Civil servants are handling public access to information requests without official written protocols on how to do so, causing breaches of confidentiality.

The issue is highlighted in information commissioner Gitanjali Gutierrez’s first annual report, in which she concludes that the lack of guidelines and insufficient staff training led to the identity of a Public Access to Information requester being made public last year.

“In the absence of written procedures to guide the public authority’s staff in the handling of a Pati request, the public cannot have faith that their confidentiality will be safeguarded,” warns the commissioner.

The Cabinet Office insisted yesterday it was on track to release the “practice codes” for public servants, which are required by law, by the end of this month.

Ms Gutierrez’s report includes the findings of an inquiry she held into the Ministry of Public Works headquarters and the Department of Works and Engineering, after public works minister Craig Cannonier named Walton Brown as a Pati requester in Parliament in May.

She says that disclosure was the result of a “perfect storm of events”.

The commissioner adds: “But the same lack of written procedures and inconsistent practice may be found across public authorities during the transitional years [of the Pati Act].

“The information commissioner’s recommendations give direction towards addressing these issues in a comprehensive manner, which will best serve the public and support public authorities in their Pati practice.”

Ms Gutierrez writes that the “highly publicised national disclosure” of Mr Brown’s identity, six weeks after the law came into effect, could reinforce people’s fears about requesting records under the Public Access to Information Act in case they are “labelled as rude or troublesome, or accused of stepping out of line”.

She adds: “Right out the gate, requesters had reason to question the security of their right to remain confidential.

“Those who filed Pati requests in 2015 did so because they were driven to accomplish something and recognised that the Pati Act offered a new tool for achieving it.

“Their bravery has paved a path for others and transformed the principles of the Pati Act into concrete action.”

The commissioner told The Royal Gazette that some departments had come up with their own procedures following the enactment of Pati on April 1 last year, while others could be dealing with requests on an “ad hoc basis”.

She said it was essential there was a set of rules to “standardise the practice” of processing Pati requests but noted that the Public Access to Information Act was still in its infancy.

“We have taken the approach that the passage [of the Act] was the beginning,” said the commissioner.

“Everybody is coming to this from a different perspective. Some have worked within environments where they have to maintain confidentiality of records. Some people have never had to deal with confidential records before.

“That’s where having stuff in writing is helpful. Once the practice codes are produced, we have these guidelines similar to financial instructions — this set of procedural how-to’s.

“[Public servants can] follow the practice codes and they can be confident they are engaging in best practice.”

Ms Gutierrez said written protocols were especially important since Bermuda’s Pati Act did not allow for anonymous requests and there remained a risk of breaches of confidentiality as long as requesters had to visit departments in person..

“Once a requester’s identity is revealed, the extent of the harm to both the individual requester’s life and the public’s perception of the security of their right to confidentiality is difficult to anticipate, as the events related to this investigation have shown,” she writes in her report.

“We currently do not have a mechanism that allows a requester to ask for records anonymously. Thus, maintaining a requester’s confidentiality protects them from retaliation and other negative consequences when they file Pati requests in certain circumstances.”

A Cabinet Office spokeswoman said: “It had been agreed with the information commissioner to release the codes by the end of March. We are still on target for that deadline.”