Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Parliamentary Joint Committee on Corporations and Financial Services
23/02/2017
Whistleblower protections in the corporate, public and not-for-profit sectors

BROWN, Professor AJ, Program Leader, Public Integrity and Anti Corruption, Centre for Governance and Public Policy, Griffith University

DOZO, Dr Nerisa, Survey and Business Manager, Centre for Governance and Public Policy, Griffith University

HALL, Associate Professor Kath, Deputy Director (Law), Transnational Research Institute on Corruption, Australian National University

LAWRENCE, Dr Sandra, Research Fellow, Centre for Governance and Public Policy, Griffith University

[10:48]

CHAIR: Welcome back to this hearing on whistleblowing. The committee welcomes Professor AJ Brown and colleagues, who have made submission 23. I just note that we may have members of the media present today. The committee has authorised photography and the filming of these proceedings. However, before we start, do any of the witnesses or committee members have an objection to be filmed or photographed? Everyone is okay with that—thank you. I remind committee members and witnesses that while this is a public hearing, care should be taken to protect the privacy of individuals and that arguments should be made without naming individuals. I now invite you to make a short opening statement. At the conclusion of your remarks, I will invite members of the committee to put questions to you.

Prof. Brown : It is a great pleasure to be here today and thank you for the invitation, especially because this is the first hearing of what is a very historic inquiry. I think it is particularly appropriate for many of the reasons that Mr Whitton introduced you to that the committee is sitting in Brisbane for its first hearing, given that Queensland was the first state in which whistleblower protection legislation was first mooted, drafted and introduced in the wake of the Fitzgerald inquiry many years ago. It is also obviously the home base for Griffith University and for the research project that we are running, Whistling While They Work 2. It is very kind of the committee to accommodate my colleagues.

I will just explain that Associate Professor Hall has a corporate law background in private practice, as well as in international anticorruption law and is a member of the research team of the Whistling While They Work 2 project. I am fortunate enough to be in charge of the project. My colleague here, Dr Dozo, is the survey manager for the project, overseeing our data collection, and Dr Lawrence is the senior research fellow who is running much of the analysis of this particular project.

Some of the background to this particular research project is in the submission. We did want to emphasise that we would like to do everything we can to assist the inquiry because of the fact that it is such a large-scale project and because the research that we doing into whistleblowing in Australia at the moment is the first systematic study of how whistleblowing is handled within organisations not just in the public sector but in the private and not-for-profit sectors. It is the first systematic study of its kind anywhere in the world. The study also includes New Zealand. As you will have seen, many of our partner organisations and supporter organisations to the project include many of the key regulatory and non-government stakeholders that have a very strong interest in seeing the parliament legislate promptly but also very wisely on this very important issue.

To that end, I just wanted to make a couple of remarks just mainly addressing terms of reference A, B and C, if I may, which go towards the scope and the starting points for the inquiry. I have provided you with some background of previous submissions on this and also some key preliminary data from our research project in attachment four in our submission. I think you have copies of this or the secretary can give you copies of this. It has some of the key data that we are most likely to refer in response to some questions, particularly about the scope of the inquiry.

It is important to recognise that your inquiry has a huge scope. The public sector whistleblower protection field in legislative terms, as you are already aware, is not a greenfield site. There is a lot of history at the state and federal level and a lot of existing law. Amongst the research that we have given you as background are some international comparisons of the state of public sector whistleblowing protection law in Australia—which is slide two of attachment four and slide three of attachment four—and the private sector and not-for-profit side, which is slide four that attachment four.

If you just simply look at that broad overview of the state of the comprehensiveness of legislation, it will be pretty clear to you—I think you probably already well understand this—that it is in the area of the private sector and not-for-profit sector that there are the huge gaps for Australia. Certainly, that is the territory in which a lot of legislative action and a lot of large-scale policy decisions are really needed, which have been waiting a long time compared to the public sector. That is not to say that I do not think there are not really important recommendations that could be made about improving the public sector legislative regimes at a federal level and hopefully trickling down to the states, which are quite a mixed bag. It is fairly clear that it is the corporate, the private and the not-for-profit sectors where the big opportunity is to really address strategically when it comes to whistleblower protection approaches.

