Freedom of Information Regulations 2019

The Regulations rest on three core legal techniques: prescription, incorporation and form‑setting. Each technique is used to bring specified actors and instruments within the administrative and disclosure architecture of the Freedom of Information Act 1982.

Prescription: The Regulations use subordinate legislation to declare particular entities to be "prescribed authorities" (reg 6, Schedule 1), and to designate specific persons and bodies as relevant authorities for referral and investigation purposes (regs 8-9, Schedule 2). The prescriptive function is modal: once an entity appears in a Schedule, particular provisions of the Act attach to it by reference to the definitions in the Act (for example, the definition of "prescribed authority" in s 5(1) of the Act and the mechanisms in s 49O and s 61L referred to by regs 8-9). The list in Schedule 1 includes statutory boards, tribunals, government advisory bodies, certain not‑for‑profit organisations and entities created under other Acts. The Listing therefore changes who is subject to FOI obligations by operation of the subordinate instrument.

Incorporation of offices: Reg 7 prescribes particular offices (Director of Public Prosecutions; Public Advocate; Solicitor‑General) pursuant to s 5(3)(a) of the Act. That means those individual statutory offices are expressly within the Act’s coverage as prescribed persons for purposes that the Act contemplates, rather than left to general interpretation.

Form‑setting: Reg 10 prescribes the form of a confidentiality notice for the purposes of s 61TJ(2)(a) of the Act by making Form 1 in Schedule 3 the prescribed template. Form 1 specifies required content (identification of restricted matters), permitted disclosure channels, mandatory warnings about penalties, duties on recipients to distribute copies of the notice when they make disclosures, expiry and extension rules and a list of attachments the notice must carry (for example ss 61TJ(3)-(7), 61TK and 61TM of the Act). By prescribing a specific form the Regulations standardise the Information Commissioner’s confidentiality notices and set express procedural obligations on recipients.

Cross‑referencing and multi‑act interaction is a further main concept. The confidentiality notice itself refers to other Acts and bodies: the Public Interest Disclosures Act 2012, the Independent Broad‑based Anti‑corruption Commission Act 2011 (IBAC Act), the Integrity Oversight Victoria Act 2011, the Ombudsman Act 1973, the Fair Work Act 2009 (Commonwealth), various investigative entities and the Supreme Court. The Regulations also rely on the Sentencing Act 1991 and the Monetary Units Act 2004 to give legal effect to penalties expressed as penalty units (see endnotes). This places the Regulations in an interlocking legal network that links FOI obligations to investigative, integrity and compensation systems and to sentencing/monetary frameworks.

Concrete operational features created by the Regulations include:

• A standardised confidentiality notice apparatus with behavioural constraints: Form 1 sets out who a recipient may or may not disclose restricted matters to, and requires the recipient to give the same notice to anyone they permit to see the restricted matters (Schedule 3, Form 1).
• A list of named bodies and offices that will be treated as subject to the Act in defined ways (Schedules 1 and 2).
• Sunset and amendment metadata in the endnotes: the Regulations will sunset after 10 years from making, and the document records the subordinate instruments that have altered the Schedules (Endnotes and Table of Amendments).

Those concepts,prescription, standard form, and cross‑act linkage,are the mechanics by which the subordinate instrument allocates duties and constraints to particular public bodies, officeholders and private persons who are included in the Schedules or served with confidentiality notices.

The Regulations directly affect several categories of actors by bringing them into or clarifying their position within the Freedom of Information Act 1982 framework.

1. Bodies listed in Schedule 1 (prescribed authorities) (reg 6). The list includes, among others, tribunals and boards (Disciplinary Appeals Boards; Medical Panels; Mental Health Tribunal), statutory advisory bodies (Victorian Multicultural Commission; Victoria Grants Commission), specific entities created under other Acts (TAFE institutes under s 3.1.11 of the Education and Training Reform Act 2006; Racing Victoria under the Racing Act 1958) and certain not‑for‑profit organisations (Yooralla Society of Victoria; Royal Society for the Prevention of Cruelty to Animals). Those entities are declared to be "prescribed authorities" for the purposes of the Act and therefore fall within whatever duties, request handling obligations and rights the Act attaches to that category. Inclusion is mechanical: reg 6 declares each body specified in Schedule 1 to be a prescribed authority.

2. Offices prescribed under reg 7. The Director of Public Prosecutions, the Public Advocate and the Solicitor‑General are expressly prescribed for the purposes of s 5(3)(a) of the Act. That means the statutory offices (not merely incumbents) are within the Act’s defined categories as the Act contemplates.

