Protected Disclosures

Procedures for the Making of Protected Disclosures in the Institute of Public Administration

This document is also available as a PDF

Policy Owner: IPA Company Secretary
Date of adoption: 14 August 2024
IPA PROTECTED DISCLOSURES POLICY
As per the Protected Disclosures Act 2014 as amended by the Protected Disclosures (Amendment) Act 2022.

1. Introduction
The Institute of Public Administration (hereafter known as “the IPA”) is committed to providing workers with a confidential and secure pathway for reporting concerns about wrongdoing in the workplace and also to protecting workers against penalisation for having reported those concerns.
The Protected Disclosures Act 2014, as amended by the Protected Disclosures (Amendment) Act 2022 (“the Act”), protects workers who report certain workplace wrongdoings. A formal channel for reporting such concerns has been established in accordance with the Act.
This document sets out:
• how to make a report;
• the types of wrongdoing that constitute a protected disclosure;
• what happens when a report is received; and
• the protections that are available against penalisation for reporting a concern about wrongdoing .
THE IPA will:
• Keep the identity of the reporting person and any person named in a report confidential;
• Not tolerate any penalisation or threat of penalisation of the reporting person or persons associated with the reporting person;
• Acknowledge all reports within 7 working days;
• Follow-up diligently on all reports of relevant wrongdoing;
• Provide feedback to the reporting person within 21 working days of acknowledgement; and
• Provide further feedback at 3 monthly intervals on written request.
The IPA Company Secretary has overall responsibility for the Procedures set out in this policy.
The IPA Head of Governance, Compliance and Risk is the Designated Person with day-to-day responsibility for the handling of reports.
A Designated Officer will be appointed from within the organisation to act as the Designated Person, in the event that the IPA Head of Governance, Compliance and Risk is unavailable.
Please read this document carefully before making a report. It is solely your responsibility to ensure you meet the criteria for protection under the Act. If you have any queries about this policy, please contact the IPA Company Secretary or the IPA Head of HR. If you require confidential, independent, advice (including legal advice) on the making of a protected disclosure, please refer to section 13 of this document.

2. Who this policy applies to
This policy applies to all “workers”. A “worker” is an individual in a work-related relationship with the IPA who acquires information on relevant wrongdoings in a work-related context and who is or was:
(a) an employee;
(b) an independent contractor, including IPA Associates;
(c) an agency worker;
(d) a trainee;
(e) a member of the IPA as per the IPA’s Constitution;
(f) a member of the IPA Board of Trustees or of its subcommittees;
(g) a volunteer;
(h) an individual who acquired information on a relevant wrongdoing during a recruitment process; or an individual who acquired information on a relevant wrongdoing during pre-contractual negotiations (other than a recruitment process).