The second thing I would like to say is that there is a new historic starting point in terms of dealing with many of the key legislative design issues, which are some of the things that were achieved with the Fair Work (Registered Organisations) Act that was passed in November. I am happy to spell out my take on which of those are really significant precedents, but my understanding is that the government has already committed to basically legislating for the private and not-for-profit sectors, at least at that standard of some of those significant improvements. Then we would come back to the public sector, presumably. But the fact that we have that starting point means that some of the debates that have been going around for years about key aspects of legislative design, good faith tests and whatever can now be short-circuited and brought to a conclusion rapidly. After the years of debate that have been going on around some of these issues, that is in the public interest. I am happy to elaborate on what was significant about those amendments. Of course, I should disclose that I was consulted by Senator Xenophon and by the government during that process. That is not to say that I take any responsibility whatsoever or think that some of those things cannot be improved upon. The committee is in an advantageous position by actually already knowing that there is policy movement from the government on some of those very significant issues.

The third and fourth things that I would like to emphasise are these. One of the most important choices for the committee and for the government and the parliament is whether you are thinking about whistleblower protection reform for the corporate and private sectors in a piecemeal sense or in a comprehensive sense or a wholescale sense. The reason for this is front and centre because of the fact that so far for the corporate and private sectors there is a bit of piecemeal whistle blower protection law. There is a bit in the Banking Act, there is a bit in the Life Insurance Act and there is stuff in the Corporations Act, which applies right across the board but very limited, and the government has already committed to move on protection of taxation whistleblowers. This raises the question of whether we want to go down the path of having our whistleblower protection provisions located in multiple pieces of Commonwealth regulatory legislation and affecting business in that way or whether we want to go down the track of something more holistic and overarching? We have evidence now, I think, for the first time that in my mind confirms that, from a business point of view, the logical path is a comprehensive overarching approach rather than a piece-by-piece, regulatory silo approach. I am happy to point to some of the results we already have that relate to that.

The other key issue is for the committee to reach a view very early on how it sees the relationship between the public sector rules and the private sector rules. The reason I want to emphasise this at the outset is that in the course of last year, the government's initial policy positions on what type of law is needed in the private sector have used the language of harmonisation of the private sector whistleblowing requirements and harmonisation with the Commonwealth's public sector Public Interest Disclosure Act regime. The term 'harmonisation' has been used in some of the government commitments through the Open Government National Action Plan, for example, and I think it is used in the discussion paper that Minister O'Dwyer put out that Treasury prepared on tax and corporate whistleblowing.

We just have to be really clear at the beginning that harmonisation with the Commonwealth's Public Interest Disclosure Act as it stands is highly unlikely to be a workable solution. That is not to say that there are not really important principles across the board that should not be common and in harmony but that many of the mechanics and the options and the realities of how it should roll out need to operate from a fit-for-purpose model. So I think everyone will be looking to the committee, and certainly we are hoping to produce research which will help answer this question: what will fit-for-purpose regulation really look like? I am sure that that will be a much more constructive path than any assumptions that anything can just be rolled over from the public sector to the private sector in that sort of way. Certainly even our preliminary research is confirming that this is an area where action is very much needed. If both government institutions and private sector institutions are to live up to their own commitments of how they say they would like to treat public interest whistleblowers, certainly there is plenty of data that we can point to that confirms that quite serious and comprehensive legislative action is needed to help bring that about.

We are very happy to take questions. I know that, in particular, Associate Professor Hall is very ready to answer questions as well.

Ms BUTLER: If we were to extend a broad-based corporate whistleblowing protection, how would that interact, for big companies, with stock exchange rules in respect of disclosure to the market of things that could adversely affect share value? I know it is a really big question. I am sorry.

Prof. Hall : I think the starting point is that, for listed companies, I believe there should be a requirement, firstly, to have in place processes and disclose under the current ASX principles and recommendations. Because there is no obligation for disclosure under those rules, the follow-on requirements for disclosure do not seem to exist. So that is a starting point, and that has to be quite comprehensive; it cannot be just publishing that you have in place a process. I believe it needs to be the three things: having protections in place, disclosing those protections and then following up on any investigations.