3. Persons and bodies in Schedule 2 (regs 8-9). Schedule 2 lists oversight, investigative and integrity bodies and senior officeholders such as the Auditor‑General, the Chief Commissioner of Police, the Health Complaints Commissioner, IBAC, the Ombudsman, the Racing Integrity Commissioner, the Road Safety Camera Commissioner and Integrity Oversight Victoria. Reg 8 prescribes these entities as "relevant authorities" for s 49O(5) of the Act; reg 9 prescribes them for the purposes of s 61L(8). The practical effect is that those bodies are the authorised recipients/referrers in particular procedural contexts created by the Act (for example, referral of complaints or investigations).

4. Persons given confidentiality notices under s 61TJ of the Act by the Information Commissioner. Reg 10 prescribes the form of confidentiality notice (Form 1 in Schedule 3). Anyone who is served with such a notice is affected because the Form carries statutory statements about permitted disclosures, mandatory duties to give the notice to persons to whom disclosures are made, expiry rules and criminal and monetary penalties for unauthorised disclosure (up to 12 months imprisonment and/or 120 penalty units as stated in the Form). The Form specifically warns that failure to comply "may be an offence" and that "penalties including imprisonment may apply" (Schedule 3, Form 1).

5. Third parties who interact with or receive restricted matters. The Form enumerates persons and organisations to whom a restricted matter can be disclosed (examples include spouse/domestic partner; employer/manager; registered health practitioner; trade union; employee assistance programmes; Victorian WorkCover Authority; Fair Work Commission applications) and also lists when the Information Commissioner can prohibit disclosures to the same categories. Individuals who receive restricted matters under a permitted disclosure must be given a copy of the confidentiality notice when the disclosure is made, unless they have a "reasonable excuse". The notice imposes a secondary distribution duty on the first disclosing person.

6. Courts and investigators. The Supreme Court can extend the expiry of a confidentiality notice and the Form contemplates Court orders extending notices and witness summonses from investigative agencies such as IBAC and Integrity Oversight Victoria. Entities that are prescribed in Schedule 2 will be involved where the Act contemplates referrals or cross‑agency investigation.

7. The Information Commissioner and administrative staff. The Information Commissioner is the issuing authority for confidentiality notices and is given the power to authorise or direct disclosures under the Form’s terms and under s 61TJ of the Act. The Commissioner also has the discretion to cancel or replace notices and to consider whether disclosure would "prejudice" an IBAC or Integrity Oversight Victoria investigation, safety or reputation of a person, or a fair trial.

Indirectly affected groups include legal practitioners who advise recipients of confidentiality notices (the Form expressly permits disclosure to a legal practitioner for the purpose of obtaining legal advice or representation), employers who may be listed as permissible disclosure recipients or as expressly prohibited recipients in a given notice, and investigators at IBAC, Integrity Oversight Victoria and Victoria Police who may receive disclosures under the specified circumstances. Bodies newly declared to be prescribed authorities may face administrative and compliance costs as they implement FOI procedures and manage records to satisfy the Act’s requirements.

The endnotes also make a material affective statement: the Regulations will sunset 10 years after making (2 April 2029), which affects long‑term planning for bodies brought into coverage. The Table of Amendments and the notes on style and interpretation (Endnotes) indicate that the instrument is subject to further amendment, which can alter who is affected at later dates; the source shows S.R. No. 155/2019 and S.R. No. 7/2025 as amending instruments. The Regulations therefore create immediate statutory obligations for those listed, but also an environment where further listing changes are possible by subsequent statutory rules.

The Regulations themselves do not create a new regime of substantive rights and duties; rather they allocate and specify which actors are subject to statutory duties, prescribe certain offices and fix the form and associated duties attached to confidentiality notices. The critical duties and rights created or clarified by the Regulations are as follows.

Duties imposed by prescription of authorities (reg 6, Schedule 1)

• Bodies listed in Schedule 1 are declared to be "prescribed authorities" under the Act. That declaration imports the Act’s existing FOI duties on prescribed authorities: to receive and process FOI requests, to make decisions under the Act, to give notices and to comply with statutory timeframes and disclosure obligations as the Act requires. The Regulations do not restate those duties, but they make them applicable by declaration in Schedule 1.

Offices prescribed (reg 7)

• The Director of Public Prosecutions, Public Advocate and Solicitor‑General are prescribed offices under s 5(3)(a) of the Act. The effect is that actions and decisions by those offices fall within the Act’s definitional scope where s 5 contemplates prescribed offices, thus subjecting those offices to whatever Act‑based rights or responsibilities apply to prescribed offices.

