Circular 2008/3: Providing information on Code of Conduct investigation outcomes to complainants

This circular provides guidance about what information Australian Public Service (APS) agencies can or should give complainants about the outcome of their complaints.

2. Complainants have a legitimate interest in knowing that alleged ‘wrongs’ have been addressed. Complainants should be given sufficient information to provide assurance that the agency:

• has taken the allegation seriously
• does not tolerate behaviour that is inconsistent with the APS Code of Conduct
• has imposed an appropriate sanction where a breach has been found
• has taken appropriate steps to ensure the problem will not recur.

3. However, when considering what information to provide to complainants to ensure confidence in public administration, agencies need to balance:

• individual employees’ right to privacy, the protection of personal information about individual employees and the agencies’ obligations in regard to this information under the Privacy Act 1988 (Privacy Act); and
• the need to take reasonable steps to be transparent and accountable to other parties involved.

4. Agencies can provide general information to complainants about the outcome of investigations. However, personal information about the employee who is subject to the investigation should only be provided where certain conditions are met.

5. Consideration should be given to the circumstances of each individual case when deciding if, and to whom, personal information might be released. Deliberations about any disclosure of personal information about an employee will be informed by the:

• nature and seriousness of the misconduct
• likelihood of consequences to the person about whom the information relates
• agency’s context (such as the type of information the agency or employee deals with).

6. This circular has been developed in consultation with the Office of the Privacy Commissioner. It provides an explanation of the Public Service Act 1999 (PS Act) and Privacy Act provisions that apply, what processes agencies should follow to ensure they comply and what issues they might consider when responding to complainants.

APS Code of Conduct

7. Section 13 of the PS Act sets out the APS Code of Conduct governing APS employees. Taken together with other elements of the PS Act, the Code establishes standards for the behaviour of APS employees, as well as an enforcement mechanism that can lead to a variety of sanctions being imposed on employees who breach the Code, up to and including termination of employment. Alleged breaches of the Code are investigated in accordance with agency procedures established under section 15(3) of the PS Act. This circular is relevant to whistleblowing investigations as well as other Code of Conduct investigations.

8. The outcome of an investigation may also involve remedial action where an APS employee is not found to have breached the Code of Conduct, but where the agency considers that steps should be taken to ensure the situation does not recur.

The Privacy Act

9. The Privacy Act, whichapplies to a wider range of agencies than are covered by the PS Act, recognises that there is a legitimate need to realise people’s expectations of privacy in the handling of their personal information.

10.Personal information is defined in section 6 of the Privacy Act as ‘information or an opinion … about an individual … whose identity is apparent, or can reasonably be ascertained, from the information or opinion’.

11. Withholding a person’s name may not be sufficient to protect that person’s identity. Personal information can include any information or opinion from which a person’s identity is apparent or may be ‘reasonably ascertained’. For example, in a small agency or in a rural or regional area, information about an employee’s work area or location or even the type of complaint itself may be sufficient to identify that person. This should be taken into account when considering what information to release to a third party and whether to release it.

Sensitive information

12. Sensitive information is defined in section 6 of the Privacy Act and is a part of personal information. Although sensitive information is not accorded special protection under the Information Privacy Principles (IPPs), agencies are advised to take particular care when handling sensitive information about an employee.

Good privacy practice would mean that sensitive information about an employee may not be used or disclosed to a third party without the employee’s express consent.

Information Privacy Principles

13. The IPPs apply to personal information contained in a written record. This information may include personal information about an employee and could be contained in letters, statements, file notes about the complaint handling process or notes taken by any party to the complaint.

14. Set out in section 14 of the Privacy Act, the IPPs govern the way personal information is handled. This includes, among other things:

• collection, use and disclosure
• what information the individual is given about the collection, including any authority for the collection and the use and/or disclosure of the information
• storage and security
• access (and correction) by the individual to information about themselves.

15. Agencies should make employees aware of their responsibilities under the Privacy Act and the IPPs when handling clients’ personal information. Employees should also be made aware of their agency’s obligations in regard to the handling of their own personal information. Ideally, employees should be made aware of these obligations on their commencement with the agency (for example, during the agency’s induction programmes).

IPP 2 notice

16. IPP 2 requires that an agency collecting personal information from an individual, including from an APS employee, should take reasonable steps to ensure that the individual is generally aware of certain things related to the collection. These include:

• the purpose for which the information is being collected
• any legal authority or requirement for the collection
• any usual disclosures made of that information.

17. An IPP 2 notice may give an agency head discretion to disclose personal information about an employee in some circumstances.

