Privacy and Transparency: Disclosing outcomes of misconduct complaints—a discussion paperThis paper seeks the views of the public, Australian Public Service (APS) agencies and employees about the extent to which information about the outcome of a misconduct complaint should be disclosed to the complainant and to others.

All APS agencies are encouraged to respond. In addition, the Australian Public Service Commission (the Commission) would like to hear from other interested stakeholders, including individuals who have reported suspected breaches of the APS Code of Conduct.

This paper has been developed in consultation with the Office of the Australian Information Commissioner (OAIC). Submissions will be shared with the OAIC and may be published on the Commission’s website unless respondents request otherwise.

Terms of referencePublic confidence in public administration is crucial to the effective working of government, and often depends on the proper balance of competing interests. Public confidence in the APS relies on a transparent, accountable public service—but also on due regard being had to the privacy of individuals and to the effective management of the APS.

In this context, the Commission is reviewing Service-wide practice for disclosure of information about the outcome of misconduct complaints.

Providing information about the outcome of complaints of misconduct should help to give confidence to complainants, employees, and the public that suspected misconduct is taken seriously and addressed appropriately by agencies. At the same time, however, an employee whose conduct has been called into question has the right to privacy and to expect that their personal information will not be unreasonably disclosed, nor their reputation unjustifiably damaged.

The Commission is therefore considering the following questions:

What information should be provided to people, including members of the public, who allege breaches of the APS Code of Conduct about the outcome of their complaints?

Should information about proven misconduct be disclosed to people other than complainants, such as the wider agency workforce?

If information should be disclosed to people other than the complainant, under what circumstances?

What do agencies need to consider in making decisions about these matters?

How to provide commentQuestions about the consultation may be directed to the Ethics Advisory Service on (02) 6202 3737. Please send your comments by 7 October 2014 to the Ethics Advisory Service: ethics@apsc.gov.au or by post to:

Ms Karin FisherAustralian Public Service Commission16 Furzer StreetPhillip, ACT 2606

Introduction

For some years the Australian Public Service Commission (the Commission) has provided guidance to Australian Public Service (APS) agencies and employees about disclosing

information to a person who has reported an alleged breach of the APS Code of Conduct about the outcome of their report. The Commission’s Circular 2008/3: Providing information on Code of Conduct investigation outcomes to complainants, developed in consultation with the then Office of the Privacy Commissioner, sought to help agencies to balance the competing considerations of privacy and transparency that apply in these circumstances: for example, the need to protect the privacy of employees about whom allegations have been made, and to assure employees who make complaints that suspected Code of Conduct breaches are taken seriously and dealt with properly.

Nevertheless, recent cases, as well as enquiries to the Commission’s Ethics Advisory Service, have highlighted a tendency across the APS to err on the side of non-disclosure—a tendency apparently underpinned by agencies’ concern that providing more than the minimum of information could constitute a breach of the Privacy Act 1988. Agencies’ hesitancy to provide information about the outcomes of misconduct complaints has left them vulnerable to criticism by the public and by the Courts, which risks undermining public confidence in the administration of the APS. Last year the Commission undertook to consult publicly on these matters.

This paper examines the relationship between public and private interests, namely:

1. the private interests of APS employees; in particular, their right to privacy and the protection of their reputation,

2. a complainant’s right to seek access to government information, and their expectation of being informed of how alleged misconduct (including matters that may have affected them adversely) has been handled,

3. the public interest, including the interest of employees, in knowing that an agency handles suspected misconduct appropriately, and

4. the public interest in the protection of individuals’ privacy.

Views on the right balance in upholding these competing interests will inform new guidance to APS agency heads on good practice in disclosing information to complainants, and others, about the outcome of misconduct complaints. The Commission will consult the Office of the Australian Information Commissioner in developing the new guidance.