3. What is a protected disclosure?
Making a report in accordance with the Protected Disclosures Act is referred to as “making a protected disclosure”. A “protected disclosure” means a disclosure of “relevant information” made by a “worker” in the manner specified in the Act. The relevant information must, in the reasonable belief of the worker, tend to show one or more relevant wrongdoings and have come to the attention of the worker in a work-related context. These requirements are explained in more detail below.
3.1 WHAT IS RELEVANT INFORMATION?
Relevant information is information which in the reasonable belief of the worker tends to show one or more relevant wrongdoings and it came to the attention of the worker in a work-related context.
The information should disclose facts about someone or something, rather than a general allegation that is not founded on any facts.
Workers should not investigate allegations of wrongdoing. The Designated Person is responsible for the appropriate follow-up of all reports.
3.2 WHAT IS A REASONABLE BELIEF?
The worker’s belief must be based on reasonable grounds, but it is not a requirement that the worker is ultimately correct. Workers are not expected to prove the truth of an allegation.
No disciplinary or other action will be taken against a worker who reasonably believes the information they have reported tends to show a wrongdoing even if the concern raised turns out to be unfounded.
The motivation of the worker in making a report is irrelevant as to whether or not it is a protected disclosure. The worker will be protected if they reasonably believe when making the report that the information disclosed tended to show a relevant wrongdoing.
A report made in the absence of a reasonable belief is not a protected disclosure and may result in disciplinary action. It is a criminal offence (see section 14A(v) of the Act) to make a report that contains any information the reporting person knows to be false. A person who suffers damage resulting from the making of a known to be false report has a right to take legal action against the reporting person.
3.3 WHAT ARE RELEVANT WRONGDOINGS?
To qualify as a protected disclosure, the matter reported must be a “relevant wrongdoing”. The following are relevant wrongdoings:
(a) that an offence has been, is being or is likely to be committed;
(b) that a person has failed, is failing or is likely to fail to comply with any legal obligation, other than one arising under the worker’s contract of employment or other contract whereby the worker undertakes to do or perform personally any work or services;
(c) that a miscarriage of justice has occurred, is occurring or is likely to occur;
(d) that the health or safety of any individual has been, is being or is likely to be endangered;
(e) that the environment has been, is being or is likely to be damaged;
(f) that an unlawful or otherwise improper use of funds or resources of a public body, or of other public money, has occurred, is occurring or is likely to occur;
(g) that an act or omission by or on behalf of a public body is oppressive, discriminatory or grossly negligent or constitutes gross mismanagement;
(h) that a breach of EU law as set out in the Act, has occurred, is occurring or is likely to occur; or that information tending to show any matter falling within any of the preceding paragraphs has been, is being or is likely to be concealed or destroyed or an attempt has been, is being or is likely to be made to conceal or destroy such information.
It does not matter whether a relevant wrongdoing occurred, occurs or would occur in Ireland or elsewhere and whether the law applying to it is that of Ireland or that of any other country or territory.
Workers may be subject to mandatory reporting obligations relevant to their role or profession. Such reports may or may not amount to protected disclosures under the Protected Disclosures Act depending on whether the requirements of the Act are met. Legislation other than and in addition to the Protected Disclosures Act may provide for making reports. Workers should ensure that they are aware of what protections, if any, such other legislation and/or the Protected Disclosures Act makes available to them and seek legal advice if necessary.
3.4 MATTERS THAT ARE NOT RELEVANT WRONGDOINGS
A matter is not a relevant wrongdoing if it is a matter which it is the function of the worker or the worker’s employer to detect, investigate or prosecute and does not consist of or involve an act or omission on the part of the employer.
A matter concerning interpersonal grievances exclusively affecting a worker is not a relevant wrongdoing and will not be dealt with under this procedure. Such matters are dealt with under the IPA Grievance Policy.
Failure to comply with a legal obligation that arises solely under the worker’s contract of employment or other contract where the worker undertakes to do or perform personally any work or services is not a relevant wrongdoing.
Protected disclosures can only be made by workers and be made in a work-related context (see next section).
3.5 WHAT IS A WORK-RELATED CONTEXT?
"Work-related context" means current or past work activities through which, irrespective of the nature of those activities, persons acquire information concerning a relevant wrongdoing and within which those persons could suffer penalisation if they reported such information.

4. How to make a report
Reports should be made to the IPA Head of Governance, Compliance and Risk (or Designated Officer) who is the Designated Person to receive reports under this policy.
Reports must be made in writing using the format outlined in Appendix A. Reports can be emailed to the Designated Person at DesignatedPerson@ipa.ie or posted to the IPA, marked Strictly Private and Confidential and addressed to the Designated Person.
A report can be made by way of a physical meeting upon request. A request for a meeting can be made by emailing DesignatedPerson@ipa.ie or by phoning the Institute on 01 2403600 and requesting to speak with the Designated Person.
In the event that a report is made to a member of staff other than the Designated Person, the member of staff should complete the Report Template Form at Appendix A and submit to the Designated Person.

5. Anonymous reports
Reports can be made anonymously. Persons who choose to report anonymously and whose report meets the requirements of the Act remain entitled to all of the protections of the Act.
Anonymous reports will be followed-up to the greatest extent possible. However, it may not be possible to fully assess and follow up on an anonymous report.
In addition, implementing certain elements of this policy – such as seeking further information, maintaining communication and protecting the reporting person’s identity or protecting them from penalisation – may not be possible.