Good privacy practice would mean that, in order for an agency to meet its obligations under the Privacy Act, any collection of personal information by an agency from an APS employee would always be accompanied by an IPP 2 notice.

18. Agencies could also take opportunities to remind employees at regular intervals about instances where personal information about them may be disclosed, and to whom (this could be done, for example, during the performance management cycle).

IPP 10 (use) and IPP 11 (disclosure)

19. IPP 10 (use) and IPP 11 (disclosure) provide that personal information will not be used or disclosed, other than for the purpose it was obtained, unless one of a number of exceptions apply.

20. Exceptions, in both IPP 10 and IPP 11, include consent by the individual to the use (generally, this is where information is used internally by the agency) or disclosure of that information (generally, this is where information is made available to a third party outside the agency).

21. IPP 11(1)(a) also allows the disclosure of personal information if the individual concerned is reasonably likely to be aware or has been made aware under IPP 2 (through an IPP 2 notice as discussed above) that personal information of that kind is usually passed on to that particular person, body or agency.

Good privacy practice would mean that agencies inform employees on engagement, and at regular intervals, about the agency’s policy in relation to complaint enquiries, Code of Conduct investigations and the impact this may have.

Responding to a complaint

22. Complainants who raise issues about an APS employee’s actions or behaviour, or the processes, actions or conduct of an agency, often receive only basic information from the agency about the outcome of the investigation into their complaint.

23. Giving a complainant little or no information about the outcome of an investigation can create problems if an agency fails to assure the complainant that the issue has been dealt with properly. This lack of information may undermine confidence in public administration and lead to further claims, complaints or litigation (including requests for review, whistleblower reports and applications under the Freedom of Information Act 1982).

24. Concern over employees’ privacy or the Privacy Act itself is often cited by agencies as the reason not to disclose any information about the handling of a complaint or the outcome of an investigation to a complainant. In these circumstances, agencies often refer to the IPPs.

25. Agencies should exercise care that they do not overstate or misinterpret the effect of the Privacy Act when declining to provide information to complainants on the handling of a complaint or any remedial action taken as a result of the complaint.

26. There may be other reasons why an agency is reluctant to discuss a complaint. An agency may find, for example, when investigating a complaint that appropriate policies or measures (such as manuals, adequate training or counselling in regard to an employee’s behaviour) had not been initiated or developed by the agency. It would be inappropriate in these circumstances to cite the Privacy Act as a reason why information about the complaint investigation should not be disclosed.

Investigating a complaint

27. At the beginning of an investigation about a complaint, agencies should (among other things) ensure that the employee who is the subject of an investigation is familiar with the agency’s policy in regard to complaint handling. Agencies should advise the employee being investigated, in writing, that a complaint investigation is underway, what the complaint is about and that personal information about them may be disclosed to others, where necessary and appropriate. The agency should answer any questions the employee may have at this time about the policy and the complaint under investigation.

28. It will, therefore, be to an agency’s advantage to ensure that its IPP 2 notices are as specific as is reasonably possible to ensure that employees are aware or reasonably likely to be aware to whom their personal information may be disclosed.

29. The investigation of a complaint should be conducted in accordance with agency Code of Conduct procedures.

30. Likewise, other parties to the investigation such as the complainant and any witnesses should be advised that personal information relating to them may be disclosed to the employee and others where necessary and appropriate. Any personal information about the complainant or witnesses should be handled in accordance with the agency’s obligations under the Privacy Act.

31. Where an investigation has been completed and part of the recommendation is for the employee’s personal information to be released to another person, body or agency (including the complainant), the individual concerned should be advised and provided with an opportunity to respond to the proposed release of their personal information prior to release. In other words, the principles of procedural fairness should be applied. A reasonable timeframe, understood by both parties, should be allowed for this response and should be sufficient to allow, for example, the employee to seek advice as necessary.

32. Records should be kept of any decisions to disclose personal information about an employee to another person, body or agency.

33. Sample clauses on disclosing information for inclusion in agency Code of Conduct procedures are at Attachment A.

Factors to consider before releasing personal information

34. Personal information relating to the investigation of a complaint must be handled within the boundaries set by the Privacy Act and the PS Act.

35. The primary consideration for agencies should be that disclosure of personal information (under IPP 11) regarding misconduct is managed in such a way that an employee’s identity is not revealed unless it is necessary, appropriate and reasonable to do so. This is particularly important where the complainant is employed in the same agency.

