Witness Protection Regulations 2017

The Regulations introduce several defined terms that structure the entire compliance framework. These definitions are in regulation 4 and are critical to understanding the duties imposed.

Scheduled decision means a decision referred to in section 20I(1) of the Act that is due to be made. The Act itself lists three categories: (a) a decision to accept a person into the witness protection program; (b) a decision to vary a person’s participation; and (c) a decision to terminate a person’s participation. The Regulations do not expand that list. The phrase “due to be made” implies a point before the decision is finalised, which triggers the notification and document delivery obligations.

Unique identifying number means a unique number or name that Victoria Police has assigned for reference purposes to a scheduled decision. This allows the PIM to track each decision without needing to know the identity of the witness or any operational details. It is the key identifier used in all notifications, receipts, and registers.

Secure delivery means delivery of documents in a double-sealed envelope by a member of Victoria Police personnel. The envelope must be sealed and marked with the security classification level on the inner envelope, then placed inside a second sealed envelope. The requirement that delivery be done by a Victoria Police member (not by ordinary postal or courier services) reflects the sensitivity of witness protection data.

Witness protection data means any information that the PIM receives under the Act to enable the performance of its functions. This is a broad definition, covering all documents and communications given to the PIM, whether under the notification requirements or under the document disclosure provisions. It is not limited to “classified” material; any information received is caught, subjecting it to the security and record-keeping obligations of Part 4.

Double-sealed envelope details the two‑step process: an inner envelope containing the documents is sealed and marked with the security classification level, then that inner envelope is placed inside a second envelope which is also sealed. The regulation does not prescribe the type of envelope (paper, plastic, tamper‑evident) or specify whether the outer envelope must also be marked. This creates some implementation ambiguity: what constitutes adequate sealing and marking is not defined further.

Written receipt is a receipt given by the PIM that specifies (a) the unique identifying number for the scheduled decision; (b) whether the decision is of type (a), (b), or (c) under section 20I(1); and (c) a list of any documents received. The receipt serves as an audit trail and triggers the PIM’s return obligations under section 20N.

Other important concepts include the Principal Public Interest Monitor, who is the person responsible for developing the written procedures under regulation 11, and information security event/incident defined in regulation 11(2). An information security event is an identified occurrence indicating a possible breach of policy, failure of safeguards, or previously unknown security‑relevant situation. An incident is a single event or series likely to have compromised security. These definitions are borrowed from standard information security frameworks (e.g., ISO 27001) and require the Principal PIM to establish incident reporting and escalation procedures.

The Regulations directly bind three categories of persons and entities: the Chief Commissioner of Victoria Police; members of Victoria Police personnel involved in witness protection decisions; and the Public Interest Monitor (including the Principal Public Interest Monitor and any staff). The Act itself also affects witnesses and applicants, but the Regulations are entirely internal to the oversight process and do not impose any duties on witnesses.

Victoria Police , specifically the Chief Commissioner , bears the primary burden under the Regulations. The Chief Commissioner must notify the PIM of every scheduled decision, provide an estimate of when documents will be available, and update the PIM on any changes (regulations 5-6). The Chief Commissioner must also ensure that documents are delivered by secure delivery, using a Victoria Police member and double‑sealed envelopes (regulation 8). After the PIM returns documents under section 20N, the Chief Commissioner must confirm receipt and certify whether all required documents have been returned (regulation 14). This creates a substantial administrative load. Every witness protection decision , even routine variations , requires a paper trail, a dedicated unique identifier, and coordination with the PIM’s availability. The requirement to ascertain the PIM’s availability by telephone or email before a notification (regulation 5(a)) introduces a scheduling dependency that could delay urgent decisions, especially if the PIM is unavailable.

Victoria Police personnel are not defined in the Regulations, but regulation 9 also imposes duties on “a member of Victoria Police personnel” who is required to give documents to the PIM under section 20L of the Act. Those persons must deliver documents as soon as practicable by secure delivery. This likely includes officers handling witness protection files, records staff, and possibly legal advisers. The burden is diffuse across the organisation.

