaking to the person disclosing their own misconduct that the disclosure or the fact of the disclosure (whichever is applicable) will not be used in evidence against them in civil or criminal proceedings (except if proceedings are brought where the disclosure is false).¹¹
  
  An undertaking can be given either before the information is provided or after it has been disclosed.¹² An integrity agency can make a recommendation to the Attorney General that a person be given an undertaking.

__________

^7. Public Interest Disclosures Act 2022, s 40.
^8. Public Interest Disclosures Act 2022, s 33.
^9. Public Interest Disclosures Act 2022, s 35.
^10. Public Interest Disclosures Act 2022, s 37.
^11. Public Interest Disclosures Act 2022, s 41(2), (4).
^12. Public Interest Disclosures Act 2022, s 41(2).
^13. Public Interest Disclosures Act 2022, s 41(3).