Referral and investigation roles (regs 8-9, Schedule 2)

• Entities listed in Schedule 2 are prescribed as "relevant authorities" for s 49O(5) and as prescribed for referral for investigation under s 61L(8). Those statutory cross‑references create duties and rights under the Act’s procedures for complaints, reviews and referrals. For instance, a prescribed relevant authority may receive referrals made under the Act, be the subject of referral to investigate an administration matter, or be authorised to act in particular investigatory pathways the Act outlines.

Form of confidentiality notice and duties on recipients (reg 10, Schedule 3, Form 1)

• Reg 10 prescribes the confidentiality notice form for s 61TJ(2)(a). Form 1 specifies mandatory content and sets explicit duties on a person who receives restricted matters pursuant to a confidentiality notice, including:
  • A duty not to disclose restricted matters other than as permitted under the notice.
  • A duty, when making a permitted disclosure, to give the recipient of the disclosure a copy of the confidentiality notice (and any order extending or cancelling it), unless they have a reasonable excuse (Schedule 3, Form 1). Failure to comply with these duties is subject to criminal and monetary penalties stated in the Form.
  • Obligations to provide certain attachments with the notice (ss 61TJ(3)-(7), 61TK and 61TM) if applicable (Form 1 attaches the statutory provisions and explanations).

Penalties and enforcement (as stated in the Form and endnotes)

• Form 1 warns that unauthorised disclosure may attract "severe penalties, including up to 12 months in prison or a fine of up to 120 penalty units or both." The Regulations themselves refer to penalty units and the Endnotes specify the mechanism for calculating monetary amounts and the current value for the 2024 financial year ($197.59), citing the Sentencing Act 1991 and the Monetary Units Act 2004. The Regulations therefore create enforceable criminal exposure for persons who contravene the terms of a confidentiality notice as authorised under s 61TJ of the Act.

Powers of the Information Commissioner and of courts (Form 1)

• The Information Commissioner decides to issue, cancel, replace or modify confidentiality notices and can authorise or direct disclosure in specific circumstances. The Supreme Court has the power to extend a confidentiality notice by order; the Form contemplates that an extension ordered by the Court will be binding and sets the expiry rules accordingly.

Rights to disclosure in specified circumstances (Form 1)

• The Form lists explicit circumstances in which a person "can" disclose restricted matters notwithstanding the notice, for example to certain named persons, to IBAC if IBAC referred the complaint and has withdrawn it, for making a complaint to IBAC or Integrity Oversight Victoria, for complying with a witness summons from those investigative bodies, to Victoria Police in specific circumstances and to a legal practitioner for legal advice. These are rights, constrained by the requirement to give the recipient a copy of the notice and subject to the caveats the notice contains.

Attachment and information duties (Form 1)

• The Form requires that certain statutory materials be attached (for example, sections 61TJ(3)-(7), 61TK and 61TM of the Act) and moreover invites the recipient to obtain legal advice. The Form also includes a plain language explanation of when the notice will expire. These are procedural duties intended to ensure transparency about the limits on disclosure.

Administrative duties and consequences for prescribed bodies

• By being listed in Schedule 1 or Schedule 2, entities acquire the administrative duties associated with the Act’s FOI procedures. That includes record keeping, responding to requests, cooperating with the Information Commissioner and potentially being the recipient or originator of referrals under ss 49O and 61L. The Regulations do not spell out operational guidance, but the prescription confers the Act’s existing administrative duties onto the listed bodies.

Taken together, the Regulations convert statutory discretion and categories in the parent Act into defined obligations and rights for named actors and create a uniform confidentiality notice form that imposes criminal, monetary and distributional duties on notice recipients while specifying particular circumstances in which disclosure is permitted.

The Regulations themselves are primarily administrative and prescriptive; however the prescribed confidentiality notice in Schedule 3 (Form 1) attaches criminal and monetary consequences to non‑compliance. The enforcement mechanisms and penalty architecture that appear in the source operate through the Act’s confidentiality notice provisions and through the broader penalty unit framework referenced in the endnotes.

Penalties stated in Form 1

• Form 1 contains an explicit warning: unauthorised disclosure of a restricted matter may be an offence with "penalties including imprisonment may apply" and states the maximum exposure of "up to 12 months in prison or a fine of up to 120 penalty units or both" (Schedule 3, Form 1). The Form therefore communicates maximum sanctions for a contravention of the statutory prohibition on disclosure of restricted matters under s 61TJ of the Act as applied by the prescribed form.

Penalty unit calculation and publication

• The Endnotes explain that penalties in the Regulations are expressed in penalty units within the meaning of s 110 of the Sentencing Act 1991 and that the numerical dollar amount is to be calculated in accordance with s 7 of the Monetary Units Act 2004 by multiplying penalty units by the value of a penalty unit in the relevant financial year. The Endnotes give the value of a penalty unit for the financial year commencing 1 July 2024 as $197.59 and state the Treasurer fixes future values by s 5 of the Monetary Units Act 2004, with the value to be published in the Government Gazette and a Victorian newspaper before 1 June in the preceding financial year. Therefore enforcement costs in dollars will vary over time in accordance with the Monetary Units Act and Treasurer determinations.