The Public Interest Monitor is the recipient of all notifications and documents. The PIM must confirm notifications by giving a written receipt and, for termination decisions, advise whether it intends to exercise its function under section 20J(1)(a) (regulation 7). The PIM must also give a written receipt each time documents are received (regulation 10). More onerously, the Principal Public Interest Monitor must develop and maintain a suite of written procedures: an information security policy, access control policy, monitoring procedures, protection procedures, a risk management policy, incident reporting and escalation procedures, and a continual improvement process (regulation 11(1)(a)-(g)). This is a significant compliance obligation for an office that may have limited resources. The PIM must also keep a register of all documents received (regulation 12) and store documents in a secure place (regulation 13). The register must record current location and date of return , implying ongoing tracking.

Witnesses and applicants are not directly mentioned in the Regulations. However, they are indirectly affected because the Regulations govern the handling of their sensitive personal information. The more secure the PIM’s processes, the lower the risk of identity disclosure. But the administrative overhead may also slow decision‑making, potentially affecting witness safety or willingness to cooperate. The Regulations do not impose any duty on Victoria Police to consult or inform the witness about the PIM’s involvement; the process is invisible to the person at the centre of the decision.

No other public bodies or private sector entities are affected. The Regulations do not extend to courts, tribunals, or other agencies. The PIM is the sole oversight body, and Victoria Police is the sole subject of the notification duties.

The Regulations impose duties exclusively, with no corresponding rights conferred on any party , not on witnesses, not on Victoria Police, and not on the public. The duties are all procedural.

Duties of the Chief Commissioner:

• After contacting the PIM by phone or email to ascertain availability, the Chief Commissioner must notify the PIM of a scheduled decision. The notification must be by email or hand delivery and include: a unique identifying number; the type of decision (acceptance, variation, or termination); the date, time and place of the scheduled decision; and an estimate of when the Chief Commissioner will give the PIM copies of documents under section 20K(3) (regulation 5). This duty arises before the decision is made.
• If any of those details change, the Chief Commissioner must notify the PIM by email or hand delivery as soon as practicable after becoming aware of the change (regulation 6).
• The Chief Commissioner must give the PIM copies of documents prepared for the scheduled decision as soon as practicable after they are prepared but before the decision is due. This must be done by secure delivery (regulation 8).
• If the Chief Commissioner or a Victoria Police member is required to give further documents under section 20L, that must also be done as soon as practicable by secure delivery (regulation 9).
• After receiving documents returned by the PIM under section 20N, the Chief Commissioner must notify the PIM as soon as practicable, in writing, specifying the unique identifying number, the type of information received, and whether all required documents have been returned (regulation 14).

Duties of the Public Interest Monitor:

• As soon as practicable after being notified under regulation 5 or 6, the PIM must give the Chief Commissioner a written receipt. For termination decisions, the PIM must also advise whether it intends to exercise its function under section 20J(1)(a) (regulation 7). That function is not described in the Regulations, but section 20J of the Act likely gives the PIM a right to appear or make submissions.
• As soon as practicable after receiving any document under regulation 8 or 9, the PIM must give a written receipt (regulation 10).
• The Principal Public Interest Monitor must develop written procedures for dealing with witness protection data, covering seven enumerated topics (regulation 11). These procedures are internal to the PIM’s office but must be documented.
• The Principal PIM must keep a register of all documents received, including current location and the date returned (regulation 12).
• The PIM must keep all documents containing witness protection data in a secure place accessible only to authorised persons (regulation 13).

Rights: The Regulations do not grant any right to the PIM to demand documents beyond those already provided under the Act. The right to receive notifications and documents exists only as correlative to the Chief Commissioner’s duty. There is no right of a witness or third party to access the register, to be informed of the PIM’s involvement, or to challenge any failure of Victoria Police to comply. The Regulations are purely administrative and do not create a private right of action.

No duties are imposed on the witness or any other person. The entire scheme is a bilateral process between Victoria Police and the PIM.

The Regulations contain no penalty provisions whatsoever. No regulation specifies a fine, imprisonment, or other sanction for non‑compliance. The Witness Protection Act 1991 may contain offences, but those are not incorporated into the Regulations. While section 25A of the Act authorised these Regulations, it does not necessarily create an offence for breach of a regulation. The Regulations do not purport to create any offences; they are purely procedural.