Ms BUTLER: So you would see it as an annual, perhaps, obligation to publish or disclosure aggregated data about the whistleblowing processes?

Prof. Hall : As part of the ASX guidelines, principles and recommendations, which is where companies' obligations to disclose would be. The obligation is either to comply or to explain, and it is under that framework, which is a very well regarded and, in my opinion, quite effective framework. At the moment there is a reference to the requirement to have in place whistleblowing processes, but it is very light.

Ms BUTLER: Is that in the ASX listing rules?

Prof. Hall : No. The ASX principles and guidelines are issued by the ASX Corporate Governance Council, and they are good governance principles and recommendations. They are a soft law instrument, but increasingly companies are required to comply or explain why they do not have those good governance frameworks in place. The principles and recommendations require companies to report on a whole range of things in their annual report, so most companies would issue a separate report against a whole range of factors, including risk management, gender diversity, good governance and a whole range of things.

Ms BUTLER: To follow on from my question, if we were to encourage a much stronger pro-disclosure culture in this country, you would hope that that would then result in many more disclosures being made to senior management internally within large companies about possible wrongdoing, whether it is bribery and corruption or more mundane things like bullying or internal workplace issues. Is that going to then increase the obligations on companies to disclose those specific allegations to the market? Is there any risk that you are going to be given a bribery disclosure? I gave an example before of a big resources company having an allegation of bribing a foreign government. That is disclosed internally. Is there any risk that, before you can even ascertain whether that is likely to be true, you are then going to have an obligation to disclose that?

Prof. Hall : That does not currently exist. What would be required is a disclosure usually at the point of investigation, so at the point of formal external investigation by a regulator or the AFP. But at the moment there is no obligation to disclose an internal investigation. It is at the point where it might affect the share price—the market.

Ms BUTLER: So you would then want to encourage genuine internal disclosure rather than disclosure to regulators as a first point so that firms are not having to suddenly disclose investigations that might actually have no merit at all but would affect shareholder value just from the fact of the investigation happening?

Prof. Hall : In the whistleblower context, absolutely. In the bribery and corruption context, where those allegations are of a very serious nature and involve overseas parties, it may be appropriate to disclose to the AFP, but I think that is a very separate issue. At the moment, we are talking about whistleblower regulation and bribery and corruption are only one of the possible areas.

CHAIR: To clarify that point: if the company is accused of bribing a foreign government, whether it be bribery, a donation or whatever it is called, and this is normal practice within that country or within their laws, how can that company be prosecuted?

Prof. Hall : Under our law, which is the foreign bribery provisions of the Commonwealth Criminal Code, there used to be an exception where if that practice were legal—and 'legal' was broadly defined—in that jurisdiction then the company was not liable for engaging in that action. That was removed after the AWB inquiry, but it was actually one of the main reasons why AWB did not face any prosecution in that context. The payments to the Iraqi government were technically legal. That does not exist anymore. The only defence that a company will have is if it can argue it is a facilitation payment, which is nothing to do with whether it is legal in the country.

CHAIR: Could it be perceived as a restriction of trade? If you are trading in a country where that type of activity is acceptable and you are put in a negative position because you cannot compete on a level playing ground in that country, that could be a restriction of trade.

Prof. Hall : Not only the best-practice position but the position increasingly under the global regulation of antibribery is that, because it is extraterritorial jurisdiction, it is about the standards that apply in Australia, and under our legislation it is not a permissible defence that that behaviour was common or required in an overseas jurisdiction.

CHAIR: Okay.

Mr KEOGH: To follow on from Ms Butler's question: I think what you are saying is that, whilst there is an obligation under the ASX rules to disclose anything that might have a material effect on value, the exception for information that is suppositional or insufficiently defined would mean that the mere raising of an internal whistleblowing complaint would mean that it does not have to be disclosed. In your view, does the operation of part 3 of the rules mean that it is almost in the company's interest not to investigate a whistleblowing matter so that it never forms a firm view?

