Individual Commonwealth employees

Risk factors

15.5 The Queensland Crime and Misconduct Commission (CMC) has identified a number of risk factors that are associated with the misuse of official information, including intentional non-compliance—that is, the deliberate ‘leaking’ or inappropriate withholding of Commonwealth information—and unintentional non-compliance.

15.6 The CMC notes that, among other factors, the deliberate release of information may be motivated by:

• personal motivations, such as the desire or need to sell information for profit or personal advantage, dissatisfaction with the stifling of debate, or lack of recognition for the officer’s individual or professional views;

• disgruntlement because of, for example, a failure to gain promotion, dismissal or other disciplinary action; and

• an inappropriate organisational culture such as a failure to consistently condemn the misuse or unauthorised release of information or a practice of misuse or unauthorised release by senior management.^[4]

15.7 Risk factors for the unintentional release of information include:

• inadequate or unclearly articulated policies and procedures on information management;

• procedural issues, such as a failure to classify sensitive information properly or poor recordkeeping practices; and

• failings in network and computer security, such as inadequate guidelines on password use and computer security, the unauthorised removal of electronic material from the office or malicious network breach.^[5]

15.8 Similar issues may contribute to an inappropriate failure to share information. For example, personal motivations may result in a Commonwealth officer deliberately withholding information where disclosure could reveal misconduct. Information-handling policies that do not clearly identify the circumstances in which information can be disclosed to Australian Government agencies or others may result in an officer not disclosing information that could properly be shared—or a lengthy delay before such sharing occurs.

15.9 Qualitative research into organisational misconduct more broadly has identified the importance of organisational factors, as compared with personal characteristics, as potential precursors of misconduct. For example, a survey of employees in for-profit, non-profit and government organisations reported that formal organisational compliance practices—such as written codes and ethics training—and the informal ethical climate—such as leaders setting a good example—were independent predictors of employee conduct. The authors noted the importance of ‘promoting a moral organization through the words and actions of senior managers and supervisors, independent of formal mechanisms such as codes of conduct’.^[6] The Deloitte & Touche USA 2007 Ethics and Workplace Survey reported that respondents viewed the role of managers and direct supervisors as being the strongest influences on ethical behaviour at work. In comparison, only 10% of respondents cited criminal penalties for violation of a code of conduct as a factor that helped foster an ethical workplace.^[7]

Leadership from senior employees and supervisors

15.10 As noted above, the example set by senior employees and direct supervisors is a strong influence on employee conduct, capable of predicting misconduct independently of formal organisational compliance mechanisms such as codes of conduct. Leadership from these staff is crucial for fostering a culture of effective information handling.

15.11 Several provisions of the Public Service Act 1999 (Cth) impose requirements to promote the Australian Public Service (APS) Values and Code of Conduct, including the administrative secrecy provision in reg 2.1 of the Public Service Regulations 1999 (Cth).^[8] Section 35 of the Act sets out the constitution and role of the Senior Executive Service (SES), including that each member of the SES must promote ‘by personal example and other appropriate means’ the APS Values and compliance with the Code of Conduct.^[9] Section 12 requires agency heads to ‘uphold and promote the APS Values’.

15.12 The influence of supervisors in establishing an agency’s information-handling culture was recognised by the ALRC and the Administrative Review Council (ARC) in their 1995 review of the Freedom of Information Act 1982 (Cth) (ALRC 77). The ALRC and ARC recommended that the performance agreements of all senior officers^[10] should include a responsibility to ensure efficient and effective practices and performance in respect of access to information, including freedom of information (FOI) requests.^[11]

ALRC’s views

15.13 The ALRC continues to see the benefits of including in the performance agreements of senior officers in Australian Government agencies a responsibility to ensure efficient and effective information-handling practices. As noted in ALRC 77, giving tangible incentives to staff to pay greater attention to, and to improve, an agency’s information-handling practices will increase the likelihood of cultural change.^[12] This will supplement relevant obligations in the Public Service Act, identified above.