That does not mean non‑compliance is without consequences. A failure by the Chief Commissioner to notify the PIM or deliver documents on time could be grounds for an application to the Supreme Court for judicial review, or could be raised in any proceeding where the validity of a witness protection decision is challenged. A failure by the PIM to maintain security or return documents could lead to internal review by the Victorian Ombudsman or the Independent Broad‑based Anti‑corruption Commission (IBAC), but no specific enforcement mechanism is provided in the Regulations.

The Subordinate Legislation Act 1994 provides that breach of a statutory rule does not of itself constitute an offence unless the rule expressly so provides (section 32). Since these Regulations do not expressly create an offence, non‑compliance is not a criminal matter. It is more akin to a breach of administrative procedure.

The only enforcement “stick” is indirect: the PIM must confirm receipt of documents and the Chief Commissioner must confirm return. These confirmations create a paper trail that makes it difficult for either party to deny that documents were late, missing, or mishandled. The register maintained by the PIM under regulation 12 adds another layer of accountability. If documents go missing, the register will show who last had them.

What is conspicuously absent is any mechanism for the PIM to compel compliance. If the Chief Commissioner fails to notify a scheduled decision, the PIM may never know about it. The PIM has no power to inspect Victoria Police files independently; it can only receive what is provided. The Regulations do not impose a duty on Victoria Police to self‑audit or to report to the PIM on whether all scheduled decisions have been notified. The entire system relies on Victoria Police voluntarily complying. In practice, the administrative burden is low enough that non‑compliance is unlikely, but there is no independent verification.

For the PIM, a failure to develop the written procedures under regulation 11 would be a breach, but who would enforce it? The Principal PIM is likely a statutory officer, and procedural deficiencies could be raised in a parliamentary committee or by the Auditer‑General, but the Regulations do not contain reporting obligations.

In summary, the Regulations are enforced through institutional culture and the risk of reputational damage or legal challenge, not through penalties. This is not unusual for procedural regulations, but it means the system depends on trust and professionalism rather than deterrence.

The Regulations are a creature of the Witness Protection Act 1991 and must be read in that context. Key interactions:

Parent Act , Witness Protection Act 1991: The Regulations flesh out the procedural skeleton of Part 2A of the Act. Sections 20I, 20J, 20K, 20L, and 20N of the Act are specifically referenced. The Regulations do not purport to modify any substantive provisions of the Act. For example, they do not change the criteria for acceptance, variation, or termination; they only govern how the PIM is notified and receives documents. Section 20K requires the Chief Commissioner to notify the PIM of scheduled decisions and give copies of documents; regulation 5 specifies the form, content, and timing of that notification. Section 20N requires the PIM to return documents; regulation 14 sets out how confirmation of return must occur. The Regulations fill in the gaps.

Subordinate Legislation Act 1994: The Regulations are made under section 25A of the Act and must comply with the Subordinate Legislation Act 1994, which governs the making, tabling, and disallowance of statutory rules. The endnote references sunset under section 5 of that Act. The reference to sunset 10 years after making means the Regulations will expire on 20 June 2027 (if the 20 June 2017 making date is correct; the endnote’s mention of 20 June 2018 appears to be a typographical error). After sunset, the Regulations would cease to have effect unless remade. This creates a planning horizon for the PIM and Victoria Police to either update or replace these rules.

Interpretation of Legislation Act 1984: The endnotes note that style changes, punctuation, headings, provision numbers, and examples are part of the Regulations by virtue of section 36 of the ILA. This is standard for all Victorian statutory rules. It means the headings (e.g., “Part 2 , Notice requirements”) are part of the operative text and can be used for interpretation.

Privacy and Data Protection Act 2014 (Vic) and Health Records Act 2001 (Vic): The Regulations do not reference privacy laws, but the handling of witness protection data will likely intersect with those statutes. Witness protection data includes highly sensitive personal information. The Privacy and Data Protection Act 2014 imposes obligations on Victorian public sector organisations (including Victoria Police and the PIM) to protect personal information. The Regulations supplement those obligations by specifying security measures (double‑sealed envelope, secure storage, access control, risk management). However, the Regulations do not create a separate right to privacy or a right to complain to the Commissioner for Privacy and Data Protection. If the PIM’s procedures under regulation 11 are inadequate, a data breach could trigger obligations under the Privacy and Data Protection Act.