Enforcement actors and mechanisms

• The instrument prescribes who may be involved in enforcement or follow‑up investigations. The Information Commissioner issues, cancels and replaces confidentiality notices and may authorise or direct disclosure in defined circumstances (Schedule 3, Form 1; see also the references to s 61TJ of the Act). The Form explicitly allows disclosures to investigative bodies (for example IBAC, Integrity Oversight Victoria) and contemplates Victoria Police receiving information where the Information Commissioner has disclosed information to the Chief Commissioner of Police relevant to an investigation. The Supreme Court has a role in extending confidentiality notices by order; the Form provides for extension orders and treats such extensions as operative for expiry rules. Additionally, the Form references other Acts (Public Interest Disclosures Act 2012, IBAC Act, Integrity Oversight Victoria Act 2011) where additional confidentiality or disclosure obligations may apply; enforcement in those contexts may involve different enforcement regimes under those Acts.

Distribution and secondary duties enforceable by sanction

• Form 1 imposes a duty on the person making a permitted disclosure to give the recipient a copy of the confidentiality notice and any subsequent cancellation or extension. Failure to comply with that distribution duty is explicitly subject to the same maximum penalties as unauthorised disclosure (Schedule 3, Form 1). This creates a secondary enforcement perimeter: not only is unauthorised disclosure penalised, but failure to provide the notice to permitted recipients can attract criminal or monetary sanction.

Procedural constraints that affect enforcement

• The Form lists specified circumstances in which disclosure is permitted and lists multiple exceptions and authorisations (for example disclosure authorised by the FOI Act, disclosure for complying with a witness summons, disclosure authorised by the Information Commissioner). The presence of these enumerated exceptions constrains enforcement because conduct falling within an exception will not be an offence under the confidentiality notice provisions. Conversely, the Form’s list sets out the evidentiary pathways that an enforcement body will consider when deciding whether a disclosure was impermissible.

Limitations and operational notes from the source

• The Regulations themselves do not set a schedule of prosecutions or an enforcement protocol. They prescribe the form that gives notice of the statutory prohibition and content of permitted disclosures. The endnotes show the Regulations will sunset on 2 April 2029, but do not provide enforcement data. The criminal exposure stated in Form 1 is therefore enforced under the Act and general criminal procedures, with monetary amounts calculated using the Monetary Units Act.

In sum, the enforcement architecture presented in the Regulations operates through the standardisation of the confidentiality notice (Form 1) together with the Act’s enforcement powers and the penalty unit framework referenced in the Endnotes. Persons who receive a confidentiality notice face potential criminal and monetary penalties for unauthorised disclosure and face duties to distribute the notice to permitted recipients and to keep informed about any cancellation or extension; the Information Commissioner, investigative agencies and the Supreme Court are the primary decision‑makers referenced in the enforcement pathway.

The Regulations are an instrument made under the Freedom of Information Act 1982 and deliberately cross‑link to multiple other statutes and institutional regimes. The source document itself records numerous statutory cross‑references and attachments that make the inter‑act relationships explicit. Key interactions include the following.

Primary interaction: Freedom of Information Act 1982

• The Regulations are made under s 66 of the Act (reg 2) and repeatedly reference sections of the Act, most notably s 5 (definitions), s 49O(5), s 61L(8) and s 61TJ(2)(a) (regs 6-10). Schedules 1 and 2 operate by reference to the Act’s statutory definitions and procedural provisions. The confidentiality notice form (Schedule 3, Form 1) operates under s 61TJ of the Act and requires attachment of sections 61TJ(3)-(7), 61TK and 61TM as part of the explanatory material accompanying a notice.

Cross‑references to integrity and investigatory Acts

• The Form explicitly references the Independent Broad‑based Anti‑corruption Commission Act 2011 (IBAC Act), the Integrity Oversight Victoria Act 2011 and the Ombudsman Act 1973; it identifies IBAC and Integrity Oversight Victoria as bodies whose investigations may be prejudiced by disclosure and as organisations to which disclosures may be permitted or necessary. The Form also contemplates disclosure to Victoria Police when the Information Commissioner has disclosed information to the Chief Commissioner of Police and the restricted matter is relevant to a police investigation. Thus the confidentiality notice mechanism intersects with integrity and criminal investigatory frameworks and can operate as a gatekeeper coordinating information flows among those systems.