Prof. Hall : My opinion is that the requirement to investigate has to sit elsewhere and there has to be a clear requirement on listed companies to investigate. The disclosure would only be required—

Mr KEOGH: My question was: do you think that the operation of part 3 as it currently is effectively incentivises a company not to investigate because there is no current positive obligation to investigate?

Prof. Hall : In the absence of a positive obligation.

Mr KEOGH: Do you think that, whilst it might not be in the remit of the parliament directly, the listing rules are the way to deal with that or do you think it should actually be a statutory obligation?

Prof. Hall : To investigate?

Mr KEOGH: Yes.

Prof. Hall : My own view is that it is a very large imposition on all companies in Australia to investigate, because, as we know, the vast majority of companies in Australia are actually small companies. My view is that legislation should require all companies to have in place processes to deal with whistleblowers—both to report and to protect—but then, in my opinion, the requirement to disclose and investigate should be under the listing rules and so should be on listed companies.

Senator WILLIAMS: Professor Brown, in your 'conclusions and actions' you say, 'and the United States, which has the most comprehensive protections but which are notorious for multiplicity, inefficiency and fragmentation with attendant costs on business'. Could you translate that for me please? 'Notorious for multiplicity' I understand, 'inefficiency and fragmentation', meaning a splitting up of it, but 'with attendant costs on business'? What are you saying?

Prof. Brown : The situation in the United States is—

Senator WILLIAMS: The reason I ask—sorry for interrupting—is that I have the opinion that the United States has pretty good whistleblowing laws, and it is financially beneficial to someone to blow the whistle, whereas in Australia many of their lives and their professions are destroyed. So please explain what is wrong with this system in America.

Prof. Brown : Certainly. I think you have to separate those two issues. In the United States at a federal level, whistleblower protection rules are located in at least 47 different pieces of regulatory legislation. This is the fragmentation and the duplication that are the road that we do not need to go down in Australia.

Senator WILLIAMS: So you are saying—just take us along slowly—that in Australia we need one set of rules to cover everything including all the jurisdictions countrywide?

Prof. Brown : From a business regulatory point of view, we are in a position where we can do that, whereas the United States cannot because there is no federal employment law governing business in effect in the United States. However, obviously in Australia, especially since Work Choices and under the current Fair Work type regime that we enjoy, it means that the Commonwealth is in a position to legislate comprehensively for all corporations and all employers who are corporations and employees of corporations.

Senator WILLIAMS: The Corporations Act, yes.

Prof. Brown : Even though there might be merits to particular aspects of how whistleblower protection rules work in the United States that are worth adhering to or copying if we have not already copied them, that broad question—

Senator WILLIAMS: I think 'nicking them' is the term that was used.

Prof. Brown : Yes, I think it was used before. That broad question of whether we need to go down the US route I think is one that we need to answer while we are still a relatively greenfield site in Australia when it comes to how this is approached for business; otherwise, the default is that we will end up with rules in 47 different pieces of legislation. But that is a separate question from other aspects of how some aspects of US whistleblower protection law work either for the public sector or in terms of bounties and rewards and incentives type regimes. That is a separate question that has a different place in the legislative design landscape, I guess.

Senator WILLIAMS: You also say in your part 3:

G20 cooperation for more comprehensive whistleblowing protection should focus on the three areas of greatest … challenge …

a. clear rules for when whistleblowing to the media or other third parties …

Would you like to expand on 'when whistleblowing to the media' please?

Prof. Brown : Yes, certainly. This is part of your terms of reference, obviously. Mr Whitton referred before to the current state of public sector whistleblower protection law. I will just refer you to slide 3 in that attachment 4, which gives a table which is a bit of a breakdown of public sector legislation in Australia. It is actually listed by the date of the most recent reform.

Mr KEOGH: What does 'not known to work' mean?

Prof. Brown : We might come back to that. It means that there is no evidence to confirm that the provisions in that category are actually being effective or achieving their intended purpose.

Mr KEOGH: That lack of evidence, though, just could be because you do not have any evidence—

Prof. Brown : That is right.

Mr KEOGH: not because you have evidence of a failure?