Common law and administrative law: The Regulations operate against the background of general administrative law principles. If the PIM is not notified of a scheduled decision, the decision may be procedurally flawed. However, the Act likely allows the Chief Commissioner to proceed even without PIM notification in certain circumstances (the Act is not provided in this source). The regulations do not state that non‑compliance invalidates a decision. A court would consider the statutory context.

No interaction with other witness protection schemes (e.g., Commonwealth or other states) is mentioned. The Regulations are specific to Victoria Police.

The Regulations were made on 20 June 2017 by the Governor in Council and commenced on 1 July 2017. As at the date of the published version (Version No. 001), no amendments have been made. The Table of Amendments at endnote 2 states “There are no amendments made to the Witness Protection Regulations 2017 by statutory rules, subordinate instruments and Acts.” Similarly, endnote 3 confirms “no amendments which were Not in Operation.” The Regulations remain in their original form.

This is notable. The Regulations have been in force for over seven years (as at 2024) without any amendment. The security procedures and notification methods prescribed (e.g., email, hand delivery, double‑sealed envelope) have presumably remained adequate, or the authorities have not considered changes necessary. However, the absence of amendment does not mean the Regulations are current in practice. For example, the regulation only mentions “email or hand delivery” for notifications (regulation 5(b)), but secure electronic transmission systems (e.g., encrypted portals) may now be more common. The Regulations could be updated to permit secure electronic delivery, but they have not been.

The sunset provision in the Subordinate Legislation Act 1994 means the Regulations will automatically expire 10 years after making , that is, on 20 June 2027 (assuming the correct making date is 20 June 2017, not the endnote’s apparent error “20 June 2018”). Before that date, the responsible Minister must either remake the Regulations (with or without amendments) or let them lapse. If they lapse, the Witness Protection Act 1991 would still operate, but the procedural requirements for PIM notification would revert to the default provisions in the Act, which are skeletal. The Act might continue to require notification, but the form and manner would be unspecified, potentially leading to disputes.

No amendment history suggests that the original drafting was well‑considered, but it also means the Regulations have not been stress‑tested against changing technology or operational realities. The PIM’s procedures under regulation 11 may have been developed once and not reviewed, despite the requirement for “continual monitoring and improvement” in regulation 11(1)(g). The absence of amendments does not equate to compliance with that continual improvement obligation.

The source material does not mention any litigation history, and there is no reported case law specifically on these Regulations. Given the secretive nature of witness protection decisions (often made under closed‑court orders), litigation would be rare. Challenges to witness protection decisions are unlikely to turn on the procedural niceties of PIM notification; they would more likely concern the substantive merits or human rights.

However, potential areas of dispute could include:

• Whether a notification given under regulation 5 complied with the content requirements. For instance, if the unique identifying number was omitted, the PIM might argue the notification was invalid.
• Whether documents were delivered “as soon as practicable” and “before the scheduled decision is due” (regulation 8). A delayed delivery could be used to argue that the PIM was not adequately informed.
• Whether the PIM’s failure to develop written procedures under regulation 11 could be used to challenge the validity of any oversight function the PIM later performed. A witness might argue that the PIM’s oversight was compromised because security procedures were not in writing.
• Whether the Chief Commissioner’s confirmation under regulation 14 was inaccurate (e.g., stating all documents were returned when some were missing). That could expose Victoria Police to criticism but unlikely to lead to civil proceedings.

No court has yet had to interpret these Regulations, so any analysis is speculative. The absence of litigation does not necessarily mean compliance is perfect; it may mean the procedural requirements are rarely tested because the stakes are high and secrecy is paramount. The PIM and Victoria Police likely resolve any discrepancies informally.

Practitioners should note that if a dispute arises (e.g., a witness alleges a decision was procedurally flawed because of late notification), the Regulations would be central. The unique identifying number and written receipts provide a clear audit trail. The party seeking to challenge must have access to that information, which may itself be secret.

The Regulations appear straightforward but contain several traps for the unwary, especially for Victoria Police officers and PIM staff who are not intimately familiar with the procedural requirements.