6. Process following receipt of a report
This process shall apply to all reports made in the manner specified in section 4 of this policy. This process may not apply if a report or other communication is made in a manner other than that specified in section 4.
6.1 ACKNOWLEDGEMENT
All reports received shall be acknowledged within 7 working days of receipt.
6.2 ASSESSMENT
The Designated Person shall assess if there is prima facie evidence that a relevant wrongdoing might have occurred. Initial screening will be undertaken using the Decision Matrix outlined at Appendix C.
The Designated Person may, if required, make contact with the reporting person, in confidence, in order to seek further information or clarification regarding the matter(s) reported.
If it is unclear as to whether or not a report is a protected disclosure, the report will be treated as a protected disclosure until a definitive conclusion can be made.
It may be necessary to differentiate the information contained in the report. It may be the case that not all of the matters reported fall within the scope of this policy or the Protected Disclosures Act. Different parts of a report may need to be approached separately and some matters may be directed to another, more appropriate, policy or procedure (e.g. personal grievances).
The Designated Person may decide that there is no prima facie evidence of a relevant wrongdoing and either close the procedure or refer the matter to another relevant procedure. If this occurs, the Designated Person will notify the reporting person in writing of this decision and the reasons for it.
If the Designated Person decides that there is prima facie evidence of a relevant wrongdoing, appropriate action will be taken to address the wrongdoing, having regard to the nature and seriousness of the matter.
The nature and seriousness of the matter reported will inform whether the matter can or should be investigated internally. In some circumstances it may be more appropriate for an investigation to be carried out by external experts, or a statutory body, or for the matter to be reported to An Garda Síochána or other body.
An informal process may be used to address a disclosure where the alleged relevant wrongdoing is relatively straightforward or not very serious or does not require consideration of the making of adverse findings about any individual.
If a decision to close the matter or refer it to another process is made, a party affected by this decision may request a review of this decision, via the system of review set out in section 11 of this policy.
6.3 INVESTIGATION
The Designated Person shall decide whether or not an investigation is required. Appendix C outlines the Decision Matrix for initial screening of reports, to determine if the report falls within the scope of this policy.
If an investigation is required, the Designated Person shall decide how the matter should be investigated.
Investigations will be undertaken in accordance with the general principles of natural justice and fair procedures and any other relevant procedures of the IPA as appropriate.
Responsibility for investigating and addressing allegations of wrongdoing lies with the IPA and not the reporting person. Reporting persons should not attempt to investigate wrongdoing themselves.
A review of a decision not to investigate can be requested via the system of review set out in section 11 of this policy.
6.4 FEEDBACK
Feedback will be provided to the reporting person within a reasonable time period and no later than 21 working days after the initial acknowledgement of the report.
A reporting person can request the Designated Person, in writing, provide further feedback at 3-month intervals until the process of follow-up is completed.
Any feedback is provided in confidence and should not be disclosed by the reporting person other than:
(a) as part of the process of seeking legal advice in relation to their report from a solicitor or a barrister or a trade union official; or
(b) if required in order to make a further report through this or another reporting channel provided for under the Act (see next section).
Feedback will include information on the action taken or envisaged to be taken as follow-up to that report and also the reasons for such follow-up.
Feedback will not include any information that could prejudice the outcome of an investigation or any other action that might follow.
Feedback will not include any information relating to an identified or identifiable third party. In particular, feedback will not include any information on any disciplinary process involving another worker. Such information is confidential between the employer and the worker concerned.
If the follow-up process determines that no relevant wrongdoing has occurred, the reporting person will be informed of this in writing and the reasons for this decision. A review of this decision may be requested via the system of review set out in section 11 of this policy.
The final outcome of the process triggered by the report will be communicated to the reporting person, subject to any legal restrictions concerning confidentiality, legal privilege, privacy and data protection or any other legal obligation.

7. Other reporting channels
The aim of this policy is to provide a means by which workers can safely and securely raise concerns about relevant wrongdoing and to give certainty that all such concerns will be dealt with appropriately. The IPA is confident that issues can be dealt with internally and strongly encourages workers to report such concerns internally in accordance with this policy.
There may, however, be circumstances where a worker may not wish to raise their concern internally or if they have grounds to believe that an internal report they have made has not been followed-up properly.
The Protected Disclosures Act sets out a number of alternative external channels for workers to raise concerns. Information regarding these channels is set out in Appendix D of this policy.
It is important to note, however, that if a worker is considering making a disclosure using these other channels, different and potentially more onerous conditions may apply. Workers are advised to seek professional advice before reporting externally. Information on where to seek independent, confidential advice in this regard can be found at section 12 of this policy.

