Tusla whistleblower asks gardaí to investigate alleged ‘retaliation and unlawful conduct’

Kenneally is asking An Garda Síochána to examine whether Tusla employees committed criminal offences after he submitted a protected disclosure about procurement and financial procedures. The complaint was lodged with Garda Commissioner Justin Kelly on October 5th by Kenneally’s solicitor, Kevin Winters of KRW Law. It matters because the allegations concern possible retaliation against a whistleblower and possible misuse of personal information.

The complaint identifies alleged retaliation or penalisation under the Protected Disclosures Act 2014. It also alleges unlawful obtaining, processing, or misuse of personal data under the Data Protection Act 2018. Kenneally says Tusla carried out unauthorised inquiries into his earlier employment, including background checks and attempts to damage his credibility, despite completed Garda vetting and reference checks.

An Garda Síochána said it could not comment on matters that may relate to a protected disclosure. Tusla said allegations must receive due process. Kenneally’s solicitor said a plenary summons may follow if Tusla does not provide a satisfactory response within two to three weeks.

A protected disclosure is a report of suspected wrongdoing, such as unlawful conduct, serious financial mismanagement, or risks to the public interest, made under whistleblower-protection law. An ordinary workplace complaint usually concerns an employee’s own treatment, pay, workload, or working conditions. The key difference is the subject and legal protection: a protected disclosure exposes wider wrongdoing, while a personal grievance primarily seeks to resolve an individual employment problem.

Kenneally’s first disclosure concerned procurement and financial procedures at Tusla’s Liberty Street aftercare service. An internal review later found missing financial-management guidelines, inconsistent records, and cash withdrawals made without regard to known requirements and contingency funds. He alleges that, after reporting these issues, he faced bullying, stress, employment termination, and inquiries into his previous work history.

The Protected Disclosures Act 2014 is intended to prevent retaliation for raising qualifying concerns. Tusla said all protected disclosures it receives are assessed under its policy, while also stressing that allegations require due process. The article does not determine whether Kenneally’s allegations constitute criminal offences.

Six bodies or processes are involved. Tusla assessed the protected disclosures and is the organisation accused of retaliation. An Garda Síochána received the complaint about possible criminal offences. The Workplace Relations Commission handled Kenneally’s unfair-dismissal case. The Data Protection Commission examined Tusla’s processing of his personal data. The Minister for Children and her department provide political and departmental oversight. Possible High Court or other court proceedings would address legal claims if settlement fails.

The WRC case ended in a settlement in November 2019. Later records released through that case confirmed that Tusla had carried out a background check. The Data Protection Commission then found that Tusla had failed to demonstrate a lawful GDPR basis for processing Kenneally’s data. Separately, his solicitor warned that a plenary summons could be issued.

These roles overlap in subject matter but not in function. Gardaí may assess alleged offences, while the WRC deals with employment disputes and the Data Protection Commission regulates personal-data handling. Tusla, the department, and any court process provide separate organisational, political, or legal routes. The article does not confirm that every route has produced a final outcome.

Kenneally alleges that Tusla retaliated after his protected disclosure through severe workplace bullying, work-related stress, and ultimately the termination of his employment. He also says management conducted unauthorised inquiries into his previous employment, including background checks and attempts to discredit his credibility. These allegations are serious because they describe both workplace pressure and scrutiny of personal information after a report of suspected wrongdoing.

The article states that Kenneally had already successfully completed Garda vetting and reference checks during recruitment. Despite that, he alleges Tusla investigated his employment history. His solicitor’s letter says the treatment affected his work and finances. Kenneally was left without income for a prolonged period, according to the complaint.

He also says his health deteriorated significantly, with medical evidence supporting that claim. Kenneally resigned from his aftercare-service role in January 2019, and later settled an unfair-dismissal case with Tusla at the WRC. Tusla has not commented on the specific allegations and says due process must apply. The article does not establish liability or quantify his losses.

Earlier this year, the Data Protection Commission found that Tusla failed to demonstrate a lawful basis under the General Data Protection Regulation for processing Kenneally’s personal data. The finding relates to the agency’s handling of information about him, including a background check confirmed by records released after his WRC case. It matters because data protection rules require organisations to justify personal-data processing.

A lawful basis is the recognised legal reason that permits an organisation to collect, use, or share personal information. Depending on the circumstances, this can include consent, a legal obligation, a contract, or another basis set out in the GDPR. The organisation must be able to explain which basis applies and why the processing is necessary and fair. The article does not identify which basis Tusla relied upon or should have used.

The finding does not itself decide whether Kenneally suffered retaliation or whether criminal offences occurred. It establishes a data-protection concern about Tusla’s ability to justify its processing. Kenneally’s Garda complaint separately alleges unlawful data use, and his solicitor is considering court proceedings if Tusla does not resolve the wider dispute.

A Garda investigation concerns suspected criminal conduct. Here, Kenneally asks gardaí to examine alleged retaliation for a protected disclosure and unlawful personal-data use. Gardaí have not commented because the matter may relate to a protected disclosure. This route could assess whether offences warrant investigation, but the article does not say an investigation has begun or reached a conclusion.

The WRC is an employment-dispute process. Kenneally brought an unfair-dismissal case there, and it settled in November 2019. The Data Protection Commission took a regulatory route instead, finding that Tusla failed to demonstrate a lawful GDPR basis for processing his personal data. That finding addresses data compliance, not every allegation about bullying, dismissal, or criminal conduct.

A possible court action would be separate litigation. Kenneally’s solicitor said a plenary summons may issue if Tusla does not respond satisfactorily within two to three weeks. The solicitor first asked Tusla to discuss a lawful and transparent resolution and compensate Kenneally for losses. The article does not state whether proceedings were ultimately issued.

Whistleblower-protection laws exist so workers can report suspected wrongdoing without being punished for speaking up. They are especially important where an employer controls a person’s job, income, reputation, and access to internal information. Data-protection rules exist for a related reason: they limit how organisations collect, use, investigate, and retain personal information. Both systems require powerful institutions to justify their actions.

In this case, Kenneally reported concerns about procurement and financial procedures at a Tusla aftercare service. He then alleges bullying, work-related stress, termination, background inquiries, and attempts to discredit him. The Data Protection Commission later found that Tusla failed to demonstrate a lawful GDPR basis for processing his personal data. These facts illustrate the two kinds of power at issue: employment power and information power.

The protections do not automatically prove that an employer acted unlawfully. Allegations still require investigation and due process. Tusla said its protected-disclosure policy applied to disclosures it received and that caution was needed when publishing allegations. The Garda complaint and possible court action could determine further consequences, while the existing data-protection finding addresses only the processing issue described.