The Act’s primary beneficiaries are “participants”—witnesses included in the program on a temporary or permanent basis (s 3(1)). The definition of “witness” in s 4 is deliberately broad: it covers Crown witnesses in criminal proceedings or serious crime prevention order applications, persons who have given evidence or statements about offences against any Australian law, and anyone who “for any other reason” may require protection. Associates of such persons are also covered (s 4(2)). “Former participants” are brought within the Act’s secrecy and identity-restoration rules by the 2024 amendments (s 13A and s 24(6)).

The Commissioner of Police is the central decision-maker and duty-bearer. Functions may be delegated only to members in “designated positions” (s 39). “Approved authorities” (federal and interstate police commissioners, ACC, NSW Crime Commission, and other declared investigative bodies) may request inclusion of witnesses and enter cost-sharing arrangements (ss 6(1), 36). “Designated authorities” under complementary witness protection laws may themselves apply for Supreme Court orders (s 15(3)(b)).

Agencies as newly defined in s 4A (government sector agencies, statutory bodies, State-owned corporations, local councils, courts, tribunals, and prescribed private bodies) are subject to duties concerning identity records (s 15(1)(b)), secure document handling (s 38A), and the legal-personality rule in s 4B that channels statutory functions to the “head” of the agency.

Protected persons who become involved in “relevant proceedings” (Part 3A and 3B) owe notification duties (s 31B(1A)) and are entitled to non-disclosure certificates and audio-visual evidence. The Registrar of Births, Deaths and Marriages must give access to registers and implement court-ordered changes (s 18(1)(b)) but may cancel entries only on further court order (s 19(2)).

Courts, tribunals, Royal Commissions and the Law Enforcement Conduct Commission must apply the closed-hearing, suppression and non-disclosure certificate rules (ss 16, 26, 31D, 31E). The Commission itself determines appeals against exclusion or termination decisions (ss 6(4), 12(5)).

Participants’ family members, spouses, legal representatives and service providers are indirectly affected through MOU obligations concerning family maintenance, marriage and confidentiality. Offenders or litigants seeking to enforce pre-existing debts against a participant may find the Commissioner interposed (ss 29, 30).

The Commissioner’s key duties include assessing suitability (s 7), ensuring MOUs contain mandatory warnings (s 8(3)), notifying participants of termination or suspension decisions (s 12(1)), maintaining records of original identities (s 18(1)(c)), and preserving removed identity records when requested (s 19B(3)). The Commissioner must also take reasonable steps to deal with a participant’s pre-existing legal obligations (s 29(1)).

Participants have the right to refuse inclusion, to appeal exclusion within 3 days to the Commission (s 6(4)), to seek internal review and Commission appeal of termination or suspension decisions (s 12), and to complain to the Commission about police conduct (s 8(3)). Once included, they have a right to protection measures the Commissioner considers necessary and reasonable (s 5(1)), an entitlement to give evidence by audio visual link (s 31G(1)), and protection from disclosure of their protected identity in proceedings unless the court grants leave under s 31E after a high-threshold test.

Protected persons must comply with MOU terms (s 8(1)(b)), notify the Commissioner of involvement in relevant proceedings (s 31B(1A)), and return identity documents on restoration of previous identity (s 21(5)). They are prohibited from marrying without satisfying identity and marital-status evidence requirements (s 20) and from using old register-based documents while new entries remain (s 22).

Agencies and interstate entities must respond to court orders or Commissioner requests to remove or replace identity records (ss 15, 19A) and keep confidential documents secure (s 38A). The Registrar of Births, Deaths and Marriages has a statutory duty to assist authorised persons and implement court orders (s 18(1)(b)).

The Supreme Court’s rights and duties are prescriptive: it must conduct closed hearings (s 16), may make witness protection orders only on satisfaction of the s 17 criteria, and may grant leave to disclose protected identity only where credibility is genuinely in issue, it is in the interests of justice, and testing credibility would otherwise be impractical (s 31E(4)).

The Act creates a tiered penalty regime. The most serious offence is unauthorised disclosure of a participant’s identity or location (s 32), punishable on indictment by 10 years imprisonment. The same maximum applies to unauthorised recording or disclosure of information about register entries (s 23(1)). Participants who disclose their own status or program information face 5 years imprisonment (s 33(1)), although a 2024 amendment introduced a health-or-safety reasonable-excuse defence with reverse onus (s 33(1A)–(1B)).

Lower-level offences include marrying without satisfying s 20 requirements (5 penalty units or 6 months), using old register-based documents (s 22, 10 penalty units), failing to return identity documents on restoration (s 21(5), 10 penalty units), and failing to notify the Commissioner of involvement in a relevant proceeding (s 31B(1A), 50 penalty units). Breaching a suppression order made after leave is granted under s 31E(6) carries 50 penalty units or 12 months imprisonment or both (s 31E(7)).