Disclosing outcomes of misconduct complaints

1. Existing guidance on disclosing information to complainantsAgency heads, APS employees, and certain statutory office holders are bound by the APS Code of Conduct, set out in section 13 of the Public Service Act 1999 (the PS Act), which codifies required standards of behaviour. Taking action in cases of suspected misconduct is primarily aimed at protecting the integrity of the APS and thereby maintaining public confidence in public administration, rather than aiming to ‘punish’ the employee as such. Sanctions are intended to be proportionate to the nature of the breach, to be a deterrent to others and to demonstrate that misconduct is not tolerated in the agency.

Circular 2008/3: Providing information on Code of Conduct investigation outcomes to complainants contains the Commission’s current advice on this matter. It describes the considerations for APS agencies in deciding the extent of the information to be given to complainants about the outcome of their complaints, in the context of the restrictions in the Privacy Act on the use and disclosure of personal information. A sample letter to complainants advising the outcome of a Code of Conduct investigation is provided in the circular.

Nevertheless, agencies appear to be uncertain about the extent of their capacity to disclose information about the outcomes of complaints. This may be due in part to some inconsistency in the guidance; or it may be that the guidance does not provide enough information or illustrate clearly enough the issues for consideration.

The Commission is seeking feedback on, among other things, how the guidance could be improved.

2. Right to privacy and reputation Like other citizens, APS employees have a right to the protection of their ‘privacy and reputation’. This right stems, in principle, from article 17 of the International Covenant on Civil and Political Rights, and is given practical, enforceable effect in Australia by the Privacy Act 1988. Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks.

The statutory protection of privacy and reputation recognises the fact that our reputations are important; a person’s reputation is a public matter informed by what is known about that person, and may be enhanced or diminished by the nature of that information. As such, an individual’s right to the protection of their reputation arguably imposes an obligation on others to consider the impact on reputation of the information they put into the public domain.

These rights to privacy and the protection of reputation are not absolute. Rather, they need to be balanced against competing public interest considerations, such as the need to maintain national security, confidence in the integrity of Government administration, the protection of public health, or the protection of the rights and freedoms of other people.

This balance of competing public interests is reflected in the Privacy Act.

The Privacy Act recognises and protects individuals’ right to privacy. It establishes rules that regulate the handling of ‘personal information’1 about individuals: namely, the Australian Privacy Principles (APPs).

The APPs are legally binding principles which are the cornerstone of the privacy protection framework in the Privacy Act. The APPs set out the standards, rights and obligations in relation to handling, holding, accessing and correcting personal information. Common examples of personal information are an individual’s name, signature, address, telephone number, date of birth, medical records, bank account details, employment details and commentary or opinion about a person.

The Privacy Act also recognises that the right to privacy is not absolute and needs to be balanced against other matters. While the APPs impose limits on the use and disclosure of personal information about individuals, they also provide that personal information may be used or disclosed in some circumstances.

Australian Privacy Principle 6 sets out the requirements in relation to the use or disclosure of personal information. Personal information should generally only be used or disclosed for the purpose for which it was collected (known as the ‘primary purpose’), or for a secondary purpose if an exception applies. There are a number of exceptions to APP 6 that may permit the disclosure of personal information for a secondary purpose, including:

where the individual reasonably expects the disclosure and the purpose of the disclosure relates to the primary purpose of collection (or for sensitive information, these purposes are directly related) (APP 6.2(a)); or

where the disclosure is required or authorised by an Australian law or a court/tribunal order (APP 6.2(b)).2

1 The Privacy Act defines ‘personal information’ as information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is

true or not; and (b) whether the information or opinion is recorded in a material form or not.

2 The Office of the Australian Information Commissioner advises that even if a disclosure is authorised by law, good privacy practice involves:

wherever possible, only disclosing de-identified information

For the purposes of use or disclosure of personal information relating to reports of alleged Code of Conduct breaches, an authorisation of this kind may be provided by Regulation 9.2 of the Public Service Regulations 1999, which authorises disclosure and use of personal information where it is necessary or relevant to an agency head’s employer powers.

Overall, the legal framework that applies to APS agencies and employees recognises that employees’ personal information can sometimes be disclosed, and may need to be disclosed where doing so would serve the broader public interest.