Achieving a balance

36. There is a further requirement to achieve an appropriate balance between the needs of the employee, the agency and the complainant in relation to the use and disclosure of personal information. Agency heads (or their delegates) should exercise judgement on a case by case basis when considering what personal information about an employee should be released to a complainant.

37. It should be possible in most circumstances to give a complainant adequate information about the way their complaint has been handled without disclosing personal information about an employee.

38. Issues that may be considered include, but are not limited to:

• the content and level of detail of personal information to be released (Can general information about the handling of the complaint be provided without disclosing personal information about the employee? This would be possible in many circumstances and would be the preferred option.)
• the need to disclose the information (Is it necessary? What is the aim of the disclosure and what will be achieved? Is this proportionate to the breach involved?)
• to whom the information is to be disclosed (For example, the complainant, other Commonwealth bodies, parliamentary committees or other stakeholders.)
• the employee’s right to privacy or any potential damage to their reputation and career (Is this proportionate to the breach involved?)
• the employee’s classification level and length of service (For senior and/or long serving employees, there are generally higher expectations to meet behavioural standards.)
• the nature and seriousness of the misconduct
• the seriousness and impact of the misconduct on the complainant (Will lack of disclosure exacerbate the negative impact on the complainant and result in further claims, complaints or litigation?)
• the physical safety or personal wellbeing of the employee
• the ‘public interest’ aspect (Are there national security considerations or significant risks to the health and safety of the public? Are these considerations or risks proportionate to the breach involved?)
• the prevalence of the type of misconduct and the need to highlight particular cases for education, deterrence or prevention (For example, systemic and serious misuse of the agency’s clients’ personal information.)
• the protection of an agency’s good standing and reputation (Would disclosure of information support the agency’s reputation of dealing quickly and transparently with complainants?)
• any other actions which may be involved (For example, criminal charges.)
• obligations under IPP 11(3)—information disclosed under IPP 11.1 should not be used or disclosed for another purpose by the person body or agency to whom it was disclosed (See Guideline 50 at www.privacy.gov.au/publications/ipp8_11.doc).

39. A detailed list of some of these considerations can be found at Attachment B.

40. A sample letter advising complainants on the outcome of a Code of Conduct investigation is at Attachment C.

Disclosure to other parties

41. Agencies should also consider whether it is necessary or appropriate to disclose to others any personal information relating to an investigation, including to:

• the complainant
• other Commonwealth bodies involved (such as the Commonwealth Ombudsman, the Office of the Privacy Commissioner or the Inspector-General of Intelligence and Security, where these bodies referred the complaint to the agency and may have an interest in knowing that suitable action was taken)
• an APS agency where the employee moves or seeks to move in the future.

42. A flowchart on the process for determining whether to release information following an investigation can be found at Attachment D.

43. A series of case studies covering some of these issues can be found at Attachment E.

Further information

44. Agencies’ central HR areas can obtain further information on the matters raised in this circular from the Commission’s Employment Policy Adviceline—or e-mail . It may be appropriate for more complex or sensitive queries to be dealt with in writing.

45. Individual APS employees should contact the HR area in their own agency in the first instance.

46. The information contained in this circular provides general guidance. If an agency is in doubt as to whether it can lawfully disclose personal information about an employee to a complainant in a particular case, legal advice should be sought.

Georgia Tarjan
Group Manager
Policy Group

24 April 2008

Attachment A: Sample clauses for inclusion in agency Code of Conduct investigation procedures – Disclosure of information

Below are sample clauses agencies may wish to include in their Code of Conduct investigation procedures relating to the disclosure of personal information.

Clause 1—defining personal information (refer Circular 2008/3 paragraph 10)

Personal information is defined in section 6 of the Privacy Act 1988 as ‘information or an opinion…about an individual…whose identity is apparent, or can reasonably be ascertained, from the information or opinion’. {Agency} will ensure that, where appropriate, necessary and reasonable, personal information about an employee under investigation will remain confidential.

Clause 1a – sensitive information (refer Circular 2008/3 paragraph 12)

Sensitive information is defined in section 6 of the Privacy Act as “information or an opinion about an individual’s racial or ethnic origin or political opinions or membership of a political association or religious beliefs or affiliations or philosophical beliefs or membership of a professional or trade association or membership of a trade union or sexual preferences or practices or criminal record that is also personal information or health information about an individual or genetic information about an individual that is not otherwise health information”. Special care should be taken in the handling of sensitive information. Sensitive information should generally not be disclosed to a third party without the express consent of the individual concerned.