Interaction with Public Interest Disclosures Act 2012

• The Form warns notice recipients that additional obligations under sections 52 and 53 of the Public Interest Disclosures Act 2012 relating to confidentiality of assessable disclosures and people who make assessable disclosures may apply. This explicitly connects the confidentiality notice obligations with the statutory protections and confidentiality rules that apply to whistleblowers or assessable disclosures under the Public Interest Disclosures Act.

Attachment of specified statutory provisions

• Form 1 requires attachment of s 61TJ(3)-(7), s 61TK and s 61TM of the Freedom of Information Act 1982 and an "explanation of the effect of those provisions" to be part of the notice. This creates a direct procedural interface between the prescribed form and the underlying statutory text.

Reference to Fair Work Act 2009 (Commonwealth)

• The Form notes a permitted disclosure channel is "for the purpose of an application to the Fair Work Commission, including any related proceeding." This creates an interaction between state confidentiality notices and federal industrial dispute processes, where disclosure to pursue workplace remedies is contemplated as an exception to the confidentiality restriction.

Penalty framework interaction: Sentencing Act 1991 and Monetary Units Act 2004

• The Endnotes instruct that penalties in the Regulations are to be calculated in penalty units under s 110 of the Sentencing Act 1991 and translated to dollar amounts by s 7 of the Monetary Units Act 2004. The value of a penalty unit is set by the Treasurer under s 5 of the Monetary Units Act and must be published. Thus monetary enforcement interacts with the state sentencing and treasury regimes.

Interaction with other Acts creating listed entities

• Schedule 1 and Schedule 2 include entities created under other statutes. For example, TAFE institutes under s 3.1.11 of the Education and Training Reform Act 2006 and Racing Victoria within the meaning of the Racing Act 1958 are specifically named. Inclusion means that the statutory regime of the FOI Act applies to entities formed under different statutory regimes, and those entities must integrate FOI duties with their other statutory functions.

Judicial interaction

• The Form contemplates the Supreme Court's power to extend a confidentiality notice. That creates a judicial interface where court orders can prolong the legal effect of a notice beyond the administrative expiry events the Information Commissioner controls. The Form also contemplates compliance with a witness summons served by IBAC or Integrity Oversight Victoria; such subpoenas are instruments of other Acts and their enforcement mechanisms interact with the confidentiality continuum.

Operational and administrative interactions

• By prescribing Form 1 and listing bodies, the Regulations impose obligations that may trigger compliance, record‑keeping, evidence‑preservation and disclosure practices that intersect with common law duties, employment law obligations, investigative powers under other Acts, and administrative law standards for procedural fairness and decision‑making. The Regulations do not subsume those other obligations but require actors to navigate them in parallel.

In short, the Regulations are an integrating instrument that places selected entities and offices within the FOI architecture and aligns the confidentiality notice apparatus with the operational realities of integrity agencies, criminal investigators, employment tribunals and the state penalty system. The instrument therefore creates cross‑act coordination points and explicit avenues for disclosure and referral among state and federal regimes.

The Regulations include amendment notations and an explicit Table of Amendments in the Endnotes. The source document records the original making date and subsequent statutory rules that amended the instrument. The amendment history in the document is as follows.

Original making and commencement

• The Freedom of Information Regulations 2019 (S.R. No. 25/2019) were made on 2 April 2019 by the Governor in Council under s 66 of the Freedom of Information Act 1982 and came into operation on 5 April 2019 (Endnotes, General information; reg 3).

Revocations of previous instruments

• Reg 4 revokes the Freedom of Information Regulations 2009 and three further amending instruments: the Freedom of Information Amendment Regulations 2012, the Freedom of Information Further Amendment Regulations 2012, and the Freedom of Information Amendment Regulations 2015. The Endnotes confirm the identification of those instruments (see reg 4 and Endnotes 3, Explanatory details).

Subsequent amendments recorded in the Table of Amendments

• Freedom of Information Amendment Regulations 2019, S.R. No. 155/2019:

  • Date of making: 17 December 2019
  • Date of commencement: 31 December 2019 (Endnotes, Table of Amendments).
  • The amending instrument inserted Reg 10 and Schedule 3, and made other changes as indicated in the marginal notes: Sch. 3 was inserted by S.R. No. 155/2019 reg 7 and Reg 10 was inserted by that amending rule (see marginal notes accompanying regs 9-10 and Sch. 3).

• Freedom of Information Amendment Regulations 2025, S.R. No. 7/2025:

  • Date of making: 25 March 2025
  • Date of commencement: 25 March 2025 (Endnotes, Table of Amendments).
  • The marginal notes show that Sch. 2 was amended by S.R. No. 7/2025 reg 4 and Sch. 3 Form 1 was amended by S.R. No. 7/2025 reg 5.

