The Protected Disclosures (Protection of Whistleblowers) Act 2022

The Protected Disclosures Act 2000 will be replaced by the Protected Disclosures (Protection of Whistleblowers) Act 2022 on 1 July 2022. The Protected Disclosures Act 2000 remains in place until then.

Key Resources:

The Act: Protected Disclosures (Protection of Whistleblowers) Act 2022

Expert support for your whistleblowers disclosure programme: Whistleblowers Website

About the Act

The new 2022 Act continues the 2000 Act’s purpose, which is to facilitate the disclosure and investigation of serious wrongdoing in the workplace, and to provide protection for employees and other workers who report concerns.

The 2022 Act addresses the following issues and improvements from the 2000 Act:

  • extending the definition of serious wrongdoing to cover private sector use of public funds and authority and to cover behaviour that is a serious risk to the health and safety of any individual
  • allowing people to report serious wrongdoing directly to an appropriate authority at any time, while clarifying the ability of the appropriate authority to decline or refer the disclosure
  • strengthening protections for disclosers by specifying what a receiver of a disclosure should do
  • clarifying internal procedure requirements for public sector organisations and requiring them to state how they will provide support to disclosers
  • clarifying the potential forms of adverse conduct disclosers may face.

Organisations, both public and private sector, have responsibilities under the Act as receivers of protected disclosures, including sometimes as appropriate authorities. Public sector organisations must have appropriate internal procedures for protected disclosures and must publicise these procedures widely.

What is a protected disclosure?
A protected disclosure is when the discloser:

  • believes on reasonable grounds that there is, or has been, serious wrongdoing in or by the discloser’s organisation, and
  • discloses information about that in accordance with the Act, and
  • does not disclose it in bad faith.

Who is a discloser?

A discloser, in relation to an organisation, means an individual who is (or was formerly):
• an employee
• a homeworker within the meaning given in section 5 of the Employment Relations Act 2000
• a secondee to the organisation
• engaged or contracted under a contract for services to do work for the organisation
• concerned in the management of the organisation (including, for example, a person who is or was a member of the board or governing body of the organisation)
• a member of the Armed Forces (in relation to the New Zealand Defence Force)
• a volunteer working for the organisation without reward or expectation of reward for that work.

What is serious wrongdoing?
Serious wrongdoing is an act, omission, or course of conduct.

Type of serious wrongdoingDoes it apply to the public sector?Does it apply to the private sector?
An offenceYesYes
A serious risk to public health, or public safety, or the health or safety of any individual, or to the
environment
YesYes
A serious risk to the maintenance of the law including the prevention, investigation and detection of offences or the right to a fair trialYesYes
An unlawful, corrupt or irregular use of public funds or public resourcesYes Yes, but does not
include the use of private sector funds or resources
Oppressive, unlawfully discriminatory, or grossly negligent or that is gross mismanagement by a public sector employee or a person performing a function or duty or exercising a power on behalf of a public sector organisation or the GovernmentYesYes, but does not
include the use of
private sector powers

What is not serious wrongdoing?
Things like dissatisfaction with the leadership of an organisation or more minor misconduct matters may not amount to serious wrongdoing and thus may not be covered by the Act. The Act does not cover employment issues that are more properly covered by the Employment Relations Act.

If a person is unsure about whether the information they want to disclose relates to serious wrongdoing, they can contact the Ombudsman for advice. Potential disclosers can also look at their organisation’s policies about handling other staff complaints.

Who does a discloser report serious wrongdoing to?
A discloser may make a protected disclosure to their organisation or to an appropriate authority (see below) at any time.

What protections are there for a person reporting serious wrongdoing?
A discloser is entitled to protection for a protected disclosure made in accordance with the Act, even if they are mistaken and there is no serious wrongdoing. The protections a discloser is entitled to are confidentiality, not retaliated against or treated less favourably, and immunity from civil, criminal and disciplinary proceedings. These protections extend to people who volunteer supporting information for the disclosure.

When is the person reporting serious wrongdoing protected?
A discloser is entitled to protection for a disclosure made in accordance with an organisation’s internal procedures, to the head or deputy head of the organisation, or to an appropriate authority. A discloser is entitled to protection even if:
• they are mistaken and there is no serious wrongdoing, or
• they do not refer to the name of the Act when making the disclosure, or
• they technically fail to comply with some of the Act’s requirements (as long as they have substantially
complied with the Act), or
• they also make the disclosure to another person (as long as they do so on a confidential basis, to seek advice about whether or how to make a protected disclosure).
Another discloser who discloses further information in support of a disclosure is also entitled to protection if they do not disclose in bad faith and they disclose to their organisation or to an appropriate authority in accordance with the Act.

