A practical guide to whistleblowing in Australia

Australia’s whistleblower regime under the Corporations Act 2001 (Cth) (Corporations Act), provides protections for people who speak up about corporate misconduct or wrongdoing (Whistleblower Laws). The Whistleblower Laws aren’t just about supporting those who raise a complaint, they also set out clear obligations for organisations to comply with. That’s why it’s essential for businesses to understand what’s required  when someone ‘blows the whistle.’

What types of organisations are subject to Whistleblower Laws?

Australia’s Whistleblower Laws apply to the following:¹

• A company
• A bank or authorised deposit-taking institution
• A provider of general insurance or life insurance
• A superannuation entity or a superannuation trustee
• An incorporated association or other body corporate that is a trading or financial corporation, including: not-for-profit organisations that trade in goods or services, lend or borrow money, or provide other financial services, and their trading or financial activities make up a sufficiently significant proportion of their overall activities.

Who is a whistleblower, and what is a Whistleblower Disclosure?

Whistleblowers are individuals who make a complaint about misconduct or an improper state of affairs relating to a company or organisation captured by the Whistleblower Laws. The whistleblower must have reasonable grounds to suspect that the information they disclose could be considered as such.

Whistleblowers can be a current or former:²

• employee of the company or organisation, or a related company or organisation
• officer of the company or organisation the disclosure is about, or a related company or organisation
• person (or employee of a person or entity) who has supplied goods or services to the company or organisation the disclosure is about, or a related company or organisation
• associate of the company or organisation
• trustee, custodian or investment manager of a superannuation entity, or an officer, employee or goods or service provider to a trustee, custodian or investment manager
• spouse, relative or dependant of one of the people referred to above, or a dependant of such an individual’s spouse.

The information in Whistleblower Disclosures can be about the company or organisation, or an officer or employee of the company or organisation. It must be related to conduct that:[3]

• breaches the Corporations Act; or
• breaches other financial sector laws enforced by the Australian Securities and Investments Commission (ASIC) or the Australian Prudential Regulation Authority (APRA); or
• breaches an offence against any other law of the Commonwealth that is punishable by imprisonment for a period of 12 months; or
• represents a danger to the public or the financial system.

Who can a Whistleblower Disclosure be made to?

A Whistleblower Disclosure, in order to be a protected disclosure, must be made to one of the following:⁴

• ASIC
• APRA
• A prescribed Commonwealth authority
• An eligible recipient in the body corporate such as:
  1. an officer or senior manager;
  2. an auditor or member of an audit team conducting an audit;
  3. an actuary; or
  4. a person authorised by the body corporate to receive whistleblower disclosures.

Are all concerns raised a Whistleblower Disclosure?

The Whistleblower Laws apply to the specific set of matters set out above. Of note, the Corporations Act expressly carves out “personal work-related grievances.” In this respect, it is important to carefully consider the nature of the complaint being made and whether it is a Whistleblower Disclosure within the meaning of the Corporations Act. Examples of grievances that are unlikely to be captured by the Whistleblower Laws include:

• an interpersonal conflict with another employee
• a decision about an employee’s transfer, promotion, or termination
• a decision about the terms of employment.

What protections are afforded to whistleblowers under the Corporations Act?

Immunity

Whistleblowers who make a protected disclosure are not subject to any civil, criminal or administrative liability (including disciplinary action) for making the disclosure.⁵ Further, no contractual or other remedy or right may be enforced or exercised against them on the basis of the disclosure.⁶

The information contained in the disclosure is also not admissible as evidence against the whistleblower in criminal or other penalty proceedings, except in relation to proceedings where the information provided as part of the disclosure is alleged to be false.⁷

It is also important to note that whistleblower protections can also apply where the whistleblower makes a report to a journalist or a member of the Commonwealth, State, or Territory parliament.⁸ However, this protection extends only in limited circumstances where the disclosure or report relates to a matter of public interest or in the case of an emergency.

Confidentiality

Under s 1317AAE of the Corporations Act, the identity of a whistleblower must be kept confidential unless the whistleblower consents to the disclosure of their identity or their identity is disclosed to:⁹

• ASIC;
• APRA;
• a member of the Australian Federal Police; or
• a legal practitioner, to obtain legal advice or legal representation in relation to the whistleblowing legislation.

Compensation for damage caused

Damages may be awarded to whistleblowers or to any other person who has suffered loss as a result of the detrimental conduct. Of note, the Whistleblower Laws allow for the awarding of exemplary damages.