Marginal annotations in Schedules

• Schedule 1 and Schedule 2 include marginal notes indicating later amendments (for example, "Sch. 2 amended by S.R. No. 7/2025 reg. 4."). Schedule 3 is annotated as inserted by S.R. No. 155/2019 reg 7 and Form 1 is noted as amended by S.R. No. 7/2025 reg 5. These annotations form part of the statutory record and indicate that the contents of the Schedules have changed since the original instrument.

Sunset and interpretative style changes

• The Endnotes note that the Regulations will sunset 10 years after making (2 April 2029) pursuant to the Subordinate Legislation Act 1994. The Endnotes also explain the application of the Interpretation of Legislation Act 1984 to style changes and headings; these are interpretative amendments rather than operative changes and form part of the instrument’s historical record.

Practical import of the amendment history

• The amendment history shows the instrument is subject to iterative change by later statutory rules. For practitioners this means that the lists in Schedules 1 and 2 and the content of Form 1 may vary over time. The marginal notes identify which rules effected the changes; to determine the current operative content one must read the consolidated version (this document purports to be a version incorporating amendments as at 25 March 2025). The Endnotes and Table of Amendments therefore provide the chain of custody for each change and indicate the legal provenance of each insertion or amendment.

The Regulations therefore present a compact but explicit amendment record: made April 2019, amended at least by S.R. No. 155/2019 (2019) and S.R. No. 7/2025 (2025), with a sunset date under the Subordinate Legislation Act 1994. The marginal notes and endnotes are part of the statutory record and should be checked to confirm the operative text for any specified date.

The source document (the Freedom of Information Regulations 2019 as provided) does not record or cite any litigation, cases or judicial decisions. The Regulations include statutory cross‑references and mention the Supreme Court’s power to extend confidentiality notices, but the instrument itself contains no report of judicial consideration or case law. The Explanatory details and Endnotes provide interpretative and procedural material, amendment records and references to penalty unit calculation, but do not include any case citations.

As a consequence, within the scope of this source there is no litigation history to summarise. The following observations flow directly from the text:

• No judicial decisions are named or relied upon in the Regulations or in the Endnotes.
• The Form contemplates judicial action (the Supreme Court may extend a confidentiality notice), but the Regulations do not include examples of how courts have exercised that power.
• The Endnotes and Table of Amendments record only subordinate instruments and interpretative provisions; they do not record any judicial challenge, review or decision responding to the Regulations.

For practitioners seeking to understand how the confidentiality notice provisions or the prescription of particular bodies have been applied or interpreted, the source indicates that any such analysis must come from external case law and decisions under the Freedom of Information Act 1982, IBAC decisions, Supreme Court orders extending notices, or other judicial authorities. Those materials are not included in the Regulations text provided and therefore cannot be summarised here. The absence of litigation history in the source does not establish that there is none; it merely records that no litigation or judicial material is printed in this instrument. Users requiring litigation precedent or case interpretation will need to consult court databases, tribunal decisions, the Information Commissioner’s published determinations and the decisions of the other bodies listed in Schedule 2.

The Regulations are short, but they contain several practical traps and procedural details that can produce compliance risk if not handled precisely. The following are concrete "gotchas" grounded in the source text.

1. Inclusion in Schedule 1 and the breadth of the category "prescribed authority" (reg 6, Schedule 1)

• Being named in Schedule 1 immediately makes an entity a "prescribed authority" for the purposes of the Freedom of Information Act 1982. That carries operational obligations (processing FOI requests; decision‑making under the Act) even though the Regulations do not elaborate the operational steps. Organisations that are not obvious public sector agencies (for example not‑for‑profit bodies like the Yooralla Society of Victoria or the Royal Society for the Prevention of Cruelty to Animals) are included; such bodies may be surprised by the administrative and legal obligations the Act imposes once listed. The gotcha is failure to recognise that a statutory listing will import FOI duties overnight.

2. Form 1 is prescriptive and contains both permissive and prohibitive entries that must be carefully completed (reg 10, Schedule 3, Form 1)

• Form 1 is a template that includes sections where the Information Commissioner or the drafter will tick or cross items to indicate permitted or prohibited disclosure recipients (Form 1 uses checkmarks and crosses in example lines). The template requires precision: inconsistent or ambiguous completion (for example ticking "spouse" in one place and crossing "your spouse" in the directional section) could create operational confusion about whether a disclosure is permitted and therefore whether a recipient is in breach. The Form also requires attaching ss 61TJ(3)-(7), 61TK and 61TM and an "explanation of the effect of those provisions." Failure to attach the specified materials may contravene the form prescription or lead to inadequate notice to recipients.