Clause 2—to whom the personal information may be disclosed (refer Circular 2008/3 paragraph 41)

During the course of a Code of Conduct investigation, or after the investigation is complete, personal information about an employee under investigation may, where necessary, appropriate and reasonable, be disclosed to others (in accordance with IPP 2), including:

• the complainant
• other Commonwealth bodies who have been involved in the matter, such as the Commonwealth Ombudsman, the Office of the Privacy Commissioner or the Inspector-General of Intelligence and Security
• an APS agency where the employee moves or seeks to move in the future.

Clause 2a—disclosure of personal information to the employee (refer Circular 2008/3 paragraphs 27-33)

During the course of a Code of Conduct investigation, or after the investigation is complete, in accordance with the principles of procedural fairness, the employee may be provided with personal information about an individual who is a party to the investigation. This may include the complainant and any witnesses to the investigation. Disclosure of information about the complainant and any witnesses to the respondent employee or others should be done in accordance with the agency’s obligations under the Privacy Act.

Clause 3—opportunity to make a case as to why information should not be disclosed (refer Circular 2008/3 paragraph 31)

Where {agency} is considering disclosing personal information about an employee to another person, body or agency, the employee will be advised in writing and given the opportunity to make a case prior to the information being disclosed, as to why their personal information should not be disclosed. The employee will have {number} days to provide a case, in writing, to the investigating officer.

Clause 4—agency may disclose general information (refer Circular 2008/3 paragraphs 36-40)

Prior to disclosing information about the outcome of a Code of Conduct investigation, {agency} will have due regard to the Privacy Act 1988, including determining whether personal information will be used or disclosed and in what circumstances. General information containing no personal information may be disclosed to others where {agency} considers it necessary, appropriate and reasonable to do so.

Attachment B: Factors to consider – Complaint investigations and disclosure of personal information

An appropriate and lawful balance should be sought between the needs and concerns of employees, the agency and the complainant, in relation to the use and disclosure of personal information. A decision whether or not to disclose personal information about an employee must be based on the circumstances of each individual case, having due regard to the Privacy Act 1988 (Privacy Act) and the Public Service Act 1999 (PS Act), and appropriate weight must be given to a number of competing interests, as detailed below. The list is not exhaustive and other factors may apply.

Agencies should also take into account what policies, processes and training are in place that may have prevented the behaviour or breach (that led to the complaint) being made. This would include for example, regular and appropriate performance appraisals, auditing and tracking of electronic equipment used by employees and regular reviews of processes, policies and training.

An employee’s right to privacy and protection of reputation

Within the APS, public servants are bound to respect the confidentiality of information under the APS Values and Code of Conduct in the PS Act and the Information Privacy Principles in the Privacy Act. The Privacy Act protects the personal information of APS employees and also applies to personal information collected by the Australian Government sector more broadly.

Disclosing any information about an APS employee will result in a loss of control of that information by the agency. Disclosing personal information about an employee to private citizens brings a higher risk of the information being disseminated more broadly (including into the public domain) and therefore may have a greater impact or risk on an APS employee’s privacy, reputation and safety.

When considering how and to whom information may be released, agencies need to take into account the potential impact on a person’s reputation, right to privacy and safety. Agencies should consider whether providing the information to a third party, including the complainant, would be disproportionate to the nature and seriousness of the misconduct.

Agencies should refer to their obligations for the handling of personal information under the Privacy Act and to the Plain English Guidelines to Information Privacy Principles at www.privacy.gov.au/government/guidelines/index.html for more information.

Informing complainants

Complainants have a legitimate interest in knowing that alleged ‘wrongs’ have been addressed. Complainants should be given sufficient information to provide assurance that the agency:

• does not tolerate behaviour that is inconsistent with the APS Code of Conduct
• has taken the allegation seriously
• has taken appropriate steps to ensure the problem will not recur
• has imposed an appropriate sanction where a breach has been found.

Agencies may inform complainants of the outcome of an investigation without releasing personal information about the APS employee. In addition, informing complainants about the outcome of an investigation may prevent further claims, complaints or litigation (including requests for review, whistleblower reports and applications under the Freedom of Information Act 1982), as the complainant is more likely to be satisfied that the matter has been dealt with appropriately.

Where an APS employee has been specifically named by the complainant, the complainant will invariably be aware of some personal information about that employee, in particular their identity. However, this does not mean that any additional personal information about the employee (such as any sanction imposed) can or should be disclosed to the complainant.

