Mandatory Whistleblower Policy deadline 1 January 2020

Organisations should be considering the whistleblower reforms which commence on 1 January 2020. A summary of the key points is set out below. 

Whistleblowers play an important role in revealing injustice, calling out misconduct, fraud, abuse or corruption in corporate, financial and tax sectors. However, while doing the right thing, whistleblowers have previously put their own safety at risk – or, in some cases, their families’ safety - particularly in the private sector where protections are limited.

The new legislation, Treasury Laws Amendment (Enhancing Whistleblower Protection) Act 2019, came into effect on 1 July 2019, bringing important changes to the Corporations Act 2001 to give eligible whistleblowers legal rights and protections. This new regime also requires certain entities to have a whistleblower policy in place from 1 January 2020.

The new regime aims to encourage ethical whistleblowing and discourage illegal, corrupt, fraudulent and other unconscionable conduct, while holding employers accountable for protecting eligible whistleblowers.

What is a whistleblower policy?

A whistleblower policy is a legal document that organisations must make publicly available and easily accessible for all employees and other persons engaged by them. A policy must include information about:

• the protections available to whistleblowers;
• who employees can disclose information to and the process they can follow to do so;
• how the organisation will support whistleblowers and protect them from detriment;
• how the organisation will investigate the information whistleblowers disclose;
• how the organisation will ensure fair treatment of employees who are mentioned in protected disclosures and;
• how policies will be made available to officers and employees.

Which entities require to have a whistleblower policy from 1 January 2020?

• public companies;
• large proprietary companies (characterised by having any two of the following: $50+ million in consolidated revenue; $25+ million or more in consolidated gross assets; or 100+ employees); and
• corporate trustees of APRA-regulated superannuation entities.

Who are the eligible whistleblowers entitled to the protection?

• an officer of a company;
• an employee of a company;
• contractor of a company;
• an employee of a contractor;
• an associate of a company;
• a relative or spouse of the above individuals.

Who can receive disclosure from whistleblowers?

• ASIC, APRA, and other prescribed Commonwealth authorities;
• officers or senior managers of the organisation;
• an auditor or actuary of the organisation; and 
• persons authorised to receive disclosures.

Disclosures to parliamentarians and journalists

The amendments also provide for public interest and emergency disclosures to be made to members of Parliament and to journalists. An emergency disclosure to a parliamentarian or journalist must be based on the whistleblower having reasonable grounds to believe the information disclosed concerns a substantial and imminent danger to the health or safety of one or more persons, or the natural environment. The extent of the information disclosed must be no greater than is necessary to inform the recipient of the substantial and imminent danger.  

A whistleblower will be able to make a public interest disclosure to a journalist or parliamentarian if:

• the whistleblower has previously made a protected disclosure (the first disclosure) to a regulator;
• at least 90 days have passed since the first disclosure was made;
• the whistleblower does not have reasonable grounds to believe that action is being or has been taken to address the matters to which the first disclosure related;
• the whistleblower has reasonable grounds to believe that making a further disclosure to a journalist or MP would be in the public interest;
• the whistleblower has given written notification to the authority that they intend to make a public interest disclosure; 
• the extent of the information disclosed is no greater than necessary to inform the recipient of the misconduct or improper state of affairs to which the first disclosure related.

What protections are available to whistleblowers?

Generally, organisations that receive a whistleblower’s report cannot disclose this information without the whistleblower’s consent. It is illegal for a person to reveal the identity of a whistleblower, or information likely to lead to the identification of whistleblower, outside of these circumstances.

The Corporations Act prohibits (through a criminal offence and civil penalty) someone from causing or threatening detriment to a whistleblower because they believe or suspect that whistleblower has made a whistleblower disclosure.

The Corporations Act protects a whistleblower against certain legal actions related to making the whistleblower disclosure, including:

• criminal prosecution (the disclosure cannot be used against the whistleblower in a prosecution, unless the disclosure is false);
• civil litigation (such as for breach of an employment contract, duty of confidentiality, or other contractual obligation); or
• administrative action (including disciplinary action).

Do SMEs need a whistleblower policy?

Most SMEs won’t be required by ASIC to develop a whistleblower policy, but all companies are required to comply with the new laws and having a policy in place is encouraged, even where not mandatory.

Next steps

The new regime requires the adoption of a robust policy which is well publicised through an organisation, or a thorough analysis of any existing whistleblower procedures. It is likely that these will have to be reworked or replaced in light of the changes.

To protect whistleblowers from harm, companies should ensure that the storage of whistleblowers’ information is secure and complies with privacy laws, so a review of the organisations privacy policy and procedures should be considered at the same time.

Organisations need to address the new whistleblower regime before 1 January 2020 to ensure compliance. If you have any questions or would like assistance drafting a compliant whistleblower policy, please contact me on 07 3224 0261.