3. Other relevant APS-wide legislation concerning privacyIn 2010 and 2013 respectively, the then Government led the passage through Parliament of amendments to the Freedom of Information Act 1982, and of the Public Interest Disclosure Act 2013.

3.1 Freedom of Information ActThe Freedom of Information Act 1982 (FOI Act) operates on the premise that information should be disclosed unless there is good reason not to do so. Notably, personal information may be exempt from disclosure if its disclosure would be unreasonable and, in the circumstances, access to the information at that time would be contrary to the public interest (section 47F and subsection 11A(5)). ‘Public interest’ is not defined in the Act, nor in the Australian Information Commissioner’s FOI Guidelines, which note that decision-makers are instead encouraged to analyse what constitutes public interest in a given set of circumstances (paragraph 6.8).3

3.2 Public Interest Disclosure ActThe Public Interest Disclosure Act 2013 (PID Act), which came into effect on 15 January 2014, provides for employees, former employees and others to report wrongdoing by public officials in the Commonwealth public sector.

The PID Act requires certain information to be provided to a person who has made a public interest disclosure (a ‘discloser’) about the progress and the outcome of their disclosure. The discloser must be given a copy of the investigation report (s.51), which must set out, among other things, the matters considered in the course of the investigation, the findings of the investigation, and any action taken as a result. The PID Act acknowledges, however, that the discloser’s right to this information is not absolute, and provides that information may be deleted from the report given to the discloser if, among other things, it identifies a person or would be exempt under the FOI Act.

While the PID Act supports the disclosure of information to complainants, agency heads are required nonetheless to exercise judgement and to balance competing considerations for and against disclosure in relation to matters reported under that Act.

if needing to disclose personal information for a particular purpose, disclose the minimum amount of personal information necessary or relevant for that purpose; and

giving the individual notice about the handling of their personal information so there will be a reasonable expectation of that disclosure.3 The FOI Guidelines provide an indicative list of factors in favour of disclosure, which includes circumstances where the disclosure would contribute to the administration of justice (paragraphs 6.23–25). At the same time, the Guidelines acknowledge that harm may result from the disclosure of some types of documents in certain circumstances; for example, where disclosure could prejudice an investigation, or unreasonably affect a person’s privacy. The Guidelines provide an indicative list of factors against disclosure, including where disclosure could reasonably be expected to prejudice the fair treatment of individuals and the information is about unsubstantiated allegations of misconduct or unlawful, negligent or improper conduct, or where it could reasonably be expected to prejudice an agency’s ability to obtain confidential information, or to obtain similar information in the future (paragraphs 6.26–29).

4. Recent CasesRecent cases have indicated that a greater degree of disclosure is acceptable to the community than the Commission’s existing guidance suggests.

In Banerji v Bowles [2013] FCCA 1052 (dealing principally with public comment and the right to freedom of expression rather than the right to privacy) it was noted by the Court that the applicant had previously made a complaint against another employee in the agency, whose conduct was investigated as a result, and had been given a letter advising her that ‘appropriate action’ had been taken by the agency in relation to her complaint but that the Privacy Act prevented disclosure of any relevant details. In commenting on this matter, Neville J said:

the letter is (a) less than informative (or otherwise illuminating), and (b) classic ‘Yes Minister’ speak.

The judge questioned how a complainant might obtain any relevant information or raise any questions about a matter that involved serious misconduct if they were told that no relevant information could be provided, and noted that ‘such an information vacuum might understandably give rise to a certain angst or tension in the workplace, which is not necessarily of the complainant’s making.’

Similarly, in ‘J’ and Department of Health and Ageing [2013] AICmr 21 (8 March 2013), which concerned a complainant’s request for information about the outcome of an investigation, the Australian Information Commissioner stated:

[T]o the extent that … a disclosure demonstrates that an investigation has been properly undertaken, that disclosure will improve general confidence in an agency’s capacity to conduct future investigations.