Nature and seriousness of the misconduct

Some kinds of misconduct, such as fraud, seeking a benefit for oneself or others, or ongoing lack of respect and courtesy in dealing with the public, may call for wider dissemination of the results of an investigation and any sanctions imposed, remedial action taken or changes to policies or processes.

It may be possible for an agency to circulate an all staff email describing the breach, subsequent actions taken and advising other employees of appropriate behaviour without disclosing personal information about the individual concerned. The agency may also report breaches in their annual report. Such actions would serve to increase the public’s confidence in the agency and public administration as a whole. Care should be taken, however, that particularly in smaller agencies, the employee’s identity cannot be ‘reasonably ascertained’ from this information.

The disclosure of personal information about an APS employee to a complainant or a wider audience may not be warranted in all circumstances. Care should be taken to ensure, for example, that criminal proceedings (in the case of fraud) are not jeopardised by the inappropriate disclosure of personal or other information related to the investigation. Legal advice should be sought as to what information may be disclosed in these circumstances (for example, advising that the matter has been referred to a court of law).

Prevalence of the type of misconduct and the need to highlight particular cases for education, deterrence or prevention

In some instances, there may be a need to highlight particular cases (such as inappropriate use of agency internet and email facilities, or unnecessary browsing of the agency’s clients’ records) for the purposes of education, deterrence or prevention within the agency.

Agencies should consider in these circumstances whether personal information needs to be disclosed, or if general information about the behaviour and the consequences would be sufficient for this purpose. On a case by case basis, agencies should consider whether releasing personal information about the employee is proportionate to the seriousness and level of misconduct and the subsequent impact of this disclosure on the employee.

Staff welfare

Consideration should be given to any adverse effects that disclosure of an employee’s personal information might have on the welfare of the employee if, for example, rumours of their misconduct and sanction become widespread. This would particularly be the case where an employee’s existing personal difficulties may have contributed to the behaviour or conduct under investigation.

Any real or potential threat to the safety or health of employees should be a primary consideration when deciding whether to release personal information about an APS employee to a complainant.

Protection of an agency’s good standing and reputation

An agency may sometimes wish to release information about Code of Conduct investigations to prevent or lessen damage to its reputation and provide reassurance to the public that the agency takes its accountability obligations seriously. In most circumstances, it will be sufficient for the agency to provide general information only about the handling of the complaint, making it unnecessary to disclose personal information about the employee concerned.

An employee’s classification level and length of service

Expectations of standards of leadership and modelling appropriate behaviour increase with an employee’s classification. For example, Senior Executive Service employees in the APS must, under section 35 of the PS Act, ‘by personal example and other appropriate means, promote the APS Values and compliance with the Code of Conduct’. There is a risk that the damage to an APS employee’s reputation and career may be disproportionately affected by disclosure of personal information concerning a Code of Conduct matter. This should be considered and balanced by agencies on a case by case basis.

Length of service may also carry with it increased expectations about an employee’s knowledge of, and compliance with, the APS Values and Code of Conduct. For example, an employee of ten or more years of service could reasonably be expected to have a higher expectation upon them to meet behavioural standards than an employee who is new to the APS and who may have breached the Code of Conduct as a result of inexperience.

Security and safety

Disclosing personal information may be considered where the need for public awareness outweighs a person’s right to privacy. This may occur under the Privacy Act in circumstances where there is a reasonable belief that public health or safety is at risk. IPP 11.1(c) permits the disclosure of personal information where there is a reasonable belief it is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person. This exception is generally only applied in an emergency situation that demands immediate action, such as a threat of bodily injury, illness or death, and the disclosure of the information is necessary to prevent or lessen the threat.

Public interest

Disclosure of personal information may be in the public interest where an APS employee is found to have engaged in improper or corrupt conduct:

• Improper conduct may include substantial misuse of government resources or serious risk to public health and safety.
• Corrupt conduct may include dishonest or inappropriate partiality (such as, nepotism), conduct that breaches public trust, or misuse of information or material that has been acquired in the course of performing official duties.

Care should be taken to ensure that, in circumstances where a criminal investigation is underway, agencies do not jeopardise such investigations by improperly disclosing information to the complainant. Legal advice should be sought as to what information may be disclosed in this circumstance.

Alternatively, public interest disclosure may simply relate to providing the complainant with information outlining the way their complaint was handled, for example, that particular remedial action was taken.