Enforcement is primarily criminal. Proceedings for all offences except s 32 are summary (s 41(1)); s 32 is dealt with under Chapter 5 of the Criminal Procedure Act 1986 (election for indictment). The Commissioner may also terminate or suspend protection for MOU breaches (s 11(2)(a)), and may inform creditors of a participant’s previous identity where the new identity is being used to avoid obligations (s 30(3)).

Civil immunity is conferred by s 40 on anyone acting in good faith in the exercise of functions under the Act, including Supreme Court orders. The Act does not create private rights of action; protection is administrative and prosecutorial.

The Act is designed to operate alongside complementary witness protection laws declared by the Minister (s 3(1)). Arrangements with approved authorities under such laws are expressly authorised (s 36), and designated authorities under those laws may apply for NSW Supreme Court orders (s 15(3)(b)). Section 24(4) gives participants the benefit of non-disclosure permissions granted under complementary laws.

Heavy interaction occurs with the Births, Deaths and Marriages Registration Act 1995. Sections 18 and 19 treat court-ordered entries as valid for all purposes, but exclude the operation of Divisions 4 and 5 of Part 3, Part 5 and s 59(2) of that Act (s 43). The Registrar is under a positive duty to assist (s 18(1)(b)) yet can cancel entries only on further court order (s 19(2)).

The Law Enforcement Conduct Commission Act 2016 is woven throughout. The Commission hears appeals against exclusion and termination decisions (ss 6(4), 12(5)) and is one of the protected recipients of communications monitoring (s 9A(2)(b)). Investigations by the Commission or its Inspector are express exceptions to the non-disclosure offences in ss 23, 32 and 33.

Part 3A and 3B intersect with the Coroners Act 2009, Crime Commission Act 2012, Royal Commissions Act 1923 and Special Commissions of Inquiry Act 1983 by including their proceedings within “relevant proceedings” that trigger non-disclosure certificates and AVL entitlements.

The Privacy and Personal Information Protection Act 1998 principles are imported into the new secure-handling obligation in s 38A. The Confiscation of Proceeds of Crime Act 1989 is disapplied to amounts certified by the Commissioner as program payments (s 31(2)).

The Act expressly preserves other witness-protection provisions in the Crime Commission Act 2012 s 44, the (repealed) Independent Commission Against Corruption Act 1988 s 50, and certain royal commission statutes (s 44).

The most significant recent changes are contained in the Justice Legislation Amendment Act 2024 No 89, which inserted or amended more than 30 provisions. The stated driver was to modernise identity management in an era of digital records and inter-jurisdictional information sharing.

Key insertions include:

• Definitions of “agency” (s 4A) and the legal-personality rule (s 4B) to ensure functions can be performed by non-human entities.
• Expanded assessment criteria and MOU contents to include communication monitoring (ss 7, 8(2)(c2), new s 9A). The monitoring power is limited to non-privileged communications and recordings cannot be used against third parties.
• Detailed rules for removal, replacement and retention of identity records held by agencies and interstate entities (new ss 19A, 19B, amendments to ss 14, 15, 17, 18, 19, 21, 23, 24, 28, 30, 38).
• New secure-handling obligation for agencies (s 38A).
• Updated non-disclosure certificate content to reference the AVL entitlement (s 31C(1)(d)).
• Clarification that the health-and-safety reasonable excuse applies to participant non-disclosure offences (s 33(1A)–(1B)).
• Amendment to the transitional provision for former NSW Police Witness Protection Plan participants (s 45).

These changes respond to practical difficulties revealed by operational experience: linkage risks in digital databases, the need for interstate cooperation, the Commissioner’s inability to retain records without a statutory hook, and the tension between participant privacy and agency record-keeping obligations. The 2019 insertion of Part 3B (via the Justice Legislation Amendment Act 2019 No 20) was a response to the practical difficulty of protecting witnesses who must give evidence in an era of increased remote-hearing technology.

Although the Act itself has not generated a large body of reported case law, the principles it embodies have been tested in several contexts. The Supreme Court’s power to make witness protection orders under s 17 is conditioned on satisfaction of cumulative jurisdictional facts; a 2002 amendment tightened the criteria to require an MOU and likely compliance, reflecting concern that orders had been sought in marginal cases.

The non-disclosure certificate regime in Part 3A has been the subject of procedural disputes. Courts have emphasised that the certificate does not create an absolute shield; s 31E requires a structured leave process once credibility is genuinely put in issue. In practice, trial judges have been reluctant to grant leave where the protected person is a peripheral witness, citing the statutory presumption in favour of non-disclosure.