15.14 As discussed below, training and development programs will be an important strategy for improving the information-handling example set by senior employees and supervisors.

Training and development programs

15.15 Training and development programs provide an opportunity for agencies to educate employees about their obligations in handling Commonwealth information, and to impart broader information-handling values.^[13]

15.16 In its State of the Service Report 2001–02, the Australian Public Service Commission (APSC) reported that agencies alerted employees to their obligations in relation to the non-disclosure of Commonwealth information through:

• the induction process (85% of agencies);

• promulgated policies (58% of agencies);

• Chief Executive instructions (46% of agencies); and

• training programs (44% of agencies).^[14]

15.17 The APSC noted that although the majority of employees are informed of their obligations in relation to handling Commonwealth information when they commence employment, 42% of agencies did not provide employees with regular reminders of these obligations.^[15]

15.18 Some agencies have developed extensive training and development programs to advise employees and others about their information-handling responsibilities. Centrelink, for example, provides all graduates and cadets, on induction, with training on confidentiality, privacy and FOI laws. The training module, among other things, specifies the types of documents that officers can release outside the operation of the Freedom of Information Act 1982 (Cth) (FOI Act); advises on the application of privacy and secrecy laws; and provides contact officers to approach for further information.^[16]

15.19 The Commonwealth Ombudsman, in reviewing the collection, storage and dissemination of information in the Australian Crime Commission (ACC), commented that the ACC’s induction program provided ‘a good introduction to security practices and, in particular, physical and document security and document security classification and handling’. The Ombudsman suggested, however, that the induction could be enhanced by:

• explaining the s 51 secrecy provision

• describing the need-to-share and need-to-know continuum, and expounding the ACC’s policy position on this

• explaining access-control measures for database documents

• explaining the role of the IT Security Adviser

• describing and defining information misuse and information access breaches, and the sanctions

• providing a more defined incident reporting process for suspected ICT and information security breaches.^[17]

15.20 In February 2009, the ALRC conducted an open forum about secrecy laws with members of the Community and Public Sector Union (CPSU). Participants commented on the need for training and development programs to reflect the type of risks that are commonly encountered by employees of particular agencies. One participant noted that, unless the purpose of the provision is relevant, employees go ‘straight to a fear culture’.^[18] Callers to the ALRC’s secrecy phone-in also raised issues about training and development programs, including the need for Commonwealth employees to be trained about broader ethics and values in relation to government information handling, in order to instil a greater culture of transparency.

Submissions and consultations

15.21 In the Discussion Paper, Review of Secrecy Laws (DP 74), the ALRC noted the importance of training and development programs in fostering compliance by employees and others with information-handling regimes. The ALRC proposed that Australian Government agencies should develop and administer training and development programs for their employees on their information-handling obligations, including the need to share information in certain circumstances and avenues for making public interest disclosures.^[19]

15.22 Civil Liberties Australia ‘strongly supported’ the proposal, noting that ‘a culture of openness and accessibility can be achieved if Commonwealth officers know and understand the circumstances in which it is appropriate to share information and how to make public interest disclosures’.^[20] The Australian Press Council agreed that all officials should receive adequate training in the correct implementation of any laws, regulations, guidelines or rulings relevant to the classification or declassification of confidential material.^[21] Many other submissions also expressed support for training and development programs.^[22]

15.23 The Department of Immigration and Citizenship (DIAC) noted that training will be especially important if a harm-based general secrecy offence is adopted, because of the degree of subjectivity in assessing whether the disclosure of information would cause harm to a specified public interest.^[23]

15.24 The Australian Privacy Foundation suggested that Australian Government agencies should be under a particular obligation to provide training and development programs for FOI and privacy officers.^[24]

ALRC’s views

15.25 In order for employees to operate in accordance with secrecy and other information-handling obligations, they must first know the scope of these obligations and the purpose that they serve.