Release to particular Commonwealth persons or bodies

Disclosure of an APS employee’s personal information may be appropriate when the Commonwealth Ombudsman, Office of the Privacy Commissioner or Inspector‑General of Intelligence and Security has decided not to investigate a particular complaint on the grounds that the agency was considering the matter. In that situation, the Ombudsman, Privacy Commissioner or Inspector-General may have expressed an interest in the quality of the agency’s handling of that complaint, and the agency should provide sufficient information to the relevant review agency to address any issues they have raised. This may include in some circumstances the provision of personal information about the APS employee. In making such disclosures, agencies must be mindful of their obligations under IPP11.

The Ombudsman, Privacy Commissioner and Inspector-General are subject to the Information Privacy Principles in the handling of personal information and/or other relevant secrecy provisions protecting personal information that may be disclosed to them.

Australian Public Service Commission circular 2007/02 specifically addresses the disclosure of Code of Conduct information when an employee moves to another agency.

Release to particular parliamentary committees

Parliamentary committees conducting inquiries into specific matters generally take evidence in public hearings. They can compel witnesses to attend a hearing and require them to produce documents, although this power is rarely used.

However, where there is a risk that certain evidence could be contrary to the public interest if made public (such as prejudicing court proceedings, national security or individual privacy concerns) a committee, other than a Senate Estimates committee, may decide to hear evidence in private. Witnesses may request their evidence to be heard in private and for all or part of that evidence not to be recorded in the Hansard transcript.

Attachment C: Letter to complainants advising the outcome of a Code of Conduct investigation

Disclosure of personal information under IPP 11 regarding misconduct should be managed in such a way that an employee’s identity will not be revealed where it is not necessary, appropriate and reasonable to do so. This is particularly important where the complainant is employed at the same agency as the individual under investigation. Care should be taken not to disclose any additional information about the employee to the complainant.

See paragraphs 34-40 and Attachment B of this circular for further information on factors to consider prior to releasing information.

The following is a sample letter to complainants advising the outcome of a Code of Conduct investigation, which provides information to the complainant without releasing personal information about the employee. However, agency heads can exercise discretion to disclose personal information in some circumstances having regard to their IPP obligations in the handling of this information.

Agencies may choose to provide a greater level of information to the complainant, such as the reasons for not finding a breach or the sanction that was imposed. Where agencies consider it inappropriate to provide information regarding the sanction, they may choose to provide the range of sanctions that have been imposed following similar cases which occurred in the past.

Sample letter

Dear {complainant}

I am writing in relation to your complaint about {nature of complaint}, which you forwarded to {agency} on {date}.

An investigation of this matter has been conducted in accordance with {agency’s} Code of Conduct investigation procedures. This investigation has now been finalised.

{May insert one of the following}

As a result, a breach of the Code of Conduct was found and a sanction imposed under section 15 of the Public Service Act 1999.

In addition, {agency} will undertake to {remedial action eg, train staff, improve agency procedures} to ensure this situation does not arise in the future.

OR

As a result, no breach of the Code of Conduct was found in this case. However, {agency} will undertake to {remedial action eg, train staff, improve agency procedures} to ensure such a situation does not arise in the future.

OR

As a result, no breach of the Code of Conduct was found in this case.

Please contact, etc.

Attachment D: Process to determine whether to release information following a Code of Conduct investigation

The following flowchart outlines the process for agencies to determine whether to release information to a complainant following a Code of Conduct investigation. Agency heads can exercise discretion to disclose personal information in some circumstances (refer paragraphs 34-43).

Receipt of complaint/Notification of issue

Step 1. Does it warrant investigation?
If Yes proceed to Step 2. If No proceed to Step 1a.

Step 1a. Is there any other course of action which might involve the use or disclosure of personal information?
If Yes proceed to Step 2. If No then follow agency procedures

Step 2. Will the investigation or other procedure involve the collection of personal information about an APS employee?
If Yes proceed to Step 3. If No then follow agency procedures

Step 3. Notify the individual in accordance with IPP 2 and in writing that their information will be collected. Provide information about the purpose of collection (ie Code of Conduct investigation), whether the information is collected by or under law and whether the information might be disclosed to another person, body or agency and in what circumstances.

Step 4. Advise the employee how the information will be used internally (ie for Code of Conduct processing, for statistical or other purposes), and of their rights to access and correct information (IPP 4, 6, 7).

Step 5. Once the employee has been notified as above and sufficient information has been collected to come to a final view on the facts, does the agency intend to use (IPP 10) or disclose (IPP 11) the personal information? If Yes proceed to Step 5a. If No then finalise the report.

Step 5a. Does the employee have any objections? If Yes proceed to Step 5b. If No then see IPP 10 on lawful uses or IPP 11 on lawful disclosures.