Controversy has surrounded the balance between witness safety and an accused’s right to a fair trial. Defence counsel have argued that the inability to probe a protected witness’s true identity impairs cross-examination on credibility. The statutory response in s 31E(4) (requiring evidence that, if believed, would call credibility into question, that it is in the interests of justice, and that testing would otherwise be impractical) reflects a legislative judgment that mere speculation is insufficient. No reported decision has yet struck down the regime on constitutional grounds, but the issue remains live in high-stakes organised-crime trials.

The 2024 amendments allowing monitoring of participant communications (s 9A) have attracted criticism from civil-liberties groups on privacy grounds. The statute counters this by excluding privileged communications, prohibiting use of material against third parties, and preserving the general prohibition on interception of telecommunications (s 9A(4)).

Administrative-law challenges to Commissioner decisions to terminate protection have been channelled through the statutory review and Commission appeal mechanisms. The Commission’s power to “make any decision that could have been made by the Commissioner” (ss 6(4), 12(5)) has been interpreted as conferring a full merits review, reducing the scope for judicial review.

Most practitioners do not realise that a participant’s MOU can lawfully authorise ongoing monitoring of communications with anyone except lawyers, Commission staff, the Inspector or police misconduct investigators (s 9A(2)). A recording lawfully obtained under the MOU cannot be used in proceedings against any person other than the participant, but the participant themselves may face termination for breach.

Another trap is the interaction between s 19(2) and s 21. Once an entry is made in a register, it can be cancelled only by Supreme Court order after the Court is satisfied the person is no longer in the program. The Commissioner’s discretionary decision to restore a former participant’s previous identity (s 21(1)) does not automatically cancel the register entry; a separate application under s 19(1A) is required. Failure to obtain that order leaves the former participant with two conflicting official identities.

The reverse onus in the new s 33(1B) is easily overlooked. A participant who discloses their status on social media claiming a mental-health crisis bears the legal burden of proving both the reasonable excuse and that it relates to a health or safety risk.

Section 31B(2A) permits the Commissioner to give a non-disclosure certificate to the court before proceedings commence and in the absence of the parties. Many judges are unaware of this power and insist on an inter partes hearing, which itself risks compromise of the protected identity.

Finally, the immunity in s 40 is broader than many realise. It covers “an act done or omitted to be done … in good faith in the exercise or purported exercise of a function”. The phrase “purported exercise” has been held in analogous contexts to protect even ultra vires acts provided good faith is present. However, deliberate fabrication of identity documents beyond what is authorised by a court order would likely fall outside the protection.

For the Commissioner and NSW Police Force, compliance begins with a robust assessment process that documents each of the s 7 factors and records why viable alternatives were rejected. Every MOU must contain the mandatory elements in s 8(1) and (3) and should be signed only in the presence of a designated-position officer (s 8(4)). Decisions to terminate or suspend must be notified in accordance with s 12(1), and the layered review rights must be scrupulously observed; failure to give the participant a reasonable opportunity to state their case invalidates the internal review (s 12(3)(b)).

When applying for a witness protection order, evidence must be led on each of the five s 17 matters. For removal of an identity record, specific evidence of linkage risk is now required (s 17(e)). The Commissioner must maintain records of original identities (s 18(1)(c)) and must retain removed records if an authorised person or interstate entity so requests (s 19B(3)).

Agencies suddenly finding themselves in possession of a confidential document must immediately implement secure storage and handling practices that satisfy both Privacy and Personal Information Protection Act 1998 s 12 principles and any regulatory requirements (s 38A). Interstate entities receiving a s 19A request should treat it as a formal statutory requirement rather than a discretionary favour.

Legal practitioners appearing in matters where a non-disclosure certificate has been or may be issued must understand that questions going to protected identity or current location are prima facie prohibited (s 31D). Any application for leave under s 31E must be supported by concrete evidence that, if accepted, would impeach credibility; fishing expeditions will fail. Where leave is granted, practitioners must comply with the court’s suppression orders or face personal liability under s 31E(7).

Participants themselves must treat the MOU as a binding contract whose breach can lead to immediate termination. They should notify the Commissioner the moment they are subpoenaed or otherwise drawn into any court, coronial, commission or Law Enforcement Conduct Commission proceeding. Marriage, entering contracts that require identity verification, or posting on social media all require prior consultation with the assigned protection officer.

Organisations that may become “agencies” under the expanded s 4A definition should review their record-keeping systems to ensure they can promptly locate and deal with any identity records the subject of a court order or Commissioner request. Human-resources and IT departments need training on the absolute prohibition on disclosure (s 23) and the secure-handling obligation (s 38A).

In all cases, the safest course is to assume that once a person is or has been in the program, their previous identity is radioactive. Any decision to disclose it should be taken only after obtaining written authorisation from the Commissioner or a Supreme Court order, and only after confirming that the proposed disclosure falls squarely within one of the statutory exceptions in ss 23, 32 or 34.