Prof. Brown : That is right. But the—

Mr FALINSKI: In the one where you have evidence, you have a question mark after it.

Prof. Brown : That is right, yes. I am happy to elaborate on that.

Mr FALINSKI: No, sorry.

Prof. Brown : If we stick with Senator Williams's question for the moment—

Senator WILLIAMS: That is a good idea!

Prof. Brown : then the second category, public disclosure, gives you a snapshot of which public sector regimes—and indeed the Corporations Act is included on this table at the bottom as well. It gives you an idea that different jurisdictions have put in place rules in their whistleblower protection legislation to recognise that it is legitimate for public interest whistleblowers to go public in a different variety of circumstances with different tests applying in different jurisdictions and with the Northern Territory, Tasmania, Victoria and South Australia still very recently undergoing reform or continuing to not deal with that question at all, just leaving whistleblowing as something which is recognised and attracts protections if it is done internally or to integrity agencies or to regulators, in effect.

You will see in many submissions that you are receiving now from private sector stakeholders that there is recognition of the reality that whistleblowers do end up going public in the public interest right across the board, whether it is private sector or public sector. But there is an enormous debate to be had about what the circumstances should be in which that should attract or retain legal protection. That is an extension of the debate that has been happening for the public sector regimes. You can just see from this table and that column that there is no universal answer that has been arrived at in terms of our own public sector legislation on what those rules should be for third-party or media disclosure.

Senator WILLIAMS: You can have a whistleblower where it is defamation, basically, so you draw a fine line so the whistleblower is protected, but you have not seen that around the world?

Prof. Brown : There are precedents, especially in the UK, in terms of having quite systematic thresholds like some of the state legislation for saying, 'In these circumstances, it's reasonable for a person to have gone public because the matter wasn't properly investigated or resolved, because there was no safe reporting channel internally or because the regulator didn't act.' In my view, there need to be circumstances where the protections are either attracted or retained by a whistleblower who goes public, and I think that is what the average member of the public would expect. But the question of what those thresholds should be is very important.

I prioritise that as being one of the three big issues for making any whistleblower protection regime work, not only because that is what the public expect and that is what justice would suggest is required but because it is the recognition of that that actually is a fundamental incentive for organisations and regulators to get their internal and regulatory whistleblowing systems right. There are some very useful quotations I can give you, both in the public sector and the private sector, where companies go: 'If it's recognised that somebody is entitled to go public and will be protected in justifiable, reasonable circumstances, then what better incentive is there for us to get our house in order in terms of our own procedures? We would rather people come to us than go to the media.'

Senator WILLIAMS: That is the point.

Prof. Brown : Wise organisations and private sector employers are already operating on that principle. It is one of the most important drivers for them to try to have good internal processes and procedures for all the right reasons, both doing the right thing by the organisation and managing the reputation of the business, shareholder value and public trust and confidence, which are not necessarily always served by having every allegation bandied around publicly.

Senator WILLIAMS: You also say:

Anonymous channels are critical to get those who know about corruption in the door to auditors or regulators …

No doubt ASIC will take your notice on board there, going from a previous witness, where ASIC is saying you must have your name to the complaint.

Prof. Brown : I think a few things have to be said about this. One is that this is one issue where I think the tide has turned, because that requirement is a statutory requirement; it is not one created by ASIC. It is a statutory—

Senator WILLIAMS: So they did not create that law about putting your name to it—

Prof. Brown : No.

Senator WILLIAMS: so we cannot blame ASIC.

Prof. Brown : No, I am afraid your parliament created this, not ASIC.

Senator WILLIAMS: In what year?

Prof. Brown : In 2003.

Senator WILLIAMS: I was not there, so don't call it my parliament!

