Chapter 8

Internal, regulatory, and external reporting channels

8.1 This chapter discusses the committee's consideration of public and private sector legislation against the best practice criteria for internal, regulatory, and external disclosures. Disclosures to Members of Parliament are not part of the best practice criteria and are discussed in the next chapter.

8.2 One of the simplest ways of describing the various reporting channels is to classify them into a tiered reporting system. However, the terminology used to describe the tiers has the potential to create confusion if not clearly defined. The definitions used in this report are those that align with best practice principles. While the arguments in favour of the principles are set out in the subsequent paragraph by Professor A J Brown, at this juncture it is useful to define the three tiers of the classification system described below:

internal disclosure refers to reporting within an organisation;
regulatory disclosure refers to reporting to a regulator (regulatory disclosure is not treated as an external disclosure under this classification system); and
external disclosure refers to reports made to third parties such as the media, non-government organisations, and labour unions.

8.3 Professor Brown argued that research and best practice legislative design principles indicate that a disclosure regime should include three tiers:

Internal disclosures, where safe and appropriate (including disclosures to whistleblowing services, e.g. hotlines contracted by the organisation; or disclosures to the board or audit committee);
Regulatory disclosures...wherever a competent regulator exists to receive and deal with the disclosure, and an internal disclosure was
(i) unsafe/unviable, (ii) inappropriate because the organisation was unlikely to act on the matter, or likely to do worse, e.g. destroy evidence or victimise others, or (iii) made but did not lead to satisfactory action;
Third party (including media) disclosures where (i) neither internal or regulatory disclosure channels were available or safe, or (ii) an internal or...regulatory disclosure was made, which did not lead to satisfactory action; or (iii) some emergency circumstances exist to justify a disclosure to third parties or the media, without first making either an internal or regulatory disclosure.[1]

8.4 The best practice criteria in the Breaking the Silence report suggests that a three-tiered disclosure system should include clear external disclosure channels for whistleblowers to contact the media, Members of Parliament, non-government organisations and labour unions where necessary. The report also noted many G20 countries fall short on this criterion.[2]

8.5 Evidence to this inquiry was strongly in favour of whistleblower protections being made consistently available across the public, private and not-for-profit sectors for the first two tiers, namely internal and regulatory disclosures. However, different views were expressed about whether whistleblower protections should apply to external disclosures made to third parties such as the media. This evidence is discussed after the section below which sets out the current legislative framework.

Reporting channels in current legislation

8.6 This section compares current legislation against the best practice criteria on internal, regulatory and external disclosures. Table 8.1 below compares the PID Act, the FWRO Act, and the Corporations Act across three elements of a tiered system of disclosure that provides for internal, regulatory and external reporting channels.

Table 8.1: Internal, regulatory, and external reporting channels

Disclosure / Reporting Channels	PID Act Section 26	FWRO Act Subsection 337A(1b)	Corporations Act Subsection 1317AA(1b)
Internal	To a supervisor or an authorised internal recipient	No protection	The company's auditors. A director, secretary or senior manager of the company. A person authorised by the company to receive disclosures.
Regulatory	The agency that the disclosable conduct relates to, or the agency the discloser belongs to. The Commonwealth Ombudsman if the discloser has reasonable grounds. An investigative agency. IGIS.	The Registered Organisations Commission. The Fair Work Commission. The Australian Building and Construction Commissioner. An Australian Building and Construction Inspector. The Fair Work Ombudsman.	ASIC
External	To any person other than a foreign public official, (subject to criteria).	No protection	No protection

Sources: PID Act, FWRO Act, Corporations Act.

Internal disclosures

8.7 The committee observes that one of the main differences in terms of best practice criteria across the three Acts is the silence of the FWRO Act on internal disclosures within registered organisations. The committee notes that prior to the December 2016 amendments, the FWRO Act was also silent on internal disclosures within registered organisations.[3]

8.8 The ACTU considered that protection should be available to persons from the moment they make a disclosure internally (if they choose to do so). It should not be necessary to make a formal complaint, either to a regulator or externally, in order to trigger whistleblower protections.[4]

Committee view

8.9 The committee considers that the lack of protection for disclosures within registered organisations is a significant gap in the legislation when compared to the best practice criteria and other legislation including the PID Act and the Corporations Act. Such a gap should be rectified. The committee suggests that, regardless of whether a single private sector whistleblower protection Act is implemented, internal disclosers within registered organisations should be provided with protection.