Importantly, the Information Commissioner also noted that the result of the complainant’s freedom of information request might have been different if the agency had provided more information and more detail—‘not necessarily in written form’—in the first instance about the outcome of the investigation.

This case also referenced Carver and Fair Work Ombudsman [2011] AICmr 5 , in which it was noted that wide disclosure of evidence provided to misconduct investigations:

could reasonably be expected to affect the willingness of people to provide evidence for future Code of Conduct investigations which, in turn, would have a substantial adverse effect on the management … of the agency’s personnel.

5. Further considerationsInherent in the Privacy Act is the recognition that others will, in certain circumstances, have a legitimate interest in knowing information about a person. An employee’s right to privacy and protection of reputation can be in tension with another person’s interest in knowing the outcome of matters that affect their interests; with an agency’s obligation to foster workplace harmony and productivity; and with the broader public interest in the APS dealing properly with allegations of misconduct.

5.1 The private interests of the subject of the complaint

APS employees who are the subject of conduct complaints have a right to privacy.

An employee’s reputation and standing with their employer (and potentially with colleagues) can be damaged by the mere fact of an allegation being made against them. The outcome of disclosing personal information may also include damage to working and private relationships; stress; embarrassment; and an unwillingness to respond frankly and openly in the investigation. The extent of the damage increases where a breach of the Code of Conduct is found.

At the same time, if an employee has breached the Code of Conduct, it might be argued that they caused, or contributed to, their own loss of reputation.

Where an employee has done the wrong thing, should their agency protect their reputation where damage to it would be caused simply by others knowing of the wrongdoing?

Where an employee hasn’t done the wrong thing, or the issue is a small one that doesn’t raise matters of genuine public interest, then what expectation of privacy would it be reasonable for an employee to hold?

5.2 The complainant’s right to request access to information Recent matters considered by the Courts and by the Australian Information Commissioner support the view that complainants have a legitimate interest in knowing that an agency has taken their complaint seriously, has considered it in good faith, and has taken appropriate action. Other considerations may also apply.

5.2.1 If the complainant is an APS employee

A complainant who is also an APS employee can expect a safe, harmonious working environment where they are supported by their employer; where complaints are resolved properly and promptly; and where review can be sought for actions that affect them adversely.

When employees are given too little information about the outcome of a complaint they have made, their trust in their employer and their engagement with their workplace may be undermined. It may also be important to consider the likelihood of the employee escalating the matter or making further complaints if they are not satisfied that it has been dealt with adequately4.

Where the complainant is an employee, to what extent should the agency consider the effects on their workplace engagement of the employee (and others in the workplace) being given, or not given, personal information about other employees concerning the outcome of their complaint?

5.2.2 If the complainant is a member of the public

If the complainant is a member of the public there is, similarly, a risk that the matter will be escalated (e.g. to the Minister) or made public if the complainant believes that an agency has not handled their complaint appropriately. A complainant may perceive lack of information from an agency as evidence of inappropriate handling.

When deciding how much information to provide to a complainant who is a member of the public, and the nature of that information, what is sufficient to limit adverse effects on public confidence in public administration?

5.2.3 If the complainant has a personal interest in the outcome

Whether a complainant is an employee or a member of the public, if they have a personal interest in the matter they may seek more detailed information to assess whether the agency has handled their complaint appropriately. However, this interest does not give employees the right to access all the information relating to the matter.

Where, for example, an employee is seeking records of statements made by witnesses, it may be reasonable not to provide these on the grounds that doing so could reasonably be expected to

4 If the matter was treated as a public interest disclosure in accordance with the Public Interest Disclosure Act 2013, the person who has made the disclosure may make their disclosure to a third party, such as the media, in circumstances including where the discloser believes on reasonable grounds that the investigation of the matter, or the agency’s response to the investigation, was inadequate (s.26).

compromise employees’ willingness to provide information to future inquiries5, or otherwise compromise the privacy or reputation of third parties.