What must public and private sector organisations do as the receiver of a protected disclosure?
Within 20 working days of receiving a protected disclosure, the receiver (the organisation or an appropriate authority) should acknowledge to the discloser the receipt of the disclosure, consider whether it warrants investigation, and deal with the matter by doing one or more of:
– investigating the disclosure
– addressing any serious wrongdoing by acting or recommending action
– referring the disclosure to an (or another) appropriate authority
– deciding that no action is required.
The receiver should then inform the discloser about what they have done or are doing to deal with the matter. If the receiver is unable to complete these actions within 20 working days, they should begin the process and inform the discloser how long it may take.

What procedures must organisations have?
Every public sector organisation must have appropriate internal procedures that set out a process for the organisation to follow as the receiver of a protected disclosure, identify who in the organisation a protected disclosure may be made to, describe the protections available under the Act and how the organisation will provide practical assistance and advice to disclosers.

Private sector organisations are not required by the Act to establish internal procedures for protected disclosures.

Who is an appropriate authority and what do they do?
An appropriate authority is a trusted external party who can be approached if a discloser is not confident about making the disclosure within their own organisation. A discloser may report serious misconduct to an appropriate authority at any time, rather than having to go through their organisation first. An appropriate authority includes: the head of any public sector organisation; any officer of Parliament (the Ombudsman, Controller and Auditor-General, Parliamentary Commissioner for the Environment); as examples the persons or bodies listed in Schedule 2 of the Act; and the membership body of a particular profession, trade, or calling with the power to discipline its members. Appropriate authorities, as receivers of protected disclosures, should handle a protected disclosure in accordance with the requirements in the Act.

Special provisions limit who the appropriate authorities are for disclosures relating to intelligence and security or international relations information.

What is the role of the Ombudsman?
As well as being an appropriate authority, the Ombudsman has a wide role supporting the operation of the Act. For example, the Ombudsman can provide information and guidance to disclosers who approach it about how to make a disclosure and the protections under the Act, or to organisations who are unsure what to do about a disclosure.

What procedures must all public sector organisations have for protected disclosures?
Every public sector organisation must have appropriate internal procedures, which must:
• comply with the principles of natural justice
• set out a process for what the organisation will do as the receiver of a protected disclosure
• identify who in the organisation a protected disclosure of serious wrongdoing in or by that organisation may be made to
• include reference to the requirement to not retaliate, or threaten to retaliate, against the discloser or treat them less favourably than others
• describe the circumstances when it might be referred on
• describe how the organisation will provide practical assistance and advice to disclosers
• describe how the organisation will meet the duty of confidentiality.
The organisation must publish widely (and republish at regular intervals) information about the existence of the internal procedures, and adequate information on how to use the procedures.
All public sector organisations were required by the Protected Disclosures Act 2000 to have internal procedures. The 2022 Act includes additional requirements such as enhanced procedures for the organisation as a receiver of a protected disclosure, referencing for disclosers the protections available under the Act and how the organisation will provide practical assistance to disclosers.
As a result all public sector organisations will need to review and update their procedures for the implementation of the new Act.

What must private sector organisations do in relation to protected disclosures?
Items a to c of the definition of serious wrongdoing (see below) apply equally to the public sector and the private sector. Items d and e can apply to the private sector in certain situations.
Serious wrongdoing includes an act, omission or course of conduct that is:
a. An offence
b. A serious risk to public health, or public safety, or the health or safety of any individual, or to the environment
c. A serious risk to the maintenance of the law including the prevention, investigation and detection of offences or the right to a fair trial
d. An unlawful, corrupt or irregular use of public funds or public resources
e. Oppressive, unlawfully discriminatory, or grossly negligent or that is gross mismanagement by a public sector employee or a person performing a function or duty or exercising a power on behalf of a public sector organisation or the Government.
Private sector organisations must follow the provisions of the Act including those as a receiver of a protected disclosure. However private sector organisations are not required by the Act to establish internal procedures for protected disclosures.
Some private sector organisations may be appropriate authorities. For example an appropriate authority as defined in the Act includes the membership body of a particular profession, trade, or calling with the power to discipline its members. As an appropriate authority such a body should handle a protected disclosure in accordance with the requirements in the Act.

Key Resources:

The Act: Protected Disclosures (Protection of Whistleblowers) Act 2022

Expert support for your whistleblowers disclosure programme: Whistleblowers Website

Contact 0800 WITNESS or support@whistleblowers.co.nz for further assistance.