Prof. Brown : It is a very significant issue. By no means does it need to be a big issue. I think it needs to be an issue which is easily ticked off in this process for a number of reasons. One is that it is quite clear that the requirement that a person should have to give their name when making their initial disclosure in order for it to be protected was always an unwise piece of legislation because it just simply does not accord with all of the standard, normal processes of complaint or information receipt and disclosure. Whether you go from Crime Stoppers to the ANZ Banking Group's whistleblowing procedures, anonymity at least at the point of entry is a crucial part of any effective disclosure channel. But there is the other thing that makes it fairly straightforward to resolve. Because of that requirement having been placed in the Corporations Act provisions in 2003, it was then copied into the Fair Work registered organisations predecessor legislation and it was copied into the Banking Act and the Life Insurance Act. The fact that that has now been removed as part of the amendments to the Fair Work (Registered Organisations) Act—and I do not think anybody thinks that there is anything wrong with having removed it—is simply something which we can now just get on and remove from the existing legislation where it still retains it. Or, more importantly, the new regime that replaces all of that can follow the public sector precedent, which is quite well established now—that is, simply to make it clear that disclosures can be made anonymously and that they will attract protection and that somebody whose name and identity is not known at the beginning of the process whose name and identity subsequently becomes known has those protections. So it is really quite a simple issue that, I think, can be quite easily resolved by the committee.

Senator WILLIAMS: As you know this committee will make recommendations. What are a few of the most important things you would do if you were running the place to make this better? Often we put through legislation and laws and they have to be altered, amended, tinkered with and changed later on because this or that is not working. How can you help this committee get good recommendations up to government? What are the key issues to give the protection for our whistleblowers in Australia, public and private?

Prof. Brown : Apart from the technicalities of getting the design right—

Senator WILLIAMS: Clearly, a lot of technicalities are overruling other legislation and the Fair Work Act and this sort of thing. There would be a mountain of legislation, but that can be done.

Prof. Brown : Yes, and certainly issues like the types of remedies. Putting aside all the technical issues, then the other two columns in that table from the public sector experience still apply. One is having not just remedies available for whistleblowers on paper but ensuring that they are effective. That comes back to the question that Mr Keogh was raising before. And the other is who is responsible for making these processes work? That comes back to some of the earlier questions and observations about ASIC. At the moment, I think a lot of the focus has defaulted back to ASIC because it is obviously responsible for administering and enforcing most of the Corporations Act and associated legislation. That is where the only general whistleblowing provisions of any sort are currently located. But those provisions give neither any authority nor any real mandate to ASIC to actually enforce any of those provisions.

That just leaves open the question: whose role should it be to actually make sure that advice and assistance and support is provided to whistleblowers and to employers and also to corporations themselves on good processes, and who should be in a position to actually provide the necessary support so that remedies that are legally accessible can be accessible, in fact? That is a crucial issue for the committee obviously not just in general but specifically because there are multiple regulators with an interest in making sure this happens—ASIC, the ACCC, the AFP, APRA; it is like a litany of acronyms here, but they are well known to you. There is not a Commonwealth regulator who does not have an interest in seeing that this is done properly.

The question is: are we going to locate these responsibilities with one of those regulators or are we going to do something which enables all of those regulators to be supported by a process, an agency or an office? The other question obviously is the interface with the rest of the Fair Work regime and remedies that are available under the Fair Work Act and through the Federal Court: what role should the Fair Work Ombudsman, potentially, play and what role will the Fair Work Commission play?

I think there are answers to those questions which are more logical than others, but they need to be worked through quite systematically. It is a conversation that really has to be had across government as to how that is all going to be done properly. But the oversight and the support mechanisms and resources have to be there for these systems to work. We know that they just will not work by themselves, for some of the reasons that have already been discussed in the committee today.

Ms BUTLER: On that point: I asked Mr Whitton about the adverse action regime under the Fair Work Act and whether it was a useful model. You have that situation where, if a reprisal is taken against you for having raised concerns about not being paid properly, for example, you can then seek remedies, you can seek compensation and you can seek that a penalty be paid and that it be paid to you. And, probably most importantly, because you want to nip reprisals in the bud, there is the capacity to go and get an urgent injunction—which, in my experience, as soon as you file the application you tend to resolve the matter without having to actually bother the court with any actual argument.

It strikes me that one of the things we could do quite sensibly is give employees a positive right to blow the whistle on their company and make that workplace right one of the triggers for taking that sort of adverse action—proceeding against the employer. In other words, you have the right to blow the whistle on your employer. If you blow the whistle and your employer then sacks you, starts disciplinary action or transfers you to Siberia, you then have the same rights as anyone who has complained about their pay, health and safety or anything of that nature. Would you think that that would be a possible model for doing something that would actually build on existing processes and existing structures?