Timing trap in regulation 5(a): Before notifying a scheduled decision, the Chief Commissioner must first contact the PIM by telephone or email to ascertain the PIM’s availability to attend the making of the decision. This is a precondition to a valid notification. If the Chief Commissioner sends a notification without first checking availability (e.g., because it is after hours and the PIM is not contactable), the notification may be non‑compliant. The Regulations do not provide an exception for urgency or emergency. In a real‑world witness protection situation, decisions may need to be made quickly. The requirement to await confirmation of availability could cause critical delays. If the PIM is not available, there is no prescribed fallback , the decision might go ahead without PIM attendance, but the notification process would still be defective.

Secure delivery definition is narrow: Regulation 4 defines “secure delivery” as delivery in a double‑sealed envelope by a member of Victoria Police personnel. This means documents cannot be sent by registered post, courier, or email, even if encrypted. The envelope must be hand‑delivered by a police member. That imposes travel costs and time. For Victoria Police, it may require assigning a sworn officer to courier documents, rather than using a civilian courier or electronic system. This is a compliance burden that could have been avoided by allowing secure electronic transmission, but the Regulations do not.

The double‑sealed envelope requirement is not foolproof: Regulation 4 defines the process, but it does not specify the type of sealing (e.g., tamper‑evident tape, wax seal, or just licking the flap). It also does not specify whether the outer envelope must be opaque or marked with any particular indication. A literal reading suggests any second envelope suffices, which could compromise security if the envelope is transparent. The regulations do not require a chain‑of‑custody log for the envelope; only the written receipt for documents is required.

No transitional provisions for existing decisions: The Regulations apply only to “scheduled decisions … due to be made” after commencement. But it is unclear what happens if a decision was already in the pipeline on 1 July 2017 , presumably the PIM must be notified for any decision made after that date, even if documents were prepared earlier. No transitional regulation exists.

The PIM’s register must include “current location” of documents (regulation 12(2)(a)). This implies the PIM must track each document’s physical location at all times, even when in use. In a busy office, that is administratively demanding. The register does not need to record who accessed the documents, only their location. That is a gap: if documents are lost, the register may show the last location but not the person responsible.

Regulation 14(2)(d) requires the Chief Commissioner to specify whether the PIM has returned all required documents. The Chief Commissioner may not always know if all required documents have been returned, particularly if the decision involves many supporting documents. The Chief Commissioner may have to rely on the PIM’s own register. If the PIM’s register is inaccurate, the Chief Commissioner’s confirmation may be wrong, creating a false audit trail.

The “as soon as practicable” standard recurs throughout (regulations 6, 8, 9, 10, 14(1)). This is a fact‑dependent standard. In a crisis, “as soon as practicable” might be hours; in normal circumstances, it might be days. There is no concrete time limit (e.g., “within 24 hours”). This creates uncertainty and potential for dispute.

No provision for electronic documents: The Regulations talk about “documents” but do not address electronic files (PDFs, emails, database extracts). The secure delivery definition using physical envelopes clearly contemplates paper. Victoria Police and the PIM may deal with electronic records, and the Regulations do not provide a parallel procedure for electronic disclosure. The safest interpretation is that all documents must be printed and delivered physically. That is wasteful and insecure (paper copies can be lost easier than encrypted files). The PIM’s written procedures under regulation 11 may cover electronic records, but the notification and delivery regulations do not.

Sunset ambiguity: The endnote states “will sunset 10 years after the day of making on 20 June 2018.” That appears to be a drafting error. The proper making date is 20 June 2017 (see the first line of the endnote). If the sunset date is 20 June 2027, then the regulations are valid. But if someone relies on the erroneous “2018” date, they might think the regulations expired. Practitioners should use the earlier date (20 June 2017) as the official making date. The Regulations appear to be in force until 2027, but they should be checked for any subsequent amendment or re‑making not captured in this version.

Compliance with the Regulations is a shared responsibility between Victoria Police (the Chief Commissioner and personnel) and the Public Interest Monitor.

For Victoria Police , steps to comply:

1. Establish and maintain a unique identifying number system. Every scheduled decision (acceptance, variation, or termination) must be assigned a unique number or name before any notification is sent (regulation 5(c)(i)). This number must be used consistently across all notifications, receipts, and document return confirmations. It should be recorded in a central register that links the number to the decision without revealing the witness’s identity.