Recommendation 8.1

8.10 The committee recommends that whistleblower protections be extended to internal disclosures within the private sector, to include:

any person within the management chain for the whistleblower within the whistleblower's employer;
any current officer of the company, or that company's Australian or ultimate parent; and
any person specified in a policy published and distributed by an employer (or principal) of the whistleblower.

Regulatory disclosures

8.11 As noted earlier, there was broad support for the consistent extension of protections for regulatory disclosures across the private sector. While most submitters and witnesses agreed that it would be preferable to encourage internal reporting in the first instance, it was generally recognised that providing protection for regulatory disclosures would have the additional benefit of incentivising organisations in the private sector to ensure their internal reporting procedures and practices were best practice.

8.12 KPMG suggested that while the whistleblower system should encourage the use of internal reporting mechanisms, it is appropriate for whistleblowers to be able to disclose direct to the regulator. KPMG also supported a tiered system and argued that it would:

allow disclosure to wider classes of people in extenuating circumstances, or if the initial disclosure has not been acted upon;
provide greater incentive for Australian corporates to act quickly and decisively on internal reports, if they know that wider disclosure can be made; and
allow whistleblowers to report to the company's external hotline (if there is one in place), followed by, if necessary, the relevant external authority.[5]

8.13 The AICD supported whistleblowers being able to disclose to a regulator at the same time as, or before, disclosing to a company. However, the AICD considered that if wrongdoing is to be disclosed to third parties, it should only be in the context of serious wrongdoing. The AICD also noted that a well-functioning tiered system of disclosure will assist in ensuring that minor matters, including those solely related to employment grievances, are not inappropriately disclosed to third parties.[6]

8.14 The IBACC indicated that while it favours a corporate whistleblower making a disclosure internally within a company in the first instance, any whistleblower should not be excluded from a right to make a disclosure externally to any relevant government agency (if the allegations concern criminal conduct or contravention of a law) before, at the same time as, or after, any internal disclosure.[7]

Committee view

8.15 The bulk of the evidence put to the committee supported extending protections consistently across the private sector for regulatory disclosures. Furthermore, many submitters and witnesses were of the view that consistent whistleblower protections for regulatory disclosures would act as an additional incentive for organisations in the private and not-for-profit sectors to ensure that their internal reporting procedures and practices met best-practice criteria as a means of encouraging internal reporting.

8.16 The committee recognises that there are currently no protections available under the FWRO Act or Corporations Act for whistleblowers who make disclosures to immediate supervisors or line managers, except in specific circumstances (i.e. the supervisor is a director, auditor, senior manager, etc.). A Whistleblowing Protection Act should make it explicit that internal disclosures within the private sector can be made to any person within the management chain. Further, disclosures should be protected where they are made to any officer within the whistleblower's employing company or its Australian or ultimate parent company.

8.17 Recognising that the three Acts currently appear to provide for disclosures to regulators, the committee supports retaining and extending regulatory disclosures to the private sector more generally.

8.18 The committee also notes that the existence of private sector regulators with investigative powers makes regulatory disclosure more feasible in the private sector than the public sector. As discussed in Chapter 12, there are limitations on the ability of the Commonwealth Ombudsman to conduct substantive investigations into disclosures and alleged reprisals against whistleblowers that have occurred in Commonwealth public sector departments and agencies.

Recommendation 8.2

8.19 The committee recommends that a Whistleblowing Protection Act should provide consistent whistleblower protections for regulatory disclosures from the public and private sectors.

Disclosures to Australian Law Enforcement Agencies

Recommendation 8.3

8.20 The committee recommends that where a whistleblower discloses a protected matter to an Australian law enforcement agency, that agency must provide regular updates to the whistleblower as to whether or not it is pursuing the matter, including where it transfers the matter to another law enforcement agency, in which case obligations to keep the whistleblower informed are transferred to that agency. However, nothing that would prejudice an investigation is required to be disclosed.