Sometimes complainants may seek evidence that an agency has ‘punished’ the employee about whom they have complained. This is, to a certain extent, an understandable desire which is perhaps best acknowledged but not encouraged, although the severity of a sanction might equally be seen as a measure of how seriously an agency deals with behaviour of the kind complained about. Having said that, the misconduct provisions in the Public Service Act are primarily aimed at protecting the integrity of the APS and thereby maintaining public confidence in public administration, rather than aiming to ‘punish’ the employee per se.

In cases where the alleged misconduct may have damaged the complainant’s reputation, the complainant may have an interest in further disclosure of information about the outcome of their complaint; for example, where the complainant has been publicly insulted by an employee. If an agency discloses to its employees at large that an instance of misconduct has been discovered and addressed properly, the disclosure can also have the effect of restoring the reputation of the complainant where it has been damaged by the behaviour. On the other hand, there may be cases in which information about a breach should not be made public in order to protect the privacy or reputation of a person harmed by the misconduct.

If a complainant has a personal interest in the matter is it reasonable to provide them with more information about the outcome than would otherwise be the case, and if so what information should be provided?

If a complainant has a personal interest in wider disclosure of the outcome of their complaint, under what circumstances would it be reasonable to disclose the outcome of the complaint more broadly?

5.2.4 If the complainant is a witness

If a complainant’s interests have not been adversely affected by the unacceptable behaviour of an employee, it may be argued that they have no interest over and above that of any other member of the public, or of the agency’s workforce, in knowing the outcome of their complaint. They might be regarded as a witness, or an ‘informant’, to suspected misconduct (with no personal interest in the conduct or in the outcome of the investigation); a disinterested bystander who has information of use to an agency in maintaining public confidence in public administration.

However, even an informant might be said to have an interest in knowing the outcome of unacceptable behaviour that they have identified and helped to address. In particular, they may be reassured to know that the matter they reported has been dealt with properly, fairly, and given due weight6.

What level of detail about the outcome should be provided to a complainant who is simply a witness?

5.3 Disclosure in the public interest

5.3.1 Disclosure within an agency

The Organisation for Economic Co-operation and Development (OECD) recognises the importance of ‘communication about integrity violations’:

When an investigation occurs in an organisational unit, this will usually cause unrest and an urgent need for information within that unit. […] Well-prepared communication can

5 This point was made in ‘J’ and Department of Health and Ageing [2013] AICmr 21 (8 March 2013).6 This interest is acknowledged and protected in the PID Act.

help to reduce the damage both within the organisation and to the organisation’s outside image.7

Commission guidance has for some years made the point that a high performing and ethical workplace requires employees to know the standards of behaviour expected of them and the consequences for not adhering to those standards. Employees also need to have confidence that their agency will address suspected breaches of those standards in a timely, vigorous and systematic way, that misconduct action will be even-handed and that sanctions imposed will be fair, have substance and will be applied consistently8.

Agencies arguably have an obligation to inform their workforces of actions taken to enforce standards of conduct, and doing so could, in turn, contribute to the agency’s productivity and performance, as well as its integrity and that of the broader APS. In this respect the rights of management coincide with the public interest in maintaining public confidence not only in the integrity, but also the quality, of public administration.

Disclosing information within the agency, either to all employees or to local work areas in which the alleged misconduct occurred, may also give confidence to employees that their agency manages misconduct appropriately. The arguments in favour of disclosure in these circumstances are stronger if it is assumed that the identities of employees alleged or found to have breached the Code of Conduct (or, where relevant, their victims) are not made known. This may be feasible in large agencies but relatively impracticable in small ones—though in many cases, regardless of agency size, it may be impossible to provide sufficient information without disclosing personal information about the person investigated.

How can agencies best demonstrate to their employees that standards of conduct are being upheld when investigations have occurred?

Should employees expect the finding of breach to be made known as a necessary consequence of their wrongdoing?

5.3.2 Disclosure to the public

There may be circumstances in which it is appropriate to disclose to the broader public the outcome of a misconduct complaint9; perhaps, for example, where the complaint has already been made public by the complainant. In these circumstances, providing information about the outcome may help to repair public confidence in the agency or the APS.