2. Pre‑notification availability check. Before sending a formal notification, contact the PIM by telephone or email to confirm the PIM’s availability to attend the scheduled decision (regulation 5(a)). Document the time and method of this contact. If the PIM is not available, note the reason and, if the decision is urgent, consider legal advice on whether to proceed. The Regulations do not excuse compliance for urgency, but a court might interpret “after … contact … to ascertain … availability” as requiring a reasonable attempt, not a successful one.

3. Send a complete notification. The notification must be by email or hand delivery (regulation 5(b)). Include all five elements: unique identifying number, type of decision (a), (b) or (c), date/time/place, and an estimate of when documents will be provided (regulation 5(c)). If any detail changes, re‑notify as soon as practicable (regulation 6). Keep a copy of every notification.

4. Document delivery by secure delivery. Prepare all documents that have been prepared for the decision (section 20K(3) of the Act). Place them in a double‑sealed envelope: inner envelope with security classification marking, then outer envelope. Have a member of Victoria Police personnel deliver the envelope to the PIM as soon as practicable after preparation but before the decision is made. Obtain a written receipt from the PIM (regulation 10). For any further documents disclosed under section 20L, repeat the process (regulation 9).

5. Return confirmation. After the PIM returns documents under section 20N, send the PIM a written notification confirming receipt. That notification must include: the unique identifying number, the type of information received, and a statement of whether all required documents have been returned (regulation 14). If documents are missing, highlight that in the notification.

6. Internal record keeping. Maintain a Victoria Police internal record of all notifications, deliveries, and confirmations. While the Regulations do not require this, it is prudent for audit and accountability.

For the Public Interest Monitor , steps to comply:

1. Develop written procedures immediately. The Principal Public Interest Monitor must create and maintain written procedures covering the seven areas in regulation 11(1): an information security policy, an access control policy, monitoring procedures, protection procedures, a risk management policy, incident reporting/escalation procedures, and a process for continual monitoring and improvement. These procedures should be documented, approved, and reviewed regularly. They must be kept current , the regulation says “develop” but the continual improvement requirement implies ongoing updates.

2. Set up a document register. Create and maintain a register of all documents received for each scheduled decision (regulation 12). The register must record the current physical location of each document (e.g., “box 3, shelf 2, secure room”) and the date each document is returned to the Chief Commissioner. This register is the key audit trail. Consider using a database with controlled access.

3. Respond to notifications promptly. As soon as practicable after receiving a notification under regulation 5 or 6, give the Chief Commissioner a written receipt (regulation 7(a)). For termination decisions (type (c)), also advise whether you intend to exercise your function under section 20J(1)(a). That advice must be by email or hand delivery (regulation 7(b)). There is no prescribed form for the written receipt, but it must include the elements in the definition (unique identifying number, type of decision, list of any documents received).

4. Acknowledge documents. As soon as practicable after receiving documents under regulation 8 or 9, give a written receipt (regulation 10). Keep a copy of each receipt.

5. Secure storage. Keep all documents containing witness protection data in a secure place when not in use. The secure place must be accessible only to persons entitled to deal with that information (regulation 13). This requires physical locks, access logs, and possibly electronic controls for digital records (if any). The written procedures under regulation 11 should define who is “entitled” to access.

6. Return documents. Under section 20N of the Act (not detailed in the Regulations), the PIM must return documents to the Chief Commissioner. The Regulations do not specify a timeframe for return, but the register must record the date of return. After the Chief Commissioner confirms return (regulation 14), the PIM should update the register and destroy or archive any copies (subject to the Act’s requirements).

7. Training and drills. Since the Regulations rely on physical secure delivery and double‑sealed envelopes, all PIM staff must be trained in the procedure. Consider periodic drills to test the information security incident response.

Common pitfalls to avoid:

• Using email for document transmission (the Regulations only allow secure delivery for documents; email is allowed only for the initial notification and change notifications).
• Failing to obtain a written receipt for every document delivery , this is a mandatory step to complete the chain.
• Allowing unauthorised staff to access witness protection data , the secure storage requirement makes the PIM vicariously liable for any breach.
• Not updating the register when documents are moved within the PIM’s office , the “current location” must be accurate at all times.
• Ignoring the availability pre‑notification step , sending a notification without checking availability may invalidate the entire process.