Recommendation 8.4

8.21 The committee recommends that Australian law enforcement agencies should be required to pass on whistleblower disclosures to whichever appropriate agency is to progress the disclosure. The whistleblower does not need to do this, if they have complied with the disclosure requirements of the Act.

External disclosures

8.22 The other significant observation from Table 8.1 is that there is no protection for external disclosures under the FWRO Act and the Corporations Act.

8.23 Research indicates that there are major differences between organisations in the public, private, and not-for-profit sectors when it comes to awareness of external reporting options:

external ombudsmen, integrity or regulatory agencies were identified as an available reporting channel by:
94.7 per cent of public sector organisations;
55.7 per cent of not-for-profits; and
44.7 per cent of private business;
media and journalists were identified as available 'if necessary' by:
23.8 per cent of public sector organisations;
5.2 per cent of not-for-profits; and
4.0 per cent of private business.[8]

8.24 The remainder of this section examines the evidence received by the committee on external disclosures.

8.25 Professor Brown argued that any system of whistleblower protections should maximise the ability of whistleblowers to make internal disclosures in the first instance, followed by the ability to make a regulatory disclosure. However, he was of the view that in circumstances where it is reasonable to go to the media, then those disclosures should also attract protection.[9]

8.26 The Law Council submitted that whistleblower protections should only apply to disclosures made to entities that have 'an obligation to treat that information confidentially'. The Law Council was of the view that 'information disclosed by whistleblowers in an emergency should be to the relevant regulator or an oversight agency'.[10]

8.27 The Law Council did not support extending whistleblower protections to external disclosures made to third parties including the media:

...the Law Council does not consider that the whistleblower protections should be available to whistleblowers who disclose information to third parties such as the media or Members of Parliament. There are few controls imposed or enforced in relation to the ways in which the media use information provided by the public...there is no obligation on the part of the media to maintain confidentiality and protect the whistleblower's identity. Nor can the media protect the whistleblower from any retaliation which may arise as a result of the media's portrayal of the information disclosed. Further, the media does not have a duty to remain impartial or ensure the information is credible and substantiated before publicising it.[11]

8.28 The GIA suggested that legislation should not provide protection for an employee disclosing to the media:

We are of the view that disclosures to the media should not be legally sanctioned in legislation, as the media has no legal powers to investigate but does have the capacity to express an opinion on a matter that has not yet been tested. Disclosure to the media and media opinion on the matter could also prejudice an ongoing investigation.[12]

8.29 By contrast, the Australian Lawyers Alliance submitted that if the discloser has a well-founded concern that their disclosure will not be acted on with sufficient urgency, which might arise where the disclosure relates to the activities of the individual or department that would be receiving the complaint, for example, it may be unreasonable to require internal disclosure before external disclosure can be permitted.[13]

8.30 The Ethics Centre argued that in circumstances where an employer fails to make it safe and reasonable for an employee to report wrongdoing using internal mechanisms, it should be allowable for an employee to make a disclosure to an external party, especially if the whistleblower reasonably believes that:

there is a risk to safety or wellbeing;
the relevant conduct is criminal in nature; and
the report is made to a third party that acts for the public interest.[14]

8.31 The Community and Public Sector Union submitted that external public disclosure should only occur in particular circumstances, including that the alleged misconduct is serious and that internal avenues have been exhausted.[15]

Criteria for external disclosures

8.32 As noted above, of the three Acts, only the PID Act explicitly provides protections for external disclosures. The PID Act includes the following criteria for external disclosures:

The information tends to show, or the discloser believes on reasonable grounds that the information tends to show, one or more instances of disclosable conduct.
On a previous occasion, the discloser made an internal disclosure of information that consisted of, or included, the information now disclosed.
Any of the following apply:
1. a disclosure investigation relating to the internal disclosure was conducted under Part 3, and the discloser believes on reasonable grounds that the investigation was inadequate;
2. a disclosure investigation relating to the internal disclosure was conducted (whether or not under Part 3), and the discloser believes on reasonable grounds that the response to the investigation was inadequate;
3. this Act requires an investigation relating to the internal disclosure to be conducted under Part 3, and that investigation has not been completed within the time limit under section 52.
The disclosure is not, on balance, contrary to the public interest.
No more information is publicly disclosed than is reasonably necessary to identify one or more instances of disclosable conduct.
The information does not consist of, or include, intelligence information.
None of the conduct with which the disclosure is concerned relates to an intelligence agency.[16]

