Report on risks to confidential control in the public sector
The report concerns the investigation of a former senior officer at the Department of Finance, Western Australia, who downloaded confidential information from a computer system before leaving to take up a role in the private sector.
The investigation identified serious misconduct risks in relation to the policies and procedures at the Department of Finance aimed at protecting confidential information, and the Department’s use of USBs, which may be applicable to other departments and agencies. It highlights the significant misconduct risks in having weak and insufficient information controls.
The Commission considered that the wording of Finance's confidentiality agreement and the lack of any reminders about post-employment confidentiality obligations as serious misconduct risks. It made two recommendations which were accepted by Finance. These are steps the Commission encourages all public sector organisations to take.
Recommendations
- Finance review and enhance its confidentiality agreement to make it abundantly clear that employees are required to maintain confidentiality and abide by the non-disclosure requirements.
- Finance consider implementing a procedure by which departing staff are reminded of their obligation not to disclose any confidential information once they leave.