3. Secondary distribution duty and exposure to penalties (Schedule 3, Form 1)

• Form 1 requires a person who makes a permitted disclosure to give the recipient a copy of the confidentiality notice and any order extending or cancelling it, unless they have a reasonable excuse. If the first discloser neglects to provide the notice (for example, in an ad hoc verbal disclosure to a legal adviser or to a union delegate) they can face the same maximum penalties as for unauthorised disclosure. The practical risk is that those making permitted disclosures (employees, managers, union reps) need systems to ensure the notice accompanies each disclosure. The gotcha is that lack of administrative control over distribution can convert a permitted disclosure into a penalised failure.

4. Penalty amounts vary with penalty unit values (Endnotes)

• The Form states a maximum fine in penalty units (120 penalty units). The Endnotes explain that the dollar equivalent is set by the Monetary Units Act and the Treasurer’s determinations and give a specific value for 2024 ($197.59). Practitioners must therefore calculate exposure in dollars for the applicable financial year. The gotcha is failing to update the monetary conversion, resulting in misstatements of financial exposure.

5. Overlap with other statutory confidentiality regimes (Form 1 references)

• The Form explicitly notes additional obligations under the Public Interest Disclosures Act 2012 and lists numerous bodies with investigative or reporting functions (IBAC, Integrity Oversight Victoria, Ombudsman, Judicial Commission, Racing Integrity Commissioner, Chief Municipal Inspector, Parliamentary Workplace Standards and Integrity Commission). Recipients need to evaluate multiple, potentially overlapping statutory rules about confidentiality and disclosure. The gotcha is assuming the confidentiality notice is the sole source of restriction; there may be independent obligations or triggers (for example protected whistleblower disclosure rules).

6. Expiry and extension rules are event‑based and may not be automatic (Form 1)

• The notice expires upon specific events, such as cancellation by the Information Commissioner or the conclusion of the investigation unless the Supreme Court has ordered an extension. Practically this means that a notice can remain in force beyond the conclusion of an investigation if a court orders an extension. The gotcha for a recipient is failing to check whether a notice has been cancelled or extended and continuing to share or withhold information incorrectly.

7. The Form allows for both permissive and prohibitive directions to the same classes of persons

• The template shows that for a given restricted matter the Information Commissioner may tick "You can disclose this restricted matter" for certain categories and, elsewhere in the template, direct that "The Information Commissioner has directed that you cannot disclose this restricted matter" for those same or other categories. Careless completion risks issuing conflicting instructions. The gotcha is ambiguous drafting of the template when it is completed.

8. Variation by subsequent statutory rules

• The Schedules have been amended by later statutory rules (S.R. No. 155/2019; S.R. No. 7/2025). Practitioners must read the consolidated instrument and not rely on older versions. The gotcha is working from an outdated list and missing that a body has been added or removed from a Schedule.

9. Non‑publication of enforcement practice in the instrument

• The Regulations do not include enforcement guidelines or examples of past enforcement. The practical implication is that parties must infer enforcement likelihood and thresholds from the parent Act and other enforcement authorities (Information Commissioner, criminal courts). The gotcha is uncertainty about prosecutorial discretion and evidentiary thresholds.

10. Attachment requirements for legal advice

• The Form permits disclosure to a legal practitioner for advice, but a legal practitioner who receives a restricted matter may have independent professional obligations (for example, legal professional privilege or duties of disclosure). The gotcha is failing to coordinate the confidentiality notice obligations with professional ethical duties.

Each of these gotchas follows from reading the text of the Regulations and Form 1. They indicate areas where procedural failure, ambiguous completion of the template, or failure to monitor changes in the instrument or in penalty unit values can produce legal exposure or compliance failures.

The Regulations create a small but specific compliance landscape: bodies listed in Schedule 1 must operate as prescribed authorities under the Freedom of Information Act 1982; specified offices in reg 7 and bodies in Schedule 2 must be prepared to act as relevant authorities; and anyone served with a confidentiality notice in Form 1 must observe the notice’s terms and distribution obligations. The following action checklist is grounded in the text of the Regulations and focuses on concrete steps organisations and individuals should take.

