On 19 February 2019, the House of Representatives passed the Treasury Laws Amendment (Enhancing Whistleblower Protections) Bill 2018 (the Bill). These amendments will come into force on 1 July 2019.

If you are not particularly interested in the treatment of employment complaints under the Bill, feel free to skip this part and go straight to our highlighted Cheat Sheet at the end of this article. I won't judge.

I assume that those of you left behind are grizzled human resources practitioners who are struggling with two key questions:

  1. Are employment complaints actually captured by the amended whistleblowing protections?
  2. Will whistleblowing laws add to the heavy burdens already placed on me by adverse action laws, and anti-victimisation rights under multiple anti-discrimination, harassment, work health and safety, and workers compensation laws around the country?

The answer to both questions is an exasperated "YES".

It's just not about me

There was a lot of talk and lobbying to exclude employment complaints from the scope of whistleblower protections. The response to this has been a carve out of "personal work-related grievances". I will refer to these as PWGs. The Explanatory Memorandum to the Bill explains that this carve-out is intended to limit the protections for disclosures concerning "solely personal employment related matters," while preserving the protections for disclosures regarding systemic issues or reprisals against a whistleblower.

This is how it works.

The whistleblowing protections cover disclosures of information if the discloser has reasonable grounds to suspect that the information concerns "misconduct" and/or an "improper state of affairs”. The disclosure must be made to certain persons (relevantly for us, senior managers or officers of your organisation). "Misconduct" is defined in the Corporations Act to include "fraud, negligence, default, or breach of duty." An "improper state of affairs" is not defined. The latter term appears to be directed at not just breaches or unlawful conduct, but a broader class of unethical conduct.

You should expect at some stage that a Judge will place some materiality limits as to the scope of these terms and confine the protection to relatively serious complaints, but this remains to be determined and in the meantime employers should take a cautious approach. It is likely to cover allegations of systemic bullying, sexual harassment and discrimination, or significant lapses in work health and safety practices.

Once a protected disclosure of this nature is made to the right person, the "discloser" obtains a number of key benefits, including a right to anonymity, a protection from victimisation, and immunity from certain legal action. These rights are powerful and backed by serious criminal and civil penalties (see our Cheat Sheet).

However, the whistleblower protections will not apply to a disclosure of information to the extent that it concerns a personal work-related grievance of the discloser and does not concern a breach of the victimisation provisions. A PWG is a complaint that concerns a grievance about any matter in relation to the discloser's employment, or former employment, having or tending to have implications for the discloser personally. Good examples of a nice and clean PWG include: "I am not happy with my remuneration", "I shouldn't have been sacked for my streaking at the X-Mas party”, or "My manager has nicknamed me 'Big Fat Greek Holiday'. "

Such complaints are not protected by the enhanced whistleblowing laws because they are all about the discloser's employment.

But complaints are rarely so simple and contained. An employee who has been advised by a seasoned employee advocate is more likely to leverage his or her position by expanding the scope of the complaint so that it has more worrying implications for the employer. These days, an employee is more likely to assert: "My manager treats all ethnic employees poorly and actively punishes them for taking any leave. He refers to me as BFG Holiday. Other senior managers see it, but act like innocent bystanders. This organisation supports a culture of ethnic discrimination and unsafe work practices. Please give me $1 million or I will write a blog."

I am sure that in the clear light of day, someone may examine this complaint, and the surrounding facts, and find that the disclosure is just externalising a personal experience (or more likely, exaggerating). However, it is unlikely that you could make such a call at an early stage of the disclosure. Do you feel lucky in circumstances where you could go to gaol if you leak the discloser's identity?

There is some uncertainty as to how you should deal with a complaint which mixes a personal issue with a complaint that involves other employees or broader systemic issues. The amended laws state that the protections won't apply "to the extent that" the disclosure is a PWG. Does this mean that the identity of the discloser is not protected for the purposes of dealing with a narrow personal part of the complaint and this can be carved out? Or does the fact that the complaint contains broader allegations mean that the entire disclosure is protected? At this time, I would err towards the latter - at least where the allegation contains significant implications for the employer that do not relate to the discloser (this is discussed further below).