Step 5b. Can the employee’s objections be sustained on IPP or other grounds?
If Yes proceed to Step 5c. If No then finalise the report.

Step 5c. Can the information be used or disclosed without identifying the employee? If Yes then proceed to Step 6. If No then do not use the information

Step 6. Was the employee given the IPP 2 notification as per step 3 above, and is the intended disclosure of information consistent with the IPP2 notice?
If Yes then the information may be disclosed. If No then proceed to Step 6a.

Step 6a. Is the employee likely to be aware that their personal information will be disclosed??
If Yes then the information may be disclosed. If No then proceed to Step 6b.

Step 6b. Has the employee since consented to the disclosure?
If Yes then the information may be disclosed. If No then proceed to Step 6a.

Step 6c. Are there reasonable grounds to believe that the disclosure will prevent or lessen a serious and imminent threat to the life of any person? ?
If Yes then the information may be disclosed. If No then proceed to Step 6d.

Step 6d. Is the disclosure required or authorised by or under law (see PS Act and Regulations)? ?
If Yes then the information may be disclosed. If No then proceed to Step 6e.

Step 6e. Is the disclosure reasonably necessary for the enforcement of the criminal law, laws imposing a pecuniary penalty or for protecting the public revenue? ?
If Yes then the information may be disclosed. If No then the information may not be disclosed

Attachment E: Providing information on Code of Conduct outcomes to complainants – Case studies

Scenario 1: releasing information to a complainant where the employee is known

An agency receives a complaint about the misconduct of one of its APS employees. The complainant is aware of the employee’s name, having met him and received a letter signed by him. The person making the complaint alleges that they have suffered financial detriment and loss of social standing because of the employee’s actions.

The agency’s procedures require that it must conduct an investigation where it is made aware through a complaint that one of its employees may have engaged in conduct which allegedly breaches the APS Values or Code of Conduct. In this case, the agency concludes that the allegation has been sustained and the delegate finds that a breach of the Code has occurred. Due to the seriousness of the complaint, the delegate would like to inform the complainant that the employee has breached the Code and that a sanction has been imposed on the employee. The delegate would also like to disclose the details of the sanction.

Q: Can the delegate release this information to the complainant?

A: If, prior to an investigation, the agency envisages that the information it is about to collect in response to an incident will involve the collection of personal information from an APS employee, the first critical step is to notify the employee in writing that their personal information may be collected for the purpose of conducting the investigation and that the information might be disclosed to the person making the complaint. Prior to disclosing this information to the complainant, the employee should be given the opportunity to make a case as to why their personal information should not be disclosed.

While such notice is a requirement under Information Privacy Principle (IPP) 2 in the Privacy Act 1988, it is also important from a procedural fairness perspective that the employee is made aware of the collection, especially if it is envisaged that the investigation or inquiry will be conducted as part of a Code of Conduct investigation as outlined above. More importantly, if it is envisaged that any personal information about the employee might be used or disclosed, such uses or disclosures will only be permitted if they comply with the agency’s obligations under IPP 10 and/or IPP 11.

Therefore, if the agency has notified the individual that their personal information may be collected for the purpose of conducting the investigation or inquiry, and that it was possible that the information might be disclosed, it is likely that the disclosure will be permitted under IPP 11(1)(a).

The delegate should consider whether the complainant can be advised about the outcome of the investigation without specifically mentioning the actions (both sanctions and remedial) that have been imposed. It may be sufficient in this case for the delegate to advise that a breach had been determined and action taken to rectify the situation. In other words, the level of detail may not need to be as great as the delegate is suggesting.

Scenario 2: complainant seeking information on an investigation from an agency and a review authority

A member of the public lodges a complaint to an agency about the actions of an APS employee with whom he dealt when seeking assistance. The complainant claims that the employee asked intrusive questions in an harassing way, placing the complainant under pressure. The agency investigated and found that the employee’s actions were within the agency’s guidelines relating to obtaining client information. The agency advises the complainant that the matter had been investigated and the outcome finalised.

Later, the complainant finds out that the employee is still working at the agency and that she may have even been promoted. The complainant considers this unacceptable and complains to the agency. The agency confirms that the employee is still a staff member. The complainant then asks the agency what action it took following the original complaint and the agency advises that it cannot disclose this information for privacy reasons.

The complainant is not satisfied with the agency’s response and lodges a complaint with a review authority (such as the Commonwealth Ombudsman). The authority advises the complainant that the agency has considered and responded to the complaint and that it cannot disclose any more information for privacy reasons.