Prof. Brown : I am not sure that it necessarily would need to be framed in terms of a positive right, because, in many ways, it is already there. On some interpretations of the adverse action provisions of the Fair Work Act, they would already cover public-interest whistleblowing; it is just not explicit. The problem is that an employee, employee represented by a union or whatever, where their own personal entitlements are affected and the entitlements of other employees are affected when it comes to remuneration and workplace health and safety conditions and many things, there is enough incentive for that employer, groups of employees or industrial organisations to assert those rights and to take that action.

Ms BUTLER: The problem is where it is something that has nothing to do with them.

Prof. Brown : When we are dealing with disclosures about wrongdoing that are in the public interest, where there may be a reduced level of personal exposure, there may be all sorts of grievances tied up in it. Basically, it is something that is wrong. It is something that is in breach of the law, corporate procedures or professional codes, but it is something that the individual employee can basically walk away from in terms of their own life. It always comes back to the fact that it is easier to walk away with a damaged career than it is to assert any rights. That is the problem which leads not only to unjust outcomes but also to the massive chilling effect on whether it is worth speaking up about the wrongdoing.

It is for those reasons which become quite fundamental when you think about them in the big scheme of things—even in, say, the United Kingdom, where the public interest disclosure regime is fully embedded in the Employment Relations Act .It is just like an extension of the Fair Work Act; that is all it is at the moment. It is a special avenue in the employment law system, that if it is a public interest disclosure then it will be treated specially. Damages are uncapped when they would otherwise be capped. There are other thresholds and mechanisms so that the tribunal recognises we have to see this differently from what would otherwise be a normal adverse action-type circumstance.

We need to think in similar sorts of lines, but we are not an entirely 100 per cent unitary regime in the way that the UK is. We have regulatory responsibilities spread in the Commonwealth in a different way than it occurs in the UK. We also have more experience, I think, than in the UK with being able to identify what types of policies and procedures are reasonable to expect or require employers to have at an operational level and then to live up to them. I think the big question that arises in people's minds is not whether organisations and employers have a responsibility to encourage disclosures and to receive them and to act on them, but it is the difficulty of actually honouring the commitments that employers are making. We now have much harder data on the extent to which possibly a majority—possibly a large majority—of medium and large scale companies will have whistleblowing processes and procedures. They are already making their commitments to their employees, their officers and their managers that wrongdoing should be reported and can be reported—'We will protect you, we will do the right thing, et cetera.' The trouble—and I think it is a trouble for companies—is how to actually then honour that, and the enforceability of that becomes a crucial issue. It is almost like we do not have to add another level of obligation on the obligation to act on disclosures. We can basically model it on what companies are already saying to their employees they will do, and then figure out how that can actually be made effective and enforceable.

Senator O'NEILL: A little earlier we discussed the situation you have just described. I want to give you some evidence that we heard yesterday from the Financial Sector Union in the insurance industry. I want to be fairly accurate but do not have my notes to refer to. They talked about systematic harassment, and yet they are companies that have these documents—they are companies that are articulating this in the public place for their own benefit and as a marketplace requirement. This gap between what is articulated and what is enacted seems to me to be very problematic. We had evidence from Mr Whitton this morning about education being the first thing that has to happen, but he also mentioned resources, which you have too. Nobody is talking about the money involved in this and who spends where to make this happen. I guess my question to you is along the lines of what I asked Mr Whitton: do we need to make it a key performance indicator for directors of companies that they report on this, in addition to the requirements you talked about with the ASX. If what you measure is what matters, and if this matters, then why are we not measuring it? And is this happening anywhere around the world? It seems to me you have a wealth of experience.

Prof. Hall : My view on key performance indicators is that there would be a lot of pushback on that, and the reason is that it links directly into directors' duties, which is where you start to make the individuals in charge of the companies liable. I think the experience in the bribery—

Senator O'NEILL: I think some whistleblowers would think that that is a good idea.