15.26 The ALRC recommends that Australian Government agencies develop and administer training and development programs for their employees about the information-handling obligations relevant to their position, including the need to share information in certain situations. As noted by DIAC, articulating these obligations may be especially important in the context of the harm-based secrecy framework recommended in this Report. Training and development programs should also clarify the avenues available to employees and others to raise queries or concerns about their information-handling responsibilities,^[25] and to make public interest disclosures.^[26]

15.27 In the ALRC’s view, training and development programs should be conducted on induction and at regular intervals thereafter. Ensuring that training takes place throughout an employee’s career has the benefit both of refreshing the information imparted in previous training programs, and enabling new obligations to be considered. For example, an employee may incur additional information-handling responsibilities because he or she has attained a higher security classification level or is in the position of managing staff.

Oaths, affirmations and acknowledgements of secrecy

15.28 Approximately 8% of the secrecy provisions identified by the ALRC—predominantly in laws governing taxation and revenue-protection information—empower a specified person, or persons, to require officers to take an oath or make an affirmation of secrecy.^[27] Secrecy obligations may also be included in the oaths of office required for assuming certain public positions, such as the oath taken by Executive Councillors.^[28] In addition to conduct covered by these legislative provisions, some agencies have taken administrative action to require officers to sign an acknowledgement of their secrecy obligations.^[29]

15.29 Many oaths and affirmations require officers to maintain secrecy ‘in accordance with’ the associated secrecy provision (or words to this effect). Identical conduct is therefore proscribed in both the oath of secrecy and the secrecy provision. For example, the oath and declaration of secrecy set out in the Income Tax Regulations 1936 (Cth) requires an officer to swear or declare that he or she

will not, either directly or indirectly, except as permitted under the said section, and either while I am, or after I cease to be, an officer, make a record or divulge or communicate to any person any information respecting the affairs of another person, disclosed or obtained under the provisions of the Income Tax Assessment Act 1936, or of any amendment thereof, or of any Act substituted therefore, or of any previous law of the Commonwealth relating to Income Tax.^[30]

15.30 The ALRC has heard anecdotally, however, that some Commonwealth employees have been asked to sign oaths that set out substantially more stringent secrecy requirements than those that apply under relevant Commonwealth laws.^[31]

15.31 It can be argued that the fact that an officer has taken an oath or affirmation of secrecy is of little or no legal consequence. Professor Enid Campbell commented that:

Nowadays, little or any legal consequence is attached to the fact that a member of an Executive Council, or a Minister, has taken an oath or affirmation of secrecy and has done so by virtue of some legal requirement. The legal significance of the taking of such an oath or affirmation has been considered by courts primarily in the context of the laws of evidence which govern the conduct of judicial proceedings. Rules of common law make it possible for courts to exclude relevant evidence on the ground that its admission would be contrary to the public interest. In recent time the availability of this so-called public interest immunity has been narrowed by the courts and in one of the leading cases before the High Court of Australia—Sankey v Whitlam in 1978—Gibbs ACJ firmly rejected the argument that this immunity is automatically attracted when evidence about proceedings before the Federal Executive Council is sought to be adduced, and is so attracted because of the oaths or affirmations taken by members of that Council.^[32]

15.32 However, oaths and affirmations of secrecy may have legal consequences where they reinforce the application of other duties of non-disclosure. For example, in setting out the particulars in the case of Kessing v The Queen, the New South Wales Court of Criminal Appeal noted that:

On 10 May 2005 the appellant signed documents including an ‘Official Secrets’ form in which he acknowledged his understanding that all official information that he had acquired in the course of his duties for the Commonwealth was not to be published or communicated to any unauthorised person after his service with the Commonwealth. He certified that all information acquired by him in the course of his employment with the Commonwealth had been returned to an appropriate Commonwealth representative.^[33]