8.33 Professor Brown was of the view that the current provisions in the PID Act regarding external disclosure were 'fairly subjective'. He therefore suggested that, in order to ensure greater clarity for whistleblowers, the test should be 'refined' if it was going to be applied to the private sector.[17]

8.34 Young Liberty Victoria noted that the PID Act requires a whistleblower to be satisfied that an external disclosure is in the public interest having regard to a lengthy list of factors that must be considered and weighed against each other. Young Liberty Victoria suggested that such provisions should be repealed and argued that these requirements for making an external disclosure are highly complex and create a significant and disproportionate barrier to public disclosure.[18]

8.35 In its consideration of external disclosures, the Moss Review noted that submissions and online survey responses criticised the external emergency disclosure criteria as confusing and hard to apply in practice. However, there being only a few occasions in which disclosers had sought the protections of the PID Act for external disclosures, it was not possible for the Moss Review to draw firm conclusions about the success of the provisions. The Moss Review went on to recommend:

That the external and emergency disclosure provisions be considered in a future review of the PID Act, when further evidence about how they are being used is available.

That the PID Act be amended to include situations when an Authorised Officer failed to allocate an internal PID, or a supervisor failed to report information they received about disclosable conduct to an Authorised Officer, as grounds for external disclosure.[19]

Committee view

8.36 In reviewing external disclosures and reporting channels, the key questions for the committee were:

whether the PID Act criteria for external disclosures are appropriate and effective; and
what criteria should apply if protections were to be extended to external disclosures in the private sector.

8.37 While recognising the limited examples of external disclosures under the PID Act as identified by the Moss Review, the committee supports the Moss Review recommendation to include a more objective test for the grounds for external disclosures under the PID Act.

8.38 The committee notes the Moss Review recommendation that consideration of other changes be deferred until more data is available. However, the committee is mindful that the complexity of the provisions may be inhibiting external disclosures and, by extension, the further data that would be relied on for any future consideration of external disclosure may not be forthcoming.

8.39 The committee considers the lack of protections for external reporting in the private sector to be a significant gap in the whistleblower protection legislation. Nevertheless, the committee considers that it would be prudent to begin with a cautious approach, including appropriate checks and balances. Once data is available on the operation of the criteria for external reporting provisions, then it may be appropriate to consider whether there is scope for relaxing some of the criteria.

8.40 A Whistleblower Protection Act should maximize the ability of a whistleblower to, in the first instance, make an internal disclosure and then a regulatory disclosure. Failing this, a disclosure should be made to an authorised external recipient. However, in instances where it is reasonable to make a public third party disclosure (i.e. to the media), protection should be afforded to the whistleblower.

8.41 The committee considers that the instances where it may be reasonable to make a third party disclosure are limited to situations where:

there is a risk of serious harm or death; or
a disclosure in the public interest has been made to an Australian law enforcement agency and, after a reasonable length of time, no action has been taken by the agency.

8.42 Noting that it supports the Moss Review in recommending a more objective test for external disclosures under the PID Act, the committee considers that, in order to provide consistency for whistleblowers and businesses, the external disclosure provisions across the private sector should be aligned with the PID Act, except for the provisions relating to intelligence functions.

Recommendation 8.5

8.43 The committee recommends that the existing whistleblower protections for external disclosures in the Public Interest Disclosure Act 2013 be simplified (including a more objective test) and extended to disclosures to a registered organisation, a federal Member of Parliament or their office, and be included in a Whistleblowing Protection Act, except the provisions relating to intelligence functions which should continue to apply to the public sector only.

Recommendation 8.6

8.44 The committee recommends that if a disclosure of disclosable conduct has been made to an Australian law enforcement agency and after a reasonable time, no steps have been taken by that or any other agency (excluding where the whistleblower has elected to make an anonymous disclosure) whistleblowing protections shall apply if the same disclosure is subsequently made to the media if they have complied with the disclosure requirements of the Act.

Navigation: Previous Page | Contents | Next Page