Q: Are the agency and the review authority correct in refusing to provide information to the complainant?

A: If the agency has determined, in the course of its investigation, that some of the information to be disclosed is personal information about the employee and that, in their view, this should not be disclosed under IPP 11(1)(a), it should make its reasoning clear to the complainant.

Agencies should also note that there is no obligation placed on them under IPP 11(1)(a) notice to the individual or (1)(b) consent of the individual, to provide personal information about an APS employee to a complainant. It is at the discretion of the agency.

In the interests of transparency, the agency should explain to the complainant how the Privacy Act 1988 works, why it came to its decision and why it considers it was appropriate to use this clause of the Privacy Act to not disclose personal information about the employee to the complainant.

Importantly, nothing in either the Privacy Actor the Public Service Act 1999 would prevent the agency providing general information to a complainant as to how it dealt with their complaint. The agency should reiterate that it has undertaken an investigation of the complaint and that, in its view, the employee concerned is not at fault. The agency may choose to provide general information regarding processes or training, or to advise that no finding of fault has been attributed.

If the complainant can be assured that both the agency and the review authority fully considered the lawfulness of disclosing the information and demonstrated that a thorough investigation had been undertaken, the complainant is less likely to consider the response from both bodies to be a ‘cover-up’. This can be done without releasing any personal information.

Scenario 3: providing information about an investigation to the Minister

A complainant is unhappy with the actions of a staff member from an agency and lodges a complaint with the agency. The agency investigates the complaint and sends her a letter apologising for the inconvenience that the employee had caused. The letter does not mention whether an investigation had taken place, or any resulting outcome.

The complainant is keen to know more about what action was taken and particularly whether the employee was sanctioned. She makes a request under the Freedom of Information Act 1982 for the file on the complaint. The agency refuses to provide this information stating that there would be an unreasonable disclosure of the employee’s personal information; and it did not consider such a disclosure to be a reasonable request after considering ways in which the FOI request for the file could be met without disclosing personal information about the employee.

The complainant decides not to appeal this decision but instead asks her local Federal MP to obtain this information for her. The MP writes to the relevant Minister who, in turn, asks the agency to provide a full briefing on the situation. The agency is reluctant to provide personal information about the employee to the Minister, although it does stipulate in internal policies that the Minister may be advised about the outcome of Code of Conduct investigations in some circumstances. After some discussion with the Minister’s office, it agrees to draft a letter from the Minister to the MP declining to disclose the information due to privacy considerations and outlining the relevant provisions of the Privacy Act 1988 which has informed this conclusion. The agency, however, will be able to include general information about the conduct of the investigation and the outcome, including the steps the agency has taken to ensure that the problem does not occur again.

Q: Should the agency disclose information about the employee to the Minister?

A: Under the Privacy Act, a Minister has the same status as an agency. As such, providing personal information about an employee to a Minister is considered to be a disclosure. In this respect, if the employee has been given notice that personal information might be disclosed to another person, body or agency, or if the agency is satisfied that the employee is reasonably likely to have been made aware of this, then the disclosure may be permitted under IPP 11(1)(a). As the agency has policies in place that it may advise the Minister about the outcome of an investigation (and employees are also made aware of these, for example, through training) the agency could be satisfied that this meets the requirements under IPP 11(1)(a).

In addition, it may be the case that, because agencies are responsible to the relevant Minister for the performance of their functions, APS employees would be reasonably likely to be aware that information about them might be disclosed to the relevant Minister in some circumstances.

Q: Should the Minister answer the MP’s question in detail, or should the Minister merely provide the general advice that the agency is recommending?

A: While the MP may consider that this request for information is reasonable, this does not override IPP 11. Although the employee may have been reasonably likely to have been aware that disclosure of this kind would be made to the Minister under IPP 11(1)(a), this is not the case with similar disclosure to another MP. There is no obligation under the Privacy Act for this information to be provided to the MP, although the agency head may have discretion in individual cases, for example the authority to disclose under IPP11(1)(d).

However, there is also nothing to prevent the Minister from providing general information about the investigation to the MP if he/she desires.

1 Privacy Act 1988, section 6. Sensitive information means: information or an opinion about an individual’s racial or ethnic origin or political opinions; or membership of a political association or religious beliefs or affiliations or philosophical beliefs or membership of a professional or trade association or membership of a trade union or sexual preferences or practices or criminal record that is also personal information or health information about an individual or genetic information about an individual that is not otherwise health information.