Receiving and managing public interest disclosures

The Public Interest Disclosure Act 2010 (PID Act) and the Queensland Ombudsman’s Public Interest Disclosure Standard No 1 set out the requirements for organisations responding to a PID.

A system for managing public interest disclosure

The Queensland Ombudsman’s PID standard requires that organisations have a management plan for PIDs. 

Under the standard, an organisation must have a plan that:

  • commits the organisation’s management to acting on reports of suspected wrongdoing and providing support to disclosers
  • establishes all the necessary elements of an effective PID program including:
    • processes to support, protect and communicate with disclosers
    • arrangements to assess and investigate PIDs
    • PID recordkeeping and reporting  to the oversight body, the Queensland Ombudsman
    • education and training about PIDs
    • arrangements for review and coordination of the PID program.

An organisation required to publish its PID procedure on its website.  

In practice, an organisation’s systems for managing PIDs are usually part of the wider process of maintaining an ethical and effective workplace. PID management is closely connected with the entity’s Code of Conduct, corruption prevention activities and the complaints management system.

Responding to a public interest disclosure

When a PID is received, the organisation must respond to the disclosure. The PID Act sets the requirements for managing a PID and the organisation’s own policy will provide guidance on managing the response process. The response to a PID will usually have four key components.

1. Assess

When an allegation of wrongdoing is made, the organisation is required to assess it to determine whether or not the matter is a PID. If the organisation assesses the matter as a PID, it must then determine the appropriate action to take, including whether or not the matter should be referred to another organisation (e.g. another organisation that has the power to investigate); or be investigated or otherwise dealt with.  

2. Confidentiality, recording and reporting

Strict confidentiality requirements apply to PIDs. Confidential PID information can be recorded or disclosed:

  • to administer the PID Act or to discharge a function under another Act (for example, to investigate something disclosed by a PID)
  • for a proceeding in a court or tribunal
  • with the consent of the person the information relates to (or if the consent of the person cannot be reasonably obtained, if the information is unlikely to harm the interests of the person) or
  • if it is essential under the principles of natural justice and reprisal is unlikely.

Organisations have specific obligations about how they record PIDs that they receive. This includes:

  • details of the PID including the name of the person making the disclosure (if known)
  • the information disclosed
  • any action taken on the disclosure
  • any other information required under the PID standard.

Organisations must report information about PIDs they have received, the Queensland Ombudsman. The Ombudsman reports statistical information in the Office’s annual report to the Parliament.

3. Support the discloser

When a disclosure has been made, an organisation must:

  • provide the discloser with confirmation of the receipt of the PID 
  • describe the action taken or proposed to be taken in respect of the PID;  or if the organisation believes no action is required, the reasons for this decision
  • if action has been taken in relation to the PID, inform the discloser of the results.

The PID Act makes reprisal against a discloser, or someone helping with a PID investigation, an offence; it also makes an organisation vicariously liable if any of the organisation’s employees attempt or cause reprisal against a discloser (whether a public officer or a member of the public). Chief executive officers have specific obligations to ensure public officers who make a PID are supported and offered protection from reprisal.  

4. Act on findings

When a PID investigation is completed, the organisation has an obligation to deal with the findings appropriately. For example, an initial response to confirm wrongdoing could be disciplinary action against a public sector officer and a systemic response could be to improve procedures or provide training.