15.33 Moreover, oaths and affirmations may carry considerable moral significance. As one commentator has noted:

There is a particular import, a gravitas, to … an oath: a message inherent therein that mandates a sense of trust, be it in oneself to fulfill the promise made or, if we are observing the oath or benefiting from its guarantee, in the oath-taker to do the same.^[34]

15.34 The capacity for oaths and affirmations to remind staff of their obligations of secrecy was commented on in a number of submissions on the Issues Paper, Review of Secrecy Laws (IP 34).^[35] For example, the Department of Human Services submitted that having employees and contracted service providers sign deeds of confidentiality

reinforces the importance the agency places on the proper management of information it handles and personalises the employee or individual service provider’s obligations.^[36]

Submissions and consultations

15.35 In DP 74, the ALRC expressed the view that the relevant Australian Government agency should retain the discretion to administer an oath or affirmation of secrecy, in accordance with any legislative provision. However, the ALRC proposed that where an agency decides to administer such an oath, it should ensure that it is an accurate reflection of the requirements under relevant Commonwealth secrecy laws.^[37] In particular, the ALRC was concerned about the potential for oaths and affirmations to set out broader or more onerous obligations than the secrecy laws on which they are based.

15.36 Those stakeholders who commented on this proposal were unanimously in support.^[38] The Australian Taxation Office (ATO) advised that it asks new tax officers and contracted staff to sign a declaration of secrecy, with the aim of ensuring compliance with the relevant taxation secrecy provision.^[39]

ALRC’s views

15.37 The strong moral significance accorded to oaths and affirmations of secrecy means that they could play a valuable role in reinforcing a Commonwealth employee’s responsibilities to protect official information. However, their very gravitas means that, if oaths or affirmations are framed more broadly than the underlying legal obligations, those who enter into them may be inhibited from engaging in lawful information sharing.

15.38 The ALRC remains of the view that Australian Government agencies should have the discretion to decide whether or not to administer an oath or affirmation of secrecy, in accordance with any legislative provision. However, where an agency does administer such an oath or affirmation, the agency should ensure that it accurately reflects the requirements under relevant Commonwealth secrecy laws. In particular, the obligations in the oath or affirmation should be no more onerous than those in the secrecy provision on which it is based. This proposal received widespread support from stakeholders.

Employee queries and concerns

15.39 The APS Values and Code of Conduct in Practice, issued by the APSC, suggests that agencies may give a direction to their employees requiring them to seek advice if they are unsure about whether to disclose information.^[40] This advice will usually come from an employee’s supervisor. Agencies may establish additional frameworks for an employee to raise queries or concerns about his or her obligations of secrecy.

15.40 The ATO, for example, has instituted a national ATO Privacy Network, comprising members of each of the agency’s business sections. The Network is intended to be the first point of contact to assist employees to resolve privacy and secrecy issues. Network members are also responsible for receiving and reporting complaints about breaches of privacy and secrecy provisions. The ATO directs employees to the ATO Legal Services Branch where they may seek further advice or assistance.^[41]

15.41 Another option for dealing with queries or concerns about secrecy oligations is through a program to provide employees with ethics advice more generally. One such strategy is the APSC Ethics Advisory Service, which was launched on 6 May 2009.^[42] The service provides advice and resources for applying and interpreting the APS Values and Code of Conduct. Among other initiatives, the service includes an anonymous call and email centre for APS employees to seek advice on ethical issues, including their secrecy obligations under the Code of Conduct.^[43] In other situations, an agency may have in place arrangements to provide its employees with ethics advice in a manner that is tailored to the agency’s specific circumstances.^[44]

15.42 Finally, an employee who has a concern about secrecy obligations may be able to raise it with one or more integrity agencies, such as the Public Service and Merit Protection Commissioners and the Commonwealth Ombudsman.

15.43 In DP 74, the ALRC proposed that Australian Government agencies should develop information-handling policies that include, among other information, avenues for an employee to raise queries or concerns.^[45] The submissions on this proposal are discussed in detail in Chapter 14. As noted in that chapter, however, there was overwhelming stakeholder support for developing such policies.