What is clear is that a disclosure which is purely about another employee's employment won't be an excluded PWG, but may not be serious enough to constitute "misconduct" or an "improper State of Affairs." So, for example, if my personal assistant complains to a senior manager that management referred to me as a BFG Holiday, she may get the immunity. Even stranger, the PWG exclusion is tied to a disclosure about employment. So if an individual contractor complains about a personal matter regarding his or her engagement, then the PWG exclusion may not apply and they may get protection.

What is clear is that a disclosure is not an excluded PWG if it relates to the victimization of the discloser under the Act. For example: "My manager calls me derogatory names because I complained that he was backdating our sales agreements to avoid tax." As foreshadowed earlier, there are also other important limitations to the PWG exclusion. It won't apply where the disclosure:

a. has significant implications for the employer (or another regulated entity) that do not relate to the discloser; or
b. concerns conduct, or alleged conduct, which
i. constitutes an offence punishable by imprisonment for a period of 12 months or more; or
ii. represents a danger to the public or the financial system; or
iii. constitutes a breach of a smorgasbord of specified legislation (including tax laws).

Examples of employment complaints which are likely to be covered by the protection include the following:

  1. The employer ignores its own policies and regularly turns a blind eye to bullying or harassing behaviour by executive psychopaths, causing multiple employees to become stressed and take sick leave. ​
  2. An employer or contractor engages workers under sham contractor arrangements when they should properly be classed as employees and paid award wages and superannuation contributions.
  3. Management supplies crack cocaine at the Christmas party.
  4. An employer works its construction worker employees long hours without breaks, and mistakes have been made.
  5. The HR Manager has just emailed personal and confidential details of key employees to a competitor. The sales manager has received a bonus and promotion over me only because he regularly charges clients for work he did not perform.

Each of these complaints would be covered by the whistleblower protections either because they give rise to significant issues for the corporation beyond any personal issues confronted by the disclosing employee, or because they contain allegations of potential offences such as offences under WHS laws, criminal conduct, or serious breaches of privacy laws.

The right manager

Leaving aside the actual content of the complaint, it is important to focus briefly on another important condition which must be fulfilled before an employee will secure protected whistleblower status. The disclosure of information must be made to a limited class of individuals.

For our purposes, this includes an officer of a company (such as a director of the Company) or a senior manager. What constitutes a senior manager is defined under the Corporations Act and is a narrower class to what you may expect. Under the Corporations Act, a senior manager is a person (other than a director) who makes or participates in making decisions which affect the whole or a substantial part of the company’s business. It would also include someone who has the capacity to affect significantly the company’s financial standing.

Unfortunately, because most decisions under the Corporations Act have focused on directors, there is not much guidance as to what kind of managers would fall under the legislation. The Courts have traditionally drawn a distinction between those managers who set company policy and strategy and those managers who simply implement policy and strategy. The following elements would tend to suggest that a manager is senior if:

  • the manager sits on an executive or leadership committee;
  • the manager reports to the Board or regularly deals with Board members and participates in their decisions;
  • the manager is responsible for a significant part of the business and controls capital expenditure for that part; and/or
  • the manager has multiple high level managers reporting to them.

It is likely that the definition would include Corporate Counsel. It is also possible that a senior Human Resources Manager could be caught. Human Resources managers more regularly participate on leadership committees or have a seat on the board. Clearly supervisors, line managers, and junior human resources managers are not covered.

In practical terms this means that if an employee raises corporate "misconduct" to a line manager or middle-level human resources manager, the whistleblower protection will not apply and those managers are not bound to keep the identity of the discloser confidential (at least under the Corporations Act). If the employee later escalates the complaint to a senior manager, it is difficult to see how that employee can then rely on the whistleblower protections. For example, if the identity of the discloser is leaked through a source other than a qualifying disclosure, there is no breach of the Act.

Employers should keep an eye out for the regulations though, which may expand the range of persons who may receive complaints.

So what's new?

A lot is new. Human resources practitioners should not underestimate the potential impact of this legislation.

It is correct that employees (and in some instances contract workers) already have powerful rights against victimisation for raising various employment related complaints. The key right is in relation to "adverse action" under section 340 of the Fair Work Act 2009 (Cth). Under this regime, an employee cannot be victimised for exercising certain workplace rights and specifically, for making a complaint or an inquiry in relation to their employment.

For example, were you to ask your employer "aren't you supposed to be paying me overtime?" and your employer were to react by, say, sacking you immediately without pay, you could run an adverse action claim. The adverse action provisions under the Fair Work Act 2009 (Cth) apply a reverse onus of proof. This means that the employer would have to show that they did not sack you for daring to raise a question about overtime.