How can agencies best demonstrate to the public that standards of conduct are being upheld where allegations of misconduct have been made public?

What are the circumstances where public disclosure may be appropriate?

5.4 Factors impacting on disclosure decisions

5.4.1 Control of information

Where information has been disclosed about the outcome of a complaint, it is possible for that information to be disseminated more broadly than intended. As the Australian Information Commissioner noted recently in ‘BA’ and the Merit Protection Commissioner [2014] AICmr (30 January 2014), in relation to a promotion decision and information obtained under the FOI Act:

It is now considerably easier for a person who has obtained information under the FOI Act to disseminate that information widely, to do so anonymously and to comment upon

7 Global Forum on Public Governance: Towards a Sound Integrity Framework: Instruments, Processes, Structures and Conditions for Implementation. 4-5 May 2009. OECD Conference Centre, Paris, France; p.58.8 Embedding the APS Values, Commonwealth of Australia, 2003 and Handling Misconduct, a human resource practitioner’s guide to the reporting and handling of suspected and determined breaches of the APS Code of Conduct http://www.apsc.gov.au/publications-and-media/current-publications/handling-misconduct9 The name of an employee whose employment has been terminated for reasons of misconduct is notified in the APS Gazette.

or even alter that information. The view taken in earlier cases – that a successful applicant’s claims should be opened to public scrutiny and their claim to privacy should be deemed as abandoned – takes on a different hue when the publication and scrutiny can occur on the web or through email interchange. Material that is published on the web may remain publicly available for an indefinite period. It may cause anxiety to a public servant that material about their suitability for a particular appointment can be publicly available long after the appointment and to an indeterminate audience.

APS employees to whom information is disclosed may be directed by their agency not to disclose that information further. Where a complainant is a member of the public, the risk is greater that information may be disclosed more broadly. It may be possible in these circumstances to come to an agreement not to disclose information further; enforcement, however, may be difficult.

5.4.2 De-identification

In some cases agencies may be able to resolve the question of balancing privacy and reputational rights of employees and the demand to disclose information by ‘de-identifying’ that information.

Personal information can become de-identified if the information is no longer about an identifiable individual or an individual who is reasonably identifiable. De-identification involves removing or altering information that identifies an individual or is reasonably likely to do so. De-identified information is not personal information.

Generally, de-identification includes two steps:

removing personal identifiers, such as an individual’s name, address, date of birth or other identifying information, and

removing or altering other information that may allow an individual to be identified, for example, because of a rare characteristic of the individual, or a combination of unique or remarkable characteristics that enable identification.

5.4.3 Action to address the complaint

In some cases, no investigation will be started because the complaint was spurious, or the complaint was a reasonable one but the agency does not consider the matter to be serious, or even a potential breach of the Code. In these cases, it may be useful for the agency to explain their reasoning carefully and sensitively to the complainant, and work with the complainant (and others, where necessary) to help them understand the situation and, where appropriate, restore relationships in the workplace.

Where the complaint that has been made is spurious, or repeated and without substance, it is useful to consider the extent to which engaging with the complainant would be of benefit, and it may be appropriate in these circumstances for the agency simply to advise the complainant that it has considered the matter and decided not to conduct an investigation, and the reasons why. This approach is consistent with recommendations for handling persistent complainants; for example:

It is potentially … productive to clarify the limitations inherent in the … complaints procedures that cannot provide the types of retribution and vindication sought, however justified the cause.10 […] The objective is to assist in resolving what can be resolved […] When what can be done has been done the case needs to be sympathetically but firmly closed…11

5.4.4 Action outside the misconduct framework

10 ‘Vexatious litigants and unusually persistent complainants and petitioners: From querulous paranoia to querulous behaviour’. Behavioural Sciences and the Law 24, 333–349 (2006). p.342.11 Ibid., p. 347.

