Policy and procedure for protected disclosures made by an external person

Policy and procedure for protected disclosures made by an external person

Date published: May 2024

1.      Introduction

The Pensions Regulator has been prescribed under the Protected Disclosures Act 2014 to receive protected disclosures in respect all matters relating to the monitoring and supervision of the operation of the Pensions Act 1990.

The Protected Disclosures Act 2014 as amended by the Protected Disclosures Act 2022 (the Act) protects workers from retaliation if they speak up about certain wrongdoings in the workplace. Persons who make protected disclosures (sometimes referred to as ‘whistleblowers’) are protected by the Act. They should not be treated unfairly or lose their job because they have made a protected disclosure.

A worker may choose to report internally to their employer or, if certain conditions are satisfied, a worker can choose to report externally to a prescribed person.

In accordance with the Act, the Pensions Authority (the Authority) has established a formal channel for workers who wish to make an external report to them in relation to the matters set out above.

The Authority will:

• keep the identity of the reporting person and any person named in a report confidential;
• acknowledge all reports within seven days unless the reporting person requests otherwise;
• assess and, where appropriate, follow up on the information contained in the report;
• provide feedback to the reporting person; and
• provide information to the reporting person on the final outcome of their report.

This policy also applies to any reports sent to the Pensions Regulator by another prescribed person or by the Protected Disclosures Commissioner in accordance with the Act.

Please read this document carefully before making a report. It is solely your responsibility to ensure you meet the criteria for protection under the Act.

If you have any queries about this policy, please contact protecteddisclosures@pensionsauthority.ie.

2.      Conditions under which a report to the Pensions Regulator qualifies as a protected disclosure

2.1      What is a protected disclosure?

A ‘protected disclosure’ is a disclosure of ‘relevant information’ made by a ‘worker’ in the manner specified in the Act. The relevant information must, in the reasonable belief of the worker, tend to show one or more ‘relevant wrongdoings’ and have come to the attention of the worker in a ‘work-related context’.

To report to the Pensions Regulator or any other prescribed person, a worker must also reasonably believe that:

• the relevant wrongdoing falls within the description of matters in respect of which the person is prescribed to receive disclosures; and
• the information disclosed, and any allegation contained in it, are substantially true.

You must fulfil all of the requirements set out in the Act in order for your report to qualify as a protected disclosure. These requirements are explained in more detail below.

If you are uncertain as to whether your report qualifies as a protected disclosure, you should seek professional advice. If you require confidential, independent advice (including legal advice) on the making of a protected disclosure, please refer to section 10 of this document.

2.2      Who can make a protected disclosure?

You can make a protected disclosure if you are a ‘worker’. A worker is an individual who acquires information on relevant wrongdoings in a work-related context and includes:

• current and former employees whether permanent or temporary;
• retired employees;
• ex-workers;
• independent contractors;
• consultants;
• trainees;
• volunteers;
• job applicants;
• agency workers; and
• Board and Committee members.

If you are not a worker, you cannot make a protected disclosure and you are not protected by the Act.

2.3      What is relevant information?

Relevant information is information which in the reasonable belief of the worker tends to show one or more relevant wrongdoings that came to the attention of the worker in a work-related context.

The information you report should disclose facts about someone or something, rather than a general allegation that is not founded on any facts.

You should not investigate allegations of wrongdoing or gather additional evidence or information – just provide the facts that you know.

2.4      What is reasonable belief?

The term reasonable belief means that your belief must be based on reasonable grounds. Some form of objective basis for such a belief must exist for it to constitute a reasonable belief. It is not a requirement that you are ultimately correct, and you are not expected to prove the truth of an allegation. Once the requirements of the Act have been satisfied, you remain entitled to the protections of the Act even if the information you have reported turns out to be unfounded.

You will be protected if you reasonably believe when making the report that the information disclosed tended to show a relevant wrongdoing.

A report made in the absence of reasonable belief is not a protected disclosure and could lead to your employer taking disciplinary action against you. It is a criminal offence to make a report that contains any information that you know to be false. You could also face legal action from any person who suffers damage resulting from a report you have made that you know to be false.

2.5      What are relevant wrongdoings?

To qualify as a protected disclosure, the information you report must concern a ‘relevant wrongdoing’. The following are relevant wrongdoings:

• Criminal offences.
• Failure to comply with a legal obligation.
• Miscarriages of justice.
• Endangerment of health and safety.
• Damage to the environment.
• Unlawful or improper use of public funds.
• Oppressive, discriminatory behaviour or behaviour that constitutes gross mismanagement by a public body.
• Breaches of EU law.
• Concealing or destroying evidence.

In order to report to the Authority, the information you wish to report must concern a relevant wrongdoing and fall within the scope of the matters for which the Authority has been prescribed under the Act. See section 2.8, below for further information on what can be reported to the Pensions Regulator.

2.6      Matters that are not relevant wrongdoings

The following matters are not considered relevant wrongdoings:

• where it is the function of the worker or the worker’s employer to uncover a wrongdoing, the protections of the Act do not apply, unless it involves an act or omission on the part of the employer.
• where it concerns interpersonal grievances exclusively affecting a worker is not a relevant wrongdoing and will not be dealt with under this procedure. Such grievances should be raised with your employer in accordance with their policy on such matters.
• failure to comply with a legal obligation that arises solely under your contract of employment or any other contract where you undertake to do or perform personally any work or services. Such matters should be raised with your employer in accordance with their policy in this area.

2.7      What is a work-related context?

Work-related context means current or past work activities in the public or private sector through which you acquire information concerning a relevant wrongdoing.

2.8      Who can a protected disclosure be made to?

You can report internally to your employer and, if you are comfortable with this, you are encouraged to do so. Most protected disclosures are made internally in the first instance.

You do not have to report to your employer before you can report to a prescribed person.

Your employer may have a protected disclosures or whistleblowing policy. All public sector bodies, regardless of size, and all employers with 50 or more employees are required under the Act, to have formal channels and procedures for their workers to report relevant wrongdoing.

If you don’t want to report to your employer, or reporting to your employer hasn’t worked, you may have the option of reporting to a prescribed person.

The Pensions Regulator is a prescribed person under the Act to receive protected disclosures in respect all matters relating to the monitoring and supervision of the operation of the Pensions Act 1990.

In order to report to the Pensions Regulator, the information you wish to report must have come to your attention in a work-related context and you must reasonably believe that:

• the information tends to show one or more relevant wrongdoing;
• the information, and any allegation contained in it, is substantially true; and
• the information falls within the description of matters for which the Authority has been prescribed.

If the matter you wish to report is a relevant wrongdoing, but does not fall under the description of matters set out above, it may be possible that another prescribed person can deal with your report. A full list of all prescribed persons and the matters that can be reported to them can be found at: www.gov.ie/prescribed-persons/.

If you are not sure which prescribed person you should report to, or if there does not appear to be a prescribed person for the matter in question, you can make a report to the Protected Disclosures Commissioner. Details of how to report to the Commissioner can be found at: https://www.opdc.ie/.

A worker may make a report to an institution, body, office or agency of the European Union (per section 7B of the Act), provided that:

• you believe the information you wish to report is true at the time of reporting; and
• the information falls with the scope of EU Directive 2019/1937.

If reporting to your employer and/or reporting to a prescribed person does not work or there are justifiable grounds for not reporting to either your employer or a prescribed person, the Act provides that you can report to a third party, such as:

• a relevant Minister of the Government;
• Protected Disclosures Commissioner; or
• a legal adviser.

The conditions for reporting via these channels are more onerous than those that apply to reporting to your employer or a prescribed person or the Protected Disclosures Commissioner. You may wish to seek professional advice before using these channels. Please refer to section 10 of this document for information on where to seek further advice in this regard.

3.      How to make a report

Reports should be made to the Pensions Regulator who is a prescribed person.

Reports can be made in writing or orally as follows:

• by email to protecteddisclosures@pensionsauthority.ie;
• by post to Protected Disclosures, The Pensions Regulator, Verschoyle House, 28-30 Lower Mount Street, Dublin 2, D02 KX27;
• by way of a physical meeting upon request to protecteddisclosures@pensionsauthority.ie ;
• by phone – (01) 6131900. 

Reports should contain specific, factual information to allow for the appropriate assessment and investigation of the matter and should at least contain the information set out in Appendix I.

This protected disclosures policy will apply to any reports sent to the Pensions Regulator by other prescribed persons or the Protected Disclosures Commissioner.

4.      Anonymous reports

Reports can be made anonymously. If you choose to report anonymously and your report meets the requirements of the Act, you remain entitled to the protections of the Act if you are subsequently identified and penalised for making your report.

Anonymous reports will be followed up to the greatest extent possible. However, it may not be possible to fully assess and follow up on an anonymous report.

In addition, implementing certain elements of this policy – such as seeking further information from you, maintaining communication with you and protecting your identity – may not be possible when you make an anonymous report.

5.      Process following receipt of a report

The prescribed person will designate an appropriate senior person to manage any reports received.

5.1      Acknowledgement

The prescribed person will acknowledge all reports in writing within seven calendar days of receipt unless:

• you request that no acknowledgement is made; or
• the prescribed person believes that to issue an acknowledgement would jeopardise the protection of your identity.

The acknowledgement shall include information about the next steps in the protected disclosure process and a copy of these procedures.

5.2      Assessment

An initial assessment will be undertaken of all reports received. The prescribed person will assess:

• if they consider there is prima facie evidence that a relevant wrongdoing might have occurred; and
• whether the report concerns matter(s) that fall within the scope for which they have been prescribed under the Act.

They may, if required, make contact with you, in confidence, in order to seek further information or clarification regarding the matter(s) you have reported.

The Act requires that you shall cooperate with the prescribed person in relation to the performance of their functions under the Act. This includes any functions they carry out as part of the assessment process.

It may be the case that the prescribed person assessment finds that not all of the matters reported qualify as relevant wrongdoings under the Act or fall within the matters for which they have been prescribed under the Act. They may deal with parts of a report differently according to what, in their opinion, is the most appropriate thing to do in each case.

The prescribed person may decide that there is no prima facie evidence that a relevant wrongdoing may have occurred. If this decision is made, the procedure will be closed, and you will be notified in writing as soon as practicable of the decision and the reasons for it.

The prescribed person may decide that there is prima facie evidence that a relevant wrongdoing may have occurred, but that the relevant wrongdoing is clearly minor and does not require follow-up. If this decision is made, the procedure will be closed, and you will be notified in writing as soon as practicable of the decision and the reasons for it.

The prescribed person may decide that all or part of a report is a repetitive report that does not contain any meaningful new information compared to a previous report. If this decision is made, the procedure will be closed, and you will be notified in writing as soon as practicable of the decision and the reasons for it.

The prescribed person may decide that all or part of a report concerns matters which are not within the scope of matters prescribed under the Act. If this decision is made, the prescribed person will transmit your report – in whole or in part, as appropriate – to another prescribed person as they consider appropriate or, where, in their opinion, there is no such other prescribed person, to the Protected Disclosures Commissioner. You will be notified in writing as soon as practicable of the decision and the reasons for it.

5.3      Follow-up

Where, in the prescribed persons opinion, there is prima facie evidence that a relevant wrongdoing may have occurred that falls within the scope of matters prescribed under the Act, they shall decide on what further follow-up action is required, having regard to their statutory powers and functions and having regard to the nature and seriousness of the matter.

The Act requires that you shall cooperate with the prescribed person in relation to the performance of their functions under the Act.

5.4      Feedback

Feedback will be provided to you within a reasonable time period and no later than three months after the initial acknowledgement of your report. This time period applies whether your report was initially made directly to the prescribed person or initially made to another prescribed person or the Protected Disclosures Commissioner.

In duly justified circumstances, the time period for the provision of feedback may be extended to six months, having regard to the nature and complexity of the report. The prescribed person will inform you, in writing, of any decision to extend the feedback period as soon as practicable after the decision is made.

You may request, in writing, that the prescribed person provides further feedback at 3-month intervals until the process of follow-up is completed, and this will be provided as soon as is practicable.

Any feedback provided is in confidence and should not be disclosed to anyone else other than:

• as part of the process of seeking legal advice in relation to your report from a solicitor or a barrister or a trade union official; or
• if required in order to make a further report through this or another reporting channel provided for under the Act.

Feedback will include information on the action taken or envisaged to be taken as follow-up to that report and also the reasons for such follow-up.

Feedback will not include any information:

• that could prejudice the outcome of an investigation or any other action that might follow,
• relating to an identified or identifiable third party.

The requirement to provide feedback does not override any statutory or legal obligations that may apply regarding confidentiality and secrecy.

If the follow-up process determines that no relevant wrongdoing has occurred, you will be informed of this in writing.

If no further action is required, you will be informed of this in writing.

The prescribed person will give you information concerning the final outcome of any investigation triggered by your report, subject to any legal restrictions concerning confidentiality, legal privilege, privacy and data protection or any other legal obligation.

6.      Confidentiality and protection of identity

The Act imposes a legal obligation on the prescribed person and any person they authorise to work on the report, to keep the reporting person’s identity confidential. The Authority will take all reasonable steps to treat disclosures made in accordance with this policy in a confidential and sensitive manner.

All records in relation to the protected disclosure will be securely maintained to comply with the requirements of confidentiality under the Act and with the relevant obligations under data protection legislation.

The Authority keeps a log of all protected disclosures and relevant files (soft and hardcopy) in a restricted and secure environment.

The prescribed person and any authorised person involved in dealing with a report, will not disclose to another person any information that might identify the reporting person except when:

• the reporting person gives their explicit consent, or
• disclosure is a necessary and proportionate obligation imposed by law, or
• the recipient shows that he or she took all reasonable steps to avoid disclosing the identity of the reporting person;
• the Authority has a reasonable belief that disclosing the identity is necessary for the prevention of serious risk to the security of the State, public health, public safety or the environment.

Where disclosure of your identity or information that could identify you is to be made under one or more of these exceptions, you will be notified in writing in advance with reasons for the disclosure, unless such notification would jeopardise:

• the effective investigation of the relevant wrongdoing reported;
• the prevention of serious risk to the security of the State, public health, public safety or the environment; or
• the prevention of crime or the prosecution of a criminal offence.

Circumstances may arise where protection of identity is difficult or impossible – e.g., if the nature of the information you have disclosed means that you are easily identifiable. If this occurs, the risks and potential actions that could be taken to mitigate them will be outlined and discussed with you.

If a reporting person is concerned that their identity is not being protected, they can contact the Pensions Regulator. Their concern will be assessed and investigated, and appropriate action taken where necessary. Excluding the exceptions above a reporting person whose identity has been compromised can take a legal action if the reporting person suffers any loss by reason of such a compromised identity.

7.      Protection from penalisation

The Act provides a range of statutory protections for workers who are penalised for making a protected disclosure.

Penalisation is any direct or indirect act or omission that occurs in a work-related context, which is prompted by the making of a protected disclosure and causes or may cause unjustified detriment to a worker.

Penalisation includes, but is not limited to:

• suspension, layoff or dismissal;
• demotion, loss of opportunity for promotion or withholding promotion;
• transfer of duties, change of location of place of work, reduction in wages or change in working hours;
• the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty);
• coercion, intimidation, harassment or ostracism;
• discrimination, disadvantage or unfair treatment;
• injury, damage or loss;
• threat of reprisal;
• withholding of training;
• a negative performance assessment or employment reference;
• failure to convert a temporary employment contract into a permanent one, where the worker had a legitimate expectation that they would be offered permanent employment;
• failure to renew or early termination of a temporary employment contract;
• harm, including to the worker’s reputation, particularly in social media, or financial loss, including loss of business and loss of income;
• blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
• early termination or cancellation of a contract for goods or services;
• cancellation of a licence or permit; and
• psychiatric or medical referrals.

• that the report is a protected disclosure and is being made under the procedures set out in this policy;

the reporting person’s name, position in the It should be noted that this list is not exhaustive. Any form of penalisation is prohibited and the fact that a type of behaviour or penalisation is not specifically referenced in the Act does not mean that it cannot be penalisation under the Act.

The Act provides that a worker who suffers penalisation as a result of making a protected disclosure can make a claim for redress at either the Workplace Relations Commission or the courts, as appropriate.

A claim concerning penalisation or dismissal must be brought to the Workplace Relations Commission within six months of the date of the instance of penalisation or the date of dismissal to which the claim relates.

A claim for interim relief pending proceedings at the Workplace Relations Commission or the courts must be made to the Circuit Court within 21 days of the last date of penalisation or date of dismissal. 

It is a criminal offence to penalise or threaten penalisation or to cause or permit any other person to penalise or threaten penalisation against any of the following:

• the reporting person;
• a facilitator (a person who assists the reporting person in the reporting process);
• a person connected to the reporting person, who could suffer retaliation in a work-related context, such as a colleague or a relative; or
• an entity the reporting person owns, works for, or is otherwise connected with in a work-related context.

The Authority cannot determine if a report qualifies for protection under the Act nor can it intervene or offer legal advice in any employment dispute or any other dispute concerning allegations of penalisation under the Act. Please refer to section 10 of this document on how to obtain further information and independent, confidential advice in relation to these statutory rights.

8.      Protection from legal liability

In general, the Act provides that no civil legal action can succeed against you for making a protected disclosure. The one exception to this is in relation to defamation.

You can be sued for defamation, but you are entitled to a defence of ‘qualified privilege’. This means that it should be very difficult for a person to win a case against you if you can show you made a protected disclosure in accordance with the Act and did not act maliciously.

There is no other basis under which you can be sued if you have made a protected disclosure in accordance with the Act – e.g., for breach of confidentiality.

If you are prosecuted for disclosing information that is prohibited or restricted, it is a defence to show that, at the time of the alleged offence, you reasonably believed you were making a protected disclosure.

The Act also provides that any provision in any agreement or contract is void insofar as it would:

• prohibit or restrict the making of a protected disclosure;
• exclude or limit any provision of the Act;
• preclude a person from taking any proceedings under or by virtue of the Act; or
• preclude a person from bringing proceedings for breach of contract in respect of anything done in consequence of the making of a protected disclosure.

Bear in mind that, if you make a report that you know is false, it is not a protected disclosure. You could be exposed to legal risks, such as being sued for defamation or breach of confidentiality. You could also face criminal prosecution.

If you are in any doubt as to whether these protections apply to you, you should seek professional advice. Please refer to section 10 of this document on how to obtain further information, and independent, confidential advice in this regard.

9.      Protection of persons concerned

A ‘person concerned’ is a person who is referred to in a report made under the Act as a person to whom the relevant wrongdoing is attributed or with whom that person is associated.

Persons concerned are entitled to protection of their identity for as long as any investigation triggered by the making of a report under this policy is ongoing.

This protection of identity does not preclude the disclosure of said identity where the Authority reasonably considers such disclosure is necessary for the purposes of the Act or where such disclosure is otherwise authorised or required by law.

Persons concerned have the right to take legal action against a person who knowingly makes a false report against them, if they suffer damage as a result of the false report.

10.      Supports and information

Transparency International Ireland operates a free Speak-Up Helpline that offers support and referral advice (which may include referral to legal advice) for workers who have reported or plan to report wrongdoing. The helpline can be contacted by calling 1800 844 866.

For workers who are members of a trade union, many unions offer free legal advice services on employment-related matters, including protected disclosures.

Further information regarding the Act is available from Citizens Information.

Information in relation to making a complaint of penalisation to the WRC is available from the Workplace Relations Commission.

11.      Review of this policy

This policy will be reviewed by the Operations Unit on an annual basis.

Appendix 1 – What to include in a disclosure

It is recommended that reports should contain at least the following information:

• organisation, place of work and confidential contact details;
• the date of the alleged wrongdoing (if known) or the date the alleged wrongdoing commenced or was identified;
• whether or not the alleged wrongdoing is still ongoing;
• whether the alleged wrongdoing has already been disclosed and if so, to whom, when, and what action was taken;
• details in respect of the alleged wrongdoing (what is occurring / has occurred and how) and any supporting information;
• the name of any person(s) allegedly involved in the alleged wrongdoing (if any name is known and the worker considers that naming an individual is necessary to report the wrongdoing disclosed); and
• any other relevant information.

Appendix 2 – Record keeping, data protection and freedom of information

Record keeping

The Authority keeps a log of all protected disclosures and relevant files (soft and hardcopy) in a restricted and secure environment. All records in relation to the protected disclosure (including anonymous reports) are securely maintained to comply with the requirements of confidentiality under the Act and with the relevant obligations under Data Protection legislation.

Where a report is made by email or by post all the documentation will be securely maintained by the Authority.

Where a report is made:

• over the phone directly or by voicemail; or
• via a physical meeting with an authorised employee of the Authority;

the report shall be documented by way of accurate minutes (in writing) of the conversation taken by the person who receives the report. The reporting person shall be afforded the opportunity to check, rectify and agree these minutes.

Data protection

All personal data will be processed in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR).

It is important to note that section 16B of the Act imposes certain restrictions on data subject rights.

Where the exercise of a right under GDPR would require the disclosure of information that might identify the reporting person or persons concerned, or prejudice the effective follow-up of a report, exercise of that right may be restricted.

Rights may also be restricted to the extent, and as long as, necessary to prevent and address attempts to hinder reporting or to impede, frustrate or slow down follow-up, in particular investigations, or attempts to find out the identity of reporting persons or persons concerned.

If a right under GDPR is restricted, the data subject will be given the reasons for the restriction, unless the giving of such reasons would identify the reporting person or persons concerned, or prejudice the effective follow-up of a report, or prejudice the achievement of any important objectives of general public interest as set out in the Act.

A person whose data subject rights are restricted can make a complaint to the Data Protection Commissioner or seek a judicial remedy in respect of the restriction.

The Authority’s Privacy Statement is available on the website.

Freedom of information

The Freedom of Information Act 2014 does not apply to any records relating to disclosures made in accordance with the Act, irrespective of when they were made.