In an important way, it seems that the amended whistleblower protections may "bookend" adverse action rights. Adverse actions rights principally protect employees who raise PWGs (with an extension in relation to certain actions under workplace laws or instruments), whilst whistleblowing protection rights extend the protections beyond these personal grievances.

There are other differences but also some similarities. Here is a useful table:

Adverse Action vs Whistleblower Protections

The natural reaction of a senior manager who receives an employee complaint would usually be to refer the matter to Human Resources for investigation. Human Resources would then, in turn, discuss the matter with the person about whom the complaint relates, for response and action. This could now get you into a whole lot of hot water. The senior manager can only disclose the identity of the complainant to a narrow cast of characters without the consent of the discloser. This would not include another senior manager or a HR Manager. It would include your lawyer for the purpose of obtaining legal advice or legal representation.Another important distinction is that under the adverse action regime there is no requirement to keep the identity of a complainant confidential (even though limiting this disclosure is often advisable). Adverse action rights focus on victimisation rather than confidentiality. The enhanced whistleblowing provisions prohibit the disclosure of the identity of the complainant, or any information, which is likely to lead to his or her identification.

In fact, if the complaint falls within the whistleblower regime, then your organisation may be blocked from conducting an investigation which could identify the discloser, without the consent of the discloser. There is an exception in the amendments where the identity of the discloser is not disclosed and, in the conduct of the investigation, all reasonable steps are taken to reduce the risk that the discloser be identified. The utility of this defence may be limited. Respondents to an allegation of misconduct will usually request details of the discloser so that they can defend themselves properly. These details could be relevant, especially in relation to issues of credibility. For instance, "Michael is only complaining about me because he is on his third performance warning."

Ultimately, this means that a senior manager or officer who receives a complaint must make a quick assessment as to whether or not it is a protected disclosure. For the various reasons I have set out above, this may not be easy.

Another important requirement is that public companies and large organisations will need to issue and comply with a regulated whistleblower policy. The policy must contain procedures to ensure that whistleblowers are dealt with fairly. These are the types of procedures which we have been stripping out of HR policies for the last 15 years, because they often tend to be inflexible and become a cause of action when not followed. Forthcoming regulations to the whistleblowing amendments are likely to provide further detail on what it means to deal with someone fairly. Joy.

In short, compliance with these new laws will require training and discipline at all levels in how complaints are received, assessed, communicated, and dealt with. The consequences of non-compliance are extremely serious and most organisations will need to invest significant resources and attention to this area.

Good luck all.

Cheat Sheet The Amended Whistleblowing Laws

1. When do they start?

The new whistleblowing laws (the new laws) will commence on 1 July 2019. The new whistleblowing laws will come before the Minister for review five years after commencement.

Once enacted, the new laws will apply to disclosures that are made on or after the commencement date as well as disclosed conduct that occurred prior to this date.

The new laws will require public companies and large proprietary companies (including private companies that are trustees of a registerable superannuation entity) to have a whistleblowing policy implemented by 1 January 2020 (6 months from the commencement date).  

2. Who can be a whistleblower?

To qualify for protection, a 'qualifying disclosure' must be made by an 'eligible whistleblower.' The new laws cast a wide net as to who can be considered an 'eligible whistleblower' including; officers, employees, suppliers, an employee of a supplier, trustees, or an associate of the regulated entity (for example, a director of a related body corporate). People who either previously had these positions or are relatives/dependents of the people listed can also be eligible whistleblowers.

Despite the commencement date, it should be noted that certain provisions of the amended legislation will apply to whistleblowing complaints which were made prior to 1 July 2019 and which would satisfy certain criteria of a qualifying disclosure under the new legislation.  

3. What is a qualifying disclosure?

The new protections apply to disclosures of information which the eligible whistleblower has reasonable grounds to suspect concerns; (1) misconduct or an improper state of affairs relating to the company (or any of its related bodies corporate); (2) a contravention of a law, including the Corporations Act, the ASIC Act or the Banking Act; (3) or an offence which is punishable by imprisonment for a period of 12 months or more; (4) and/or conduct which represents a danger to the public or the financial system.

Qualifying disclosures can be anonymous disclosures and do not need to be in "good faith."

'Personal work-related grievances' are excluded from whistleblowing protections.