ALRC’s views

15.44 Providing Commonwealth employees with avenues to raise queries and explore concerns about secrecy laws may help to promote effective information handling in two ways. First, where an employee has a ready source of advice about the application of an agency’s information-handling policy, there will be a decreased risk of misunderstanding and consequent inadvertent breach of secrecy obligations. Secondly, to the extent that a deliberate breach is motivated by an employee feeling as though his or her views have not been ‘heard’ by an agency, providing the employee with an avenue to raise concerns may to some extent meet this need.

15.45 The ALRC remains of the view that the information-handling policies that Australian Government agencies develop in accordance with Recommendation 14–1 should include, among other information, avenues for an employee to raise queries or concerns.

15.46 In the ALRC’s view, there is no need to specify a particular system that agencies must institute. As long as a clear pathway is provided, agencies should have a broad discretion as to the manner in which they satisfy this obligation, depending, for example, on their structure and functions, and any related initiatives that they have in place. APS employees—who make up a significant proportion of Commonwealth employees—will also be able to have many of their secrecy queries or concerns addressed through the APSC Ethics Advisory Service.

15.47 The avenues for queries and concerns about secrecy laws that are developed by Australian Government agencies should be accompanied by readily accessible avenues for employees to make public interest disclosures, discussed below.

Public interest disclosures

15.48 A number of the risk factors for the unauthorised disclosure of information identified by the CMC are connected to a lack of authorised avenues for employees to voice concerns or grievances. For example, an employee may disclose information because he or she feels that debate is being stifled, or suspects that his or her individual or professional views have been ignored. An unauthorised disclosure could also be a reaction to perceived shortcomings in organisational culture, such as a practice of misuse or unauthorised release of information by senior management. Concerns of this kind could potentially be identified and rectified through pathways for public interest disclosures.

15.49 As noted in Chapter 2, there is minimal protection at the Commonwealth level for people who make public interest disclosures. Section 16 of the Public Service Act provides some limited protection for APS employees who report breaches of the APS Code of Conduct.

15.50 Some stakeholders made submissions on the importance of having available avenues for whistleblowing.^[46] Dr James Renwick, for example, stated that there should be a clear mechanism for the public servant who genuinely believes that a government is going to behave unlawfully to report that information.^[47] The CPSU advised that its members strongly supported an independent body where employees could raise complaints and allegations without breaching secrecy provisions or employment duties.^[48] The Australian Commission for Law Enforcement Integrity (ACLEI) considered that the capacity for whistleblowers to bring information to it directly for independent assessment and investigation is an important part of its role.^[49] Participants in the national secrecy phone-in advised of the lack of support for officers wanting to report misconduct. One caller stated that officers feel they have no place to go to report misconduct with confidence that something will be done about it.^[50]

15.51 In February 2009, the House of Representatives Standing Committee on Legal and Constitutional Affairs (the Standing Committee) issued a report on whistleblower protection for the Commonwealth public sector (the Whistleblower Protection report).^[51] The Standing Committee recommended that the Australian Government should establish by legislation a system for employees in the Commonwealth public sector to make disclosures about serious matters to their organisation, other public service agencies or, in limited circumstances, publicly. A person who made a disclosure under the framework would be protected from detrimental action in the workplace and receive immunity from criminal and civil liability and administrative penalties.^[52]

15.52 At the time of writing, the Australian Government had not responded to the Whistleblower Protection report, although the Government has indicated that it intends to develop public interest disclosure legislation in 2009.^[53] For the purposes of this Report, the ALRC is proceeding on the basis that such legislation will be put in place and that it will largely reflect the recommendations made in the Whistleblower Protection report. Accordingly, the importance of processes for Commonwealth employees to make public interest disclosures is not the subject of a recommendation in this chapter. However, these processes will be an integral component of creating an effective information-handling culture within Australian Government agencies.