For bodies newly listed in Schedule 1 (reg 6, Schedule 1)

1. Confirm listing and effective date. Check the consolidated Regulations to confirm the body’s inclusion and the operative date, noting the consolidated instrument incorporates S.R. No. 155/2019 and S.R. No. 7/2025 where applicable.
2. Inventory FOI obligations. Treat the entity as a "prescribed authority" under the Freedom of Information Act 1982 and map existing procedures to the Act’s requirements (records management, response timeframes, internal review processes). The Regulations do not set the operational detail, but inclusion triggers statutory duties.
3. Designate an FOI contact officer. Allocate or recruit an FOI decision maker and a records officer and ensure staff know the contact point for FOI requests.
4. Implement or update FOI processing systems. Put in place request intake, acknowledgement, processing, refusal and review templates that comply with the Act’s procedural timelines and decision content requirements.
5. Train staff. Provide targeted training for employees handling personal or restricted information so they understand when to escalate to the FOI contact and how to handle confidentiality notices.

For entities in Schedule 2 and prescribed offices (regs 7-9, Schedule 2)

1. Identify referral and investigatory obligations. Understand the practical implications of being prescribed for s 49O(5) and s 61L(8) purposes. Clarify internal processes for receiving referrals and for interacting with the Information Commissioner.
2. Coordinate with other agencies. Establish contact protocols with the Information Commissioner, IBAC, Integrity Oversight Victoria, and Victoria Police where relevant, and clarify witness summons handling procedures.

For persons served with a confidentiality notice (reg 10, Schedule 3, Form 1)

1. Read and verify the notice carefully. Confirm the restricted matters are correctly specified, and check the sections of the Act attached to the notice (Form 1 requires attachment of ss 61TJ(3)-(7), 61TK and 61TM). If the statutory attachments are absent, request them before making any disclosures.
2. Check permitted disclosure list. Note precisely who the notice permits disclosure to and whether the Information Commissioner has directed any prohibitions. If there is ambiguity, seek the Commissioner’s clarification in writing.
3. If making a permitted disclosure, provide a copy of the notice (and any cancellation or extension) to the recipient. The notice imposes a mandatory duty to give the notice to any person you disclose to unless you have a reasonable excuse. Document compliance by keeping dated copies of the notice given to each recipient.
4. Obtain legal advice where necessary. The Form expressly permits disclosure to legal practitioners for advice. If facing complex questions (for example, overlapping confidentiality obligations under the Public Interest Disclosures Act 2012), secure legal advice and document it.
5. Maintain an access and disclosure log. Keep an auditable record of who accessed restricted matters, who received copies of the notice and rationale for each permitted disclosure. This record will be essential if enforcement or review occurs.

Administrative compliance steps for all affected bodies and persons

1. Update policies and staff procedures. Incorporate Form 1 obligations, FOI request procedures and record‑keeping duties into organisational policies. Provide checklists for staff who might receive confidentiality notices.
2. Monitor statutory changes and penalty units. Keep the Monetary Units Act and Treasurer’s Gazette notices under review so that monetary exposure is correctly calculated (Endnotes explain the calculation method and give a 2024 figure).
3. Review interactions with other regimes. Map where the confidentiality notice overlaps with the Public Interest Disclosures Act, IBAC procedures, Integrity Oversight Victoria processes, employment law and the Fair Work Commission. Adopt decision trees for staff to follow when disclosure or referral is contemplated.
4. Establish escalation procedures. Create a clear escalation pathway to the Information Commissioner or legal counsel if the organisation receives a confidentiality notice or a witness summons.
5. Prepare for court orders extending notices. Recognise that the Supreme Court can extend a confidentiality notice and that extension will alter expiry rules. If a notice may be extended, establish a process for checking the Court's orders and updating internal access permissions accordingly.
6. Ensure the notice is correctly completed. If your organisation is the issuing authority (for example, the Information Commissioner’s office), ensure the Form 1 template is filled without internal contradiction between "can" and "cannot" disclosure boxes. If you use the template in internal communications, ensure consistent selection and clear language.

Recordkeeping and audit

• Ensure that copies of confidentiality notices and all related correspondence are retained in a secure, indexed file. The Form’s distribution rule and the potential for criminal exposure make an auditable trail essential. This includes copies of any cancellation, replacement or extension notices and any related witness summonses or court orders.

Testing and scenario exercises

• Run tabletop scenarios among legal, HR and records staff that cover examples of permitted disclosure (to a legal practitioner, to IBAC, to a trade union) and examples of impermissible disclosure (social media, disclosure to a spouse where prohibited). Use these exercises to test the distribution and logging procedures required by Form 1.

Engage with the Information Commissioner proactively

• Where the scope of restricted matters or permitted recipients is uncertain, seek clarifying direction from the Information Commissioner before making disclosures. The Form contemplates that the Information Commissioner can direct or authorise disclosure in particular circumstances.

By following the checklist above, entities and persons affected by the Regulations can create processes that align with the prescriptive instrument. The Regulations are short and procedural; compliance therefore depends on translating the prescriptions (Schedule listings and Form 1 content) into operational procedures and ensuring those procedures are followed consistently and auditable.