Prof. Hall : Just stepping back, I think there are other ways—which is not to say that this will not ultimately come to be part of directors' duties. Directors' duties are actually very, very broad in Australia, and they are broader than in the US or the UK. I think the courts are continuing to expand directors' duties. My own view is that the starting place for this is that it has to become part of the norms of an organisation. It has to be considered part of everyday behaviour, and at the moment that is not the case. Over here you have policies and practices which are expressed, but then over here you have implied practices, which are all the things that actually get done within an organisation. This is a very real issue in the context of bribery and corruption. You can say, 'Don't do it,' but over here it happens. How do you change that? My own view is that the example of the UK Bribery Act and the model that it adopts is a very effective one. Whilst the soft law in the listing rules creates a soft incentive, which is regulated by investors, consumers and people who read those documents, one way to create a very hard incentive is along the lines of the Bribery Act, where a company is liable for any reprisals and any victimisation by any of their employees, unless they can show they have in place—so it becomes the defence—policies and procedures which are implemented, effective, reviewed, reported on and so on. There are now standards that have developed for companies about what that means—about how they get that defence. The very quick reaction of companies around the world was to start to not just have the policies and practices in place but to make sure they were implementing them in an effective way, because the defence would not operate otherwise.

My view is that the law will evolve to the point of it being part of the risk management that a board takes into account—what those policies are, whether they are being implemented. That is happening slowly through case law. But what we can do quite easily through legislation is to create a broader reason to have those in place by creating organisational liability for any employee—including a director, anyone—who engages in victimisation.

Prof. Brown : I might add two things to that. One is that we know this is a live issue for directors, boards and those involved in corporate governance. Our project is fortunate to have the Australian Institute of Company Directors as one of its partners, along with ASIC and others. Certainly in our focus groups with directors, which the AICD has facilitated, a live question for directors has been: 'How much do we need to know about this?' I think the answer will come back to treating whistleblowing processes as part of the risk management framework, in terms of key information that relates to the integrity of the organisation and needs to be reported through to directors as part of the verification that those risk management processes are working. It is fairly clear that there are quite a lot of directors out there who want to see that information as part of the governance process. And then there are many companies where directors are a hands-on part of that governance process; they are part of the whistleblowing chain. The whistle will be blown to directors. There is a bit of data here that confirms how crucial board audit committees are for the private sector and the not-for-profit sector, in particular, as part of the disclosure apparatus.

It is not like there is an intention to go out and have this massive inconsistency between the rhetoric and the reality. It is actually a real conundrum for organisations, how to make sure that their reality matches their rhetoric. The interesting thing is that we in Australia are on the front foot, internationally, on this. That does not necessarily mean that we have the answers yet, but because of the fact that we have had longer experience with trying to have good systems and procedures at the organisational level in the public sector and trying to see whether they can work, it gives us an advantage, because Australia has been doing that for a longer period of time than any other country.

We know, for example, that international standards on whistleblowing systems are very limited because they tend to focus on what the reporting regime should be—you encourage disclosures, then you investigate them and you deal with the wrongdoing—but they are very weak on support, protection and management of the personnel issues that go with whistleblowing. We now know from research that there is no current, valid Australian standard on whistleblower protection programs in place as part of Standards Australia's governance suite, but the process for drafting the replacement one is just kicking off. Professor Hall and I are both on the technical committee for that, along with lots of other stakeholders. But internationally there is no model, because this has been a very slow-burning issue that the whole world has been waking up to very slowly.

I should also say that this is not just an issue for the private sector or for the not-for-profit sector. Slides 9 and 10 of the attachment show preliminary data from the 702 organisations in Australia, across the sectors, whose procedures and processes we are assessing and evaluating through our initial surveys. This is just the first phase of the project. You can see that, right across the board, large majorities of organisations do have policies and procedures in place. They do have things that they believe are support mechanisms that they can trigger for whistleblowers. You can see some of the gaps between the public and the not-for-profit sectors on some of those more common elements of their processes. But, when you get down to the right-hand end of each of those graphs on slides 9 and 10, you can see that on the issