This article is more than 1 year old

This article is more than 1 year old

Australia’s union watchdog accidentally leaked secret emails from a confidential whistleblower in an embarrassing mix-up last year.

Internal documents show the Registered Organisations Commission, which investigates union malfeasance, received a tip-off about the conduct of a “senior official” last year.

The whistleblower, who worked for an unknown union or employee association, had expressly asked the ROC not to contact their organisation, amid fears their identity could be compromised.

But in attempting to send an email to the whistleblower in May, an ROC official mistakenly entered a single wrong character in the email address.

The email – which contained details of the ROC’s conversations with the whistleblower and the identity of the “senior official” – was forwarded to a random recipient with the same surname but a different first initial. The ROC would not say whether the mistaken recipient worked for the same organisation as the whistleblower.

Pharmaceutical companies spent $34m on patient advocacy groups, research finds Read more

Internal emails show how the ROC scrambled to fix its error the next morning. It sent a second email to the address to confirm the account was still active, before pleading with the recipient to delete the previous message.

“You will see a previous email that I have sent in error. Can I urge you to pls. urgently delete it and someone will be in contact with you,” the ROC wrote in an email dated 11 May 2018.

The ROC was then forced to apologise to the whistleblower.

“I am writing to apologise that the ROC appears to have sent an email, intended for you, to another email address (a person apparently based in [redacted]),” an unidentified ROC official wrote. “It seems this was because a difference of one character between the two email addresses.”

It also disclosed its mistake to the Office of the Australian Information Commissioner as a potential privacy breach. The ROC told the information commissioner that the email had contained “employment-related information including allegations about a senior official in the organisation”.

“Steps have already been taken to have the incorrect recipient delete the email, which they confirm that they have done,” the ROC told the information commissioner.

Asked what steps have been taken to prevent a repeat of the incident, the ROC reported that: “Staff will be required to verify the correct each [sic] email address input before an email is sent.”

The internal emails and documents were obtained through freedom-of-information laws and published earlier this month on the Right to Know website, which champions transparency and accountability of government.

It is unclear which union or employer association the case relates to and the ROC has a policy of not publicly discussing protected disclosures.

An ROC spokesman told Guardian Australia the person who mistakenly received the email was an “unrelated addressee” to the whistleblower.

The spokesman said the incident had been referred to the OAIC, and no further action was deemed to be required. The ROC would not say how it was sure the email had been deleted.

Tasmania's FOI regime crippled by 'outrageous' delays, academics say Read more

“The ROC had advised the OAIC of the steps it had taken and the OAIC subsequently advised that it did not require any further action from the ROC,” he said. “The ROC takes the privacy of its stakeholders very seriously, and has a Privacy Policy and Privacy Breach Guide which all staff are required to acknowledge that they have read and understood. The ROC conducts regular and ongoing training to all staff regarding their obligations under the Privacy Act 1988.”

Sally McDow, who became an advocate for whistleblowers after revealing wrongdoing at her past employer, Origin Energy, said enormous damage can be done to whistleblowers if their confidentiality is not respected.

Any act that threatens the anonymity of the whistleblower can cause “career ending impacts”, she said.

That included the “loss of professional reputation, isolation, harassment and in some cases termination”.

“There is a broad spectrum of performance in this area- some Australian organisations are doing a fantastic job of encouraging employees to speak out and managing whistleblower reports with rigour and independence to maximise best outcomes for those reporting issues and the organisation itself,” she said.

“Other organisations are digging their heads in the sand hoping if they keep ignoring the reports and stifling communication channels that the problem will somehow magically disappear.”

The ROC was handed a significant budget boost by the Coalition in last year’s budget. The government said the extra $8.1m would help the ROC investigate whistleblower disclosures, among other things.

The watchdog was handed broad, coercive powers in 2017 allowing it to investigate the internal governance of unions and other registered organisations.

New whistleblower laws are currently before parliament, which will give greater protections to individuals who want to disclose misconduct. The bill includes tougher protections to protect a whistleblower’s identity.