Detrimental conduct

The Whistleblower Laws also afford protections to whistleblowers against detrimental conduct. Detrimental conduct is conduct that causes any detriment to a person and includes making threats to cause any detriment to that person.

Critically, companies, their employees, and officers must not engage in detrimental conduct against a person if:¹⁰

1. they believe or suspect that a person subject to the detrimental conduct may be a whistleblower; and
2. the belief or suspicion is partly or wholly the reason for the detrimental conduct.

This means that a person does not necessarily need to have made a Whistleblower Disclosure for the detrimental conduct to be captured by the detrimental conduct provisions.

Examples of detrimental action include:¹¹

• dismissal from employment
• injury of an employee in their employment
• altering a position or duties to the employee’s disadvantage
• discriminating between employees of the same employer
• harassment or intimidation
• harm or injury to a person, including causing psychological harm
• damage to property
• damage to reputation
• damage to a person’s business or financial position
• causing any other damage.

Penalties for non-compliance

It is illegal for companies, employees or officers to cause or threaten detriment to a whistleblower in circumstances where they believe or suspect that the person has made, may have made, or proposes to make a Whistleblower Disclosure.¹² This is made illegal through both criminal offences and civil penalties. The court may also order an employer or the person causing the detriment to the employee to provide compensation.

Relevant conduct	Criminal penalties	Pecuniary penalties
Breach of Confidentiality	For an individual: $19,800 (60 penalty units); or Imprisonment for six months; or Both. For a body corporate: $198,000 (600 penalty units)	For an individual, the greater amount of: $1,650,000 (5,000 penalty units); or Three times the benefit derived, and detriment avoided because of the contravention. For a body corporate, the greatest amount of: $16,500,000 (50,000 penalty units); or Three times the benefit derived, and detriment avoided because of the contravention; or 10% of the annual turnover of the body corporate (up to $825 million – 2.5 million penalty units).
Detrimental conduct	For an individual: $79,200 (240 penalty units); or Imprisonment for two years; or Both. For a body corporate: $792,000 (2,400 penalty units)
Failure to have a compliant whistleblower policy	For an individual: $19,800 (60 penalty units) For a body corporate: $198,000 (600 penalty units)	N/A

Key tips for dealing with a Whistleblower Disclosure

If you receive a potential whistleblower complaint, you should immediately seek legal advice as to whether it is a protected disclosure. We recommend you engage lawyers as soon as possible to conduct a privileged investigation into the complaint.

Here are some best practice tips to help you mitigate risks associated with the Whistleblower Laws in your workplace:

• Do not pass on: It is important not to disclose the identity of the whistleblower or any information that is likely to identify the whistleblower (i.e. their role or work location) to anyone, as this will be a breach of the confidentiality provisions of the Corporations Act. If you need to inform the relevant officers, you should prepare a summary of the key elements of the complaint. It is important to refer to the whistleblower as the ‘discloser’ or ‘whistleblower’ and be careful not to identify them inadvertently.
• Review of whistleblower policies: If a whistleblower policy is currently in place, businesses should review their whistleblower policies to ensure they are following best practice arrangements. In some cases, companies are required to have a whistleblower policy. We recommend you seek legal advice about whether your business is required to have a whistleblower policy in place.
• Training of officers: Businesses should ensure that their staff are appropriately trained on how to deal with a whistleblower complaint when received, which complies with the Company’s whistleblower policy and the Corporations Act.
• Understand the threshold of qualifying disclosures: Ensure all staff understand when a disclosure qualifies for protection under the Corporations Act to avoid unintentional contraventions.

Get in touch

For further guidance and advice on whistleblowing in the workplace, please contact the Hamilton Locke Workplace and Safety team.

---

¹Corporations Act 2001 (Cth) s 1317AAB.

²See s 1317AAA for meaning of ‘eligible whistleblower’.

³Ibid s 1317AA(4)-(5).

⁴Ibid s 1317AA(1).

⁵Ibid s 1317AB(1)(a).

⁶Ibid s 1317AB(1)(b).

⁷Ibid s 1317AB(1)(c).

⁸Ibid s 1317AAD.

⁹Ibid s 1317AAE(2).

¹⁰Ibid s 1317AD(1).

¹¹Ibid s 1317ADA.

¹²Ibid, s 1317AC.