4. Who must be the recipient of the disclosure?

For the new protections to apply, a whistleblower must make their qualifying disclosure to an 'eligible recipient' which includes; senior managers, officers, auditors, actuaries, or anyone else authorised by the entity to receive qualifying disclosures. For superannuation entities specifically, this includes trustees, directors of a trustee entity or other persons authorised by the trustee to receive qualifying disclosures.  

5. What protections are whistleblowers afforded?

Legal immunity

Whistleblowers will receive immunity from civil, criminal, and administrative liability (including disciplinary action) when they make a qualifying disclosure. No contractual or other remedy may be enforced against them on the basis of their disclosure.

Interestingly, qualifying disclosures brought forward against the whistleblower themselves, which relates to the alleged conduct, will be inadmissible.


Revealing the whistleblower's identity, or any information which is likely to lead to their identification, will be a criminal and civil offence.

Protection from victimization

Whistleblowers are protected from victimisation under the new laws. Causing 'detriment' to a whistleblower will also constitute a criminal and civil offence.  

6. What is considered a 'detriment'?

The new laws protect a whistleblower from victimizing conduct by prohibiting detrimental conduct. 'Detrimental' conduct is defined broadly and includes: dismissal, a disadvantageous change of position, discrimination, harassment, intimidation, injury (including psychological harm), damage to property, reputation or business, and/or any other damage to the person.  

7. Remedies, penalties, and the employer's defence

The new whistleblowing regime contains reverse onus provisions. The whistleblower bears the evidential onus of demonstrating that there was a reasonable possibility of detrimental conduct. Upon doing so, the onus then shifts to the employer who then must prove that the claim is not made out.

Under the new laws, a person may bring civil proceedings for a compensation order or pursue civil penalties even when a criminal prosecution has not been, or can not be, pursued.


Penalties with respect to breaches of the new whistleblowing laws have also been substantially increased. The penalties in relation to qualifying disclosures will differ depending on the date upon which the conduct occurred.


Who can seek compensation?

A whistleblower can seek compensation from a person ('the victimiser') who causes, or threatens to cause, detriment to them on the basis that the victimiser believed that the whistleblower has or may have made or proposes to make or could make a qualified disclosure. It is enough that one of the victimiser's motives for the detrimental conduct was the disclosure. A person other than the whistleblower who suffers loss as a result of the victimiser's conduct can also seek compensation.  

Who will be liable?

The victimiser may be an individual or a company (including a third party). In the case of a company, liability may extend to the aiding, abetting, counselling, procuring, inducing, or having a knowing concern in the threat of, the detrimental conduct. A Court may also make orders against the employer of the victimiser.  In doing so, the Court may take into account a number of different factors, including whether the employer took reasonable precautions and exercised due diligence to avoid the detrimental conduct occurring and to what extent the employer's whistleblowing policy was implemented and given effect. Where a company breaches these provisions, any officer or employee who is involved in the contravention also is taken to breach the section

What types of compensation orders are available?

Compensation orders may include:  

a)monetary compensation (jointly or severally between the person who causes the detriment and/or the employer); or  

b)an injunction to prevent or stop the detrimental conduct; or  

c)an order requiring the person engaging in the detrimental conduct to apologise; or  

d)reinstatement of a terminated employee; or  

e)an order requiring the first person to pay exemplary damages; or  

f)any other order the Court may think appropriate.

8.What is a qualifying disclosure?

All public companies, 'large proprietary companies', and proprietary companies that are a trustee of a registerable superannuation entity are required to implement a whistleblowing policy. Failure to implement a compliant policy is an offence under the new laws.

A 'large proprietary company' is defined in the Corporations Act and from 1 July 2019 will include  a company which meets two of the following criteria:  

a)has consolidated revenue of $50m or more;  

b)has gross assets of $25m or more; or  

c)the company and any entities it controls have 100 or more employees.

9.What is a qualifying disclosure?

An organisation's whistleblowing policy must contain information about:  

a)monetary compensation (jointly or severally between the person who causes the detriment and/or the employer); or  

b)how and to whom an individual can make a disclosure;  

c)how the company will support and protect whistleblowers;  

d)how investigations into a disclosure will proceed. Companies will need to ensure that this is consistent with any existing investigation procedures and the way in which the company conducts its investigations in practice;  

e)how the company will ensure fair treatment of employees who are mentioned in whistleblower disclosures; and  

f)how the policy will be made available.