8. Protection from penalisation
The IPA is committed to protecting workers from penalisation or a threat of penalisation because the worker made a protected disclosure. Acts of penalisation will not be tolerated.
If a worker is penalised or threatened with penalisation this can be reported to the Head of HR, and the report will be followed-up in accordance with the IPA’s Disciplinary Procedures.
Where a worker feels this may not be appropriate, they may bring the matter to the attention of the IPA Director General, the Workplace Relations Committee (WRC), or external supports as per section 12 of this policy.
Penalisation is any direct or indirect act or omission that occurs in a work-related context, which is prompted by the making of a protected disclosure and causes or may cause unjustified detriment to a worker.
Penalisation includes, but is not limited to:
(a) Suspension, layoff or dismissal;
(b) Demotion, loss of opportunity for promotion or withholding promotion;
(c) Transfer of duties, change of location of place of work, reduction in wages or change in working hours;
(d) The imposition or administering of any discipline, reprimand or other penalty (including a financial penalty);
(e) Coercion, intimidation, harassment or ostracism;
(f) Discrimination, disadvantage or unfair treatment;
(g) Injury, damage or loss;
(h) Threat of reprisal;
(i) Withholding of training;
(j) A negative performance assessment or employment reference;
(k) Failure to convert a temporary employment contract into a permanent one, where the worker had a legitimate expectation that he or she would be offered permanent employment;
(l) Failure to renew (where there is a legitimate expectation of renewal), or early termination of a temporary employment contract;
(m) Harm, including to the worker’s reputation, particularly in social media, or financial loss, including loss of business and loss of income;
(n) Blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
(o) Early termination or cancellation of a contract for goods or services;
(p) Cancellation of a licence or permit; and
(q) Psychiatric or medical referrals.
Appropriate action, which may include disciplinary action, will be taken against a worker who penalises a reporting person or other individual due to the making of a protected disclosure.
The normal management of a worker who has made a protected disclosure is not penalisation.
If a protected disclosure is made during an investigation or disciplinary process to which the reporting person is subject, it will not automatically follow that the making of the report will affect the investigation or disciplinary process. Separate processes unconnected with the disclosure will ordinarily continue to proceed.
Disclosure of an alleged wrongdoing does not confer any protection or immunity on a worker in relation to any involvement they may have had in that alleged wrongdoing.
The Protected Disclosures Act provides that a worker who suffers penalisation as a result of making a protected disclosure can make a claim for redress through either the Workplace Relations Commission or the courts, as appropriate.
A claim concerning penalisation or dismissal must be brought to the Workplace Relations Commission within 6 months of the date of the act of penalisation or the date of dismissal to which the claim relates.
A claim for interim relief pending proceedings at the Workplace Relations Commission or the courts must be made to the Circuit Court within 21 days of the last date of penalisation or date of dismissal.
It is a criminal offence (see section 14A(II) of the Act) to penalise or threaten penalisation or permit any other person to penalise or threaten penalisation against any of the following:

• The reporting person;
• A facilitator (a person who assists the reporting person in the reporting process);
• A person connected to the reporting person, such as a colleague or a relative; or
• An entity the reporting person owns, works for or is otherwise connected with in a work-related context.

9. Protection from legal liability
Section 14 of the Act provides that civil legal action, with the exception of defamation, cannot be taken against a worker who makes a protected disclosure. Workers can be sued for defamation but are entitled to the defence of “qualified privilege”. This means that it should be very difficult for a defamation case against a worker to succeed if the worker can show they have made a protected disclosure in good faith. There is no other basis under which a worker can be sued if they have made a protected disclosure.
Section 15 of the Act provides that If a worker is prosecuted for disclosing information that is prohibited or restricted, it is a defence for the worker to show they reasonably believed they were making a protected disclosure at the time they disclosed the information.
Section 23 of the Act provides that It is not permitted to have clauses in agreements that prohibit or restrict the making of a protected disclosure, exclude or limit any provision of the Act, preclude a person from bringing proceedings under or by virtue of the Act or preclude a person from bringing proceedings for breach of contract in respect of anything done in consequence of making a protected disclosure.
Please refer to section 12 of this policy on how to obtain further information and independent, confidential advice in relation to these statutory rights.

10. Confidentiality and protection of identity
The IPA is committed to protecting the confidentiality of the identity of both workers who raise a concern under these procedures, and any third party mentioned in a report, and to treating the information disclosed in confidence.
The Designated Person, and any other IPA officer who receives, or is otherwise involved in a report, will not disclose the identity of the reporting person without the explicit consent of the reporting person, save in the circumstances outlined below.
Subject to the exceptions below, the identity of the reporting person or any information from which their identity may be directly or indirectly deduced will not be shared with anyone other than persons authorised to receive, handle or follow-up on reports made under this policy without the explicit consent of the reporting person.
The Protected Disclosures Act provides for certain exceptions where a reporting person’s identity or information that could identify the reporting person can be disclosed without the reporting person’s consent. There are:
(a) Where the disclosure is a necessary and proportionate obligation imposed by EU or national law in the context of investigations or judicial proceedings, including safeguarding the rights of defence of persons connected with the alleged wrongdoing;
(b) Where the person to whom the report was made or shared shows they took all reasonable steps to avoid disclosing the identity of the reporting person or any information that could identify the reporting person;
(c) Where the person to whom the report was made or shared reasonably believes disclosing the identity of the reporting person or information that could identify the reporting person is necessary for the prevention of serious risk to the security of the State, public health, public safety or the environment; and
(d) Where the disclosure is otherwise required by law.
Where a reporting person’s identity or information that could identify a reporting person is to be disclosed under exceptions (a) to (d), above, the reporting person will be notified in writing in advance, unless such notification would jeopardise:

• The effective investigation of the relevant wrongdoing reported;
• The prevention of serious risk to the security of the State, public health, public safety or the environment; or
• The prevention of crime of the prosecution of a criminal offence.

A reporting person may request a review of a decision to disclose their identity under the System of Review set out in section 11 of this policy.
Circumstances may arise where protection of identity is difficult or impossible – e.g. if the nature of the information disclosed means the reporting person is easily identifiable. If this occurs, the risks and potential actions that could be taken to mitigate against them will be outlined and discussed with the reporting person by the Designated Person (or Designated Officer).
Other employees must not attempt to identify reporting persons. Attempts to do so may result in disciplinary action.
If a worker believes that their identity has been disclosed without their consent, they can report this to the IPA Company Secretary or the IPA Head of HR.
The Designated Person (or Designated Officer) will keep a record of all reports, including anonymous reports, in accordance with applicable polices concerning record keeping, data protection and freedom of information. Please refer to Appendix B of this policy for further information.

11. System of review
A review may be sought:

• By the reporting person into a decision, following assessment, to close the procedure or refer the matter to another process.
• By any affected party in respect of the conduct or outcome of any follow-up actions (including any investigation) taken on foot of the receipt of a report;
• By any affected party in respect of the conduct or outcome of any investigation into a complaint of penalisation; and
• Except in exceptional cases, by any party affected by any decision to disclose the identity of the reporting person to persons other than those authorised under these procedures to handle reports.

A request for a review can be made to the IPA Company Secretary in the first instance. If this is not deemed appropriate, the request for a review can then be made to the IPA Head of HR.

12. Supports and information
Transparency International Ireland operates a free Speak-Up Helpline that offers support and advice (including legal advice) for workers who have reported or plan to report wrongdoing. Contact details are:
E-mail: admin@transparency.ie Telephone: +353 1 554 3938
Speakup Helpline: 1800 844 866 Address: Floor 2, 69 Middle Abbey Street, Dublin 1
For workers who are members of a trade union, many unions offer free legal advice services on employment-related matters, including protected disclosures.
The IPA provides a free and confidential Employee Assistance Service. To avail of these services, please contact:
The Clanwilliam Institute
Lynx House
Old Church Road
Lower Kilmacud Road, Stillorgan, A94 E4Y0
Email reception@clanwilliam.ie , indicating that you are an employee of the IPA.

13. Policy review and governance

This policy will be reviewed periodically by the Audit and Risk Committee, and at least on an annual basis.

Appendix A – Making a Report Template Form
PROTECTED DISCLOSURE FORM – TO BE SENT TO DESIGNATED PERSON
1. I…………….......................................... (name of worker making the protected disclosure) wish to make a disclosure under the Protection Disclosures Act 2014 as amended by The Protected Disclosures (Amendment) Act 2022
2.Job title and place of work:
___________________________________________________________________________
3. Please indicate your worker category (see section 2 of this policy):
___________________________________________________________________________
I confirm I have read the IPA Protected Disclosures Policy and that it is my reasonable belief that a relevant wrongdoing has been, is being or is likely to be committed. (Please tick box)
Category of Relevant Wrongdoing that is the subject of this report: (please tick as appropriate)
o that a person has failed, is failing or is likely to fail to comply with any legal obligation, other than one arising under the worker’s contract of employment or other contract whereby the worker undertakes to do or perform personally any work or services;
o that a miscarriage of justice has occurred, is occurring or is likely to occur;
o that the health or safety of any individual has been, is being or is likely to be endangered;
o that the environment has been, is being or is likely to be damaged;
o that an unlawful or otherwise improper use of funds or resources of a public body, or of other public money, has occurred, is occurring or is likely to occur;
o that an act or omission by or on behalf of a public body is oppressive, discriminatory or grossly negligent or constitutes gross mismanagement;
o that a breach of EU law as set out in the Act, has occurred, is occurring or is likely to occur; or that information tending to show any matter falling within any of the preceding paragraphs has been, is being or is likely to be concealed or destroyed or an attempt has been, is being or is likely to be made to conceal or destroy such information.
4. Date of the alleged wrongdoing (if known) or the date the alleged wrongdoing commenced
__________________________________________________________________________
5. Is the alleged wrongdoing still ongoing?
___________________________________________________________________________
___________________________________________________________________________
6. Has this alleged wrongdoing already been disclosed, if so, to whom, when and what action was taken? __________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
7. Details of the protected disclosure (care should be taken to only include the name(s) of individual(s) directly relevant to the report)
___________________________________________________________________________
___________________________________________________________________________
___________________________________________________________________________
___________________________________________________________________________
___________________________________________________________________________
Please provide contact details at which the recipient can contact you:
Address:
Tel no:
Email :
Worker’s signature :
Date:

Appendix B – Record keeping, data protection and freedom of information
B.1 RECORD KEEPING
A record of all reports – including all anonymous reports – will be kept.
Where a report is made via a physical meeting upon request, the Designated Person or Designated Officer will complete the template form, as at Appendix A, at that meeting. The reporting person shall be offered an opportunity at the meeting to check, rectify and agree the form .
B.2 DATA PROTECTION
All personal data will be processed in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR).
It is important to note that section 16B of the Protected Disclosures Act imposes certain restrictions on data subject rights, as allowed under Article 23 of the GDPR.
Where the exercise of a right under GDPR would require the disclosure of information that might identify the reporting person or persons concerned, or prejudice the effective follow up of a report, exercise of that right may be restricted.
Rights may also be restricted to the extent, and as long as, necessary to prevent and address attempts to hinder reporting or to impede, frustrate or slow down follow-up, in particular investigations, or attempts to find out the identity of reporting persons or persons concerned.
If a right under GDPR is restricted, the data subject will be given the reasons for the restriction, unless the giving of such reasons would identify the reporting person or persons concerned, or prejudice the effective follow up of a report, or prejudice the achievement of any important objectives of general public interest as set out in the Act.
A person whose data subject rights are restricted can make a complaint to the Data Protection Commissioner or seek a judicial remedy in respect of the restriction.
For Information: THE IPA PROTECTED DISCLOSURES PRIVACY NOTICE
The Institute of Public Administration is a body which is uniquely dedicated to the education, learning and development within the Irish Public Service. The Institute has multiple specialist services that support and advise on different approaches to capacity building within the Public Service.
The Institute is committed to protecting your data and respecting your privacy. This Privacy Notice explains how the Institute, as the Data Controller, will process the personal data (as defined in Article 4 of the GDPR) provided to it in respect of a protected disclosure; how that information will be used and what rights you may exercise in relation to your personal data.
Categories of Personal Data
The following items of personal data may be processed by the Institute in respect of Protected Disclosures:
• Name (First name, Surname)
• Address
• Date of Birth
• Eircode
• Email Address
• Phone Number
• Employment Details* (Role, Job Title, Grade etc.)
• Medical information including special category information as defined by Article 9 of the GDPR
* Employment details may also include complaints or accusations of wrongdoing, complaints or accusations of inappropriate behavior and accusations or complaints in relation to the failure to comply with organizational policies, procedures and processes.
Source of the Personal Data
Your Personal Data was provided to the Institute directly by you or the person making the protected disclosure.
Purpose(s) for processing
The Institute will use the information provided in order to assess and investigate the protected disclosure(s)
Lawful bases for processing
It is necessary for the Institute to fulfil its obligations under the Protected Disclosures Act 2014 and the Protected Disclosures (Amendment) Act 2022. Therefore, your personal data is processed as per Art 6 1 (c) of the GDPR, which states that the processing is necessary for compliance with a legal obligation to which the [data] controller is subject.
Profiling
The Institute will not use any personal data collected from you in respect of protected disclosures for profiling or automated decision-making purposes.
Security of your personal data
The Institute has implemented appropriate technical and organisational measures to protect your information (including personal data) from unauthorised access. A limited number of Institute staff will have access to your information, which will be stored in an electronic file system that features restricted access that is controlled by password and network protection.
Recipients of the data
Your personal data may be shared internally for compliance purposes.
Your personal data may be shared with the Office of the Protected Disclosures Commissioner. The Protected Disclosures Commissioner is responsible for ensuring that all external protected disclosures received by prescribed bodies are dealt with by the appropriate body.
Personal data may also be shared in certain circumstances with third parties where it is necessary to advance the investigation or other purposes where necessary and in accordance with statutory and regulatory obligations (for example, An Garda Siochana may be notified if fraudulent or criminal activity is discovered).
Cross-border data transfers
The Institute will not transfer personal data collected in respect of protected disclosures to any country or international organisation outside the EEA.
B.3 FREEDOM OF INFORMATION
The Freedom of Information Act 2014 does not apply to any records relating to disclosures made in accordance with the Protected Disclosures Act, irrespective of when it was made.
How long will your data be kept?
The Institute will only retain your personal data for as long as it is necessary for the purposes which it was collected and processed. As standard policy, copies of disclosures made by Institute staff plus related investigations and outcomes will be retained until the matter is resolved and for a period of seven years thereafter.
Your rights
You have the right to request access to your personal data the we hold in relation to you. You have the right to obtain confirmation as to whether data concerning you exists, be informed of the content and source of the data and to check whether the data we hold about you is accurate.
In addition, you have the right to have your data (under certain conditions) erased, you have the right to restriction and the right to object to the processing of your personal data (again, under certain conditions).
If you consider that your rights have been infringed, you have the right to make a complaint to the Irish Data Protection Commission (www.dataprotection.ie) and you have the right to seek a judicial remedy.
Contacting us
The Institute is the Data Controller when processing your personal data for the purposes outlined in this privacy notice. The institutes contact details are available here Contact Us (ipa.ie)
The Institute has appointed a Data Protection Officer to support its compliance with data protection law. The contact details for the Institute’s Data Protection Officer Are:
Data Protection Officer, Institute of Public Administration, 57-61 Lansdowne Road, Ballsbridge, Dublin 4, Ireland, D04 TC62.
DPO@ipa.ie

Appendix C - Template Decision Matrix
The Protected Disclosures Policy (the “Policy”) of the IPA outlines the internal procedures for managing reports received by the IPA as alleged Protected Disclosures. In accordance with the Policy, the Designated Person has been appointed to undertake a screening assessment on each report received to determine whether or not it should be treated as a Protected Disclosure.
The below decision matrix has been used by the Designated Person in reaching their determination in respect of the disclosure(s) received.
Definition of Protected Disclosure: A disclosure of information which, in the reasonable belief of a worker, tends to show one or more relevant wrongdoings; which came to the attention of the worker in a work-related context; and is disclosed in the manner prescribed in the Protected Disclosure Act 2014 (as amended).

Appendix D – Other disclosure channels
D.1 OVERVIEW
The aim of this policy is to provide a means by which workers can safely and securely raise concerns about relevant wrongdoing and to give certainty that all such concerns will be dealt with appropriately. The IPA is confident that issues can be dealt with internally and strongly encourages workers to report such concerns internally in accordance with this policy.
There may, however, be circumstances where a worker may not wish to raise their concern internally or if they have grounds to believe that an internal report they have made has not been followed-up properly.
The Protected Disclosures Act sets out a number of alternative external channels for workers to raise concerns. Information regarding these channels is set out below.
Workers should note that different and potentially more onerous conditions may apply when using these channels. Workers are advised to seek professional advice before reporting externally. Information on where to seek independent, confidential advice in this regard can be found at section 13 of this policy.
The information set out in this Appendix gives a general overview of the other disclosure channels available under the Act. It does not purport to be legal advice or a legal interpretation of the Protected Disclosures Act. It is entirely a matter for each worker to satisfy themselves that they are reporting in accordance with the Act.
D.2 REPORTING TO A PRESCRIBED PERSON
The conditions applying to reporting to a prescribed person are set out in section 7 of the Protected Disclosures Act.
Prescribed persons are designated by the Minister for Public Expenditure, NDP Delivery and Reform to receive reports of wrongdoing in respect of matters they regulate or supervise.
If a worker wishes to make a report to a prescribed person, in addition to having a reasonable belief that the information they report tends to show a relevant wrongdoing, they must also reasonably believe the information they report is substantially true and that the relevant wrongdoing they wish to report falls within the description of matters for which the person is prescribed.
Prescribed persons are required to have formal channels to receive reports to them under the Act and to acknowledge, follow-up and give feedback on all reports received.
If a worker decides to report to a prescribed person, they must make sure that they choose the right person or body for their issue. For example, if they are reporting a breach of data protection law, they should contact the Data Protection Commission. A full list of prescribed persons and a description of the matter for which they have been prescribed can be found at: www.gov.ie/prescribed-persons/.
D.3 REPORTING TO THE PROTECTED DISCLOSURES COMMISSIONER
The conditions applying to reporting to the Protected Disclosures Commissioner are set out in section 7 of the Protected Disclosures Act.
The Protected Disclosures Commissioner is an alternative means by which a worker can make a report under section 7 of the Act. In particular, the Commissioner can assist where the worker is uncertain as to which prescribed person to report to. The Commissioner will transmit the report to the correct prescribed person or to another person the Commissioner considers suitable to follow-up on the report. In exceptional circumstances (e.g. if no prescribed person or suitable person can be found) the Commissioner will follow-up directly on a report.
If a worker wishes to make a report to the Commissioner, in addition to having a reasonable belief that the information they report tends to show a relevant wrongdoing, they must also reasonably believe the information they report and any allegation contained in it is substantially true.
The Commissioner has established formal channels for workers to make reports under the Act. Information on how to report to the Commissioner is available at: https://www.opdc.ie/.
D.4 REPORTING TO INSTITUTIONS OF THE EU
The conditions applying to reporting to institutions of the EU is set out in section 7B of the Act.
If the relevant wrongdoing a worker wishes to report concerns a breach of European Union (EU) law, as set out EU Directive 2019/1937 on the protection of persons who report breaches of Union law, they can report to a relevant institution, body, office or agency of the EU, provided:
• the worker believes the information they wish to report is true at the time of reporting; and
• the information falls with the scope of EU Directive 2019/1937.
A number of these EU institutions have formal channels for receiving reports from workers. A worker wishing to make such a report should contact the institution concerned for information in this regard.
D.5 REPORTING TO A MINISTER
The conditions applying to reporting to a Minister are set out in section 8 of the Protected Disclosures Act.
A worker who is or was employed by a public body can make a report to the Minister or Minister of State responsible for the public body concerned, provided one or more of the following conditions is met:

• the worker has previously made a report of substantially the same information to their employer or other responsible person; or to a prescribed person; or the Protected Disclosures Commissioner; or to a relevant Minister but no feedback has been provided to the worker in response to the report within the specified feedback period, or, where feedback has been provided, the worker reasonably believes that there has been no follow-up or that there has been inadequate follow-up;
• the worker reasonably believes the head of the public body concerned is complicit in the relevant wrongdoing concerned;
• the worker reasonably believes that the relevant wrongdoing concerned may constitute an imminent or manifest danger to the public interest, such as where there is an emergency situation or a risk of irreversible damage.

In the case of The IPA, the relevant Minister is The Minister for Public Expenditure, NDP Delivery and Reform
D.6 REPORTING TO A LEGAL ADVISER
The conditions for reporting to a legal adviser are set out in section 9 of the Act.
A worker can disclose information concerning a relevant wrongdoing to a barrister, a solicitor or a trade union official (or an official of an excepted body under section 6 of the Trade Union Act 1941) in the course of obtaining legal advice, including advice in relation to the operation of the Protected Disclosures Act.
D.7 REPORTING TO OTHER THIRD PARTIES
There are specific – and more onerous – conditions that must be met for a worker to be protected if they make a disclosure to any person other than their employer or other responsible person, a prescribed person, the Protected Disclosures Commissioner or a relevant Minister. These are set out in section 10 of the Protected Disclosures Act.
The worker must reasonably believe that the information disclosed in the report, and any allegation contained in it, is substantially true, and that at least one of the following conditions is met:
the worker previously made a disclosure of substantially the same information to their employer or other responsible person; to a prescribed person; to the Protected Disclosures Commissioner, or to a relevant Minister, but no appropriate action was taken in response to the report within the specified feedback period; or

• the worker reasonably believes that the relevant wrongdoing concerned may constitute an imminent or manifest danger to the public interest, such as where there is an emergency situation or a risk of irreversible damage, or
• the worker reasonably believes that if he or she were to make a report to a prescribed person, the Protected Disclosures Commissioner or a relevant Minister that there is a risk of penalisation, or
• the worker reasonably believes that if he or she were to make a report to a prescribed person, the Protected Disclosures Commissioner or a relevant Minister that there is a low prospect of the relevant wrongdoing being effectively addressed, due to the particular circumstances of the case, such as those where evidence may be concealed or destroyed or where a prescribed person may be in collusion with the perpetrator of the wrongdoing or involved in the wrongdoing.

D.8 REPORTING OF MATTERS RELATED TO LAW ENFORCEMENT AND THE ADMINISTRATION OF JUSTICE
Section 17 of the Protected Disclosures Act sets out certain special conditions that apply to the reporting of matters relating to law enforcement and the administration of justice. A full definition of what constitutes such matters is set out in section 17(1) of the Act.
In general, reports concerning law enforcement and the administration of justice can only be made:

• To the workers employer in accordance with this policy; or
• To a prescribed person, if a person has been prescribed in respect of the matter the worker wishes to report; or
• To the Comptroller and Auditor General, if the report contains taxpayer information.

A worker can also disclose information concerning a relevant wrongdoing in this area to a legal adviser or a trade union official (or an official of an excepted body under section 6 of the Trade Union Act 1941) in the context of seeking legal advice regarding their disclosure.
A report on matters concerning law enforcement and the administration of justice can in certain circumstances be made to a member of Dáil Éireann or Seanad Éireann. Section 17 sets out the specific conditions that apply in this case. Workers should familiarize themselves with these conditions and seek legal advice if required.
No other form of disclosure of these matters is permitted under the Protected Disclosures Act.
D.9 REPORTING OF MATTERS RELATED TO SECURITY, DEFENCE, INTERNATIONAL RELATIONS AND INTELLIGENCE
Section 18 of the Protected Disclosures Act sets out certain special conditions that apply to the reporting of matters relating to security, defence, international relations and intelligence. A full definition of what constitutes such matters is set out in sections 18(1) and 18(2) of the Act. Reports concerning matters relating to these areas can only be made:

• To the worker’s employer, in accordance with this policy;
• To a relevant Minister in accordance with section 8 of the Protected Disclosures Act;
• To the Disclosures Recipient in accordance with section 10 of the Protected Disclosures Act.

A worker can also disclose information concerning a relevant wrongdoing in these areas to a legal adviser or a trade union official (or an official of an excepted body under section 6 of the Trade Union Act 1941) in the context of seeking legal advice regarding their disclosure.
No other form of disclosure of these matters is permitted under the Protected Disclosures Act.