It may be reasonable for an agency to choose to address poor behaviour through, for example, its performance management framework, rather than treating it as a suspected breach of the Code of Conduct. Where this is the case, the complainant might be reassured by the knowledge that the matter is being addressed by the agency through a process designed to improve the employee’s behaviour—an outcome not always achievable through the misconduct framework.

5.4.5 Breach determination and sanction

Similar considerations to the handling of complaints of minor poor behaviour apply if an investigation takes place but no breach is found.

Where a breach of the Code of Conduct has been determined, an agency will need to consider whether to disclose information about the sanction decision. Information that a sanction has been imposed can provide an indication of how seriously the agency views the matter.

That said, sanction decisions are made not only on the basis of the objective seriousness of the breach, but also taking into account the circumstances that apply in the specific case—e.g. prior behaviour, mitigating factors, length of service.

If information about a sanction decision is provided, would it also be appropriate in some cases to provide information, in broad terms, about particular considerations applying to the imposition of the sanction?

6. Proposed principles and supporting guidanceGiven the competing considerations discussed in this paper, the Commission has developed draft principles and supporting guidance for decision-makers when considering what information should be provided to complainants and others on the outcomes of reports of suspected misconduct. Views are sought on these draft principles and guidance. Once settled the supporting guidance may be supplemented with examples.

Proposed principles governing disclosure

A. Agencies should provide enough information to assure a reasonable complainant that the matter has been dealt with properly.

B. Agencies should provide enough information to assure employees and the public that complaints are dealt with fairly and effectively.

C. Generally, the more harm done to the complainant and/or the agency as a consequence of the misconduct, the more information should be provided.

D. Before any disclosure is made, the views of the employee who is the subject of the complaint should be sought and taken into consideration.

11

Supporting guidance

Minimum informationSubject to Principle D, generally the following information should be provided to a complainant as a minimum:

Whether the matter was investigated using the agency’s procedures made under s15(3) of the PS Act;

If the matter was not investigated, why not; and If the matter was investigated, whether a breach was found.

Approaches to restricting further disclosureWhen considering how much information to disclose to a complainant, the following approaches may be useful in preventing further disclosure of the information:

Will the complainant agree not to disseminate the information? Can a direction be made in this respect (i.e. if the complainant is an employee)? Can the disclosure be made in a way that makes further dissemination more difficult (e.g.

orally)?

Non-disclosure where there is a risk of harmAn agency head may decide not to disclose information where he or she is satisfied that there is a risk of harm that would outweigh the public interest of disclosure. This might include, for example, circumstances where disclosure:

May pose a serious threat to life, health or safety; Would entail an unreasonable disclosure of the personal information of a third party (other

than the subject of the complaint); Would prejudice another investigation; May discourage witnesses from coming forward in the future; or Would cause unreasonable harm to the reputation of the agency or the employee.

De-identified information

Agencies should consider whether any personal information needs to be disclosed to achieve a particular purpose and if not, wherever possible, disclose de-identified information.

Record keeping and access

A record should be made of the factors informing any decision not to provide the minimum information to the complainant. Any oral disclosure of information should also be recorded.

Requests for information about the outcome of a complaint of misconduct made under the Freedom of Information Act 1982 or the Privacy Act 1988 should be dealt with in accordance with those Acts.

7. Questions on which views are soughtQuestions have been posed throughout this document which are designed to help readers consider the issues raised. The questions on which views are sought are as follows:

1. Are the proposed principles sound?a. Do they reflect an appropriate balance between the interests of the

complainant; the person alleged to have breached the Code of Conduct; the agency; and the public?

b. Are there any unintended consequences that may arise from the application of these principles?

c. Are there cases of which agencies are aware where the proposed principles would not apply, or would be impracticable?

2. Is the proposed supporting guidance practical?a. What other information would be useful for agencies to help them implement

the proposed principles?b. What other information do complainants need to know about how privacy in

relation to complainants of misconduct are handled generally in the APS?3. Do the proposed principles and the supporting guidance together provide a sound

framework for deciding what information to disclose following a complaint of a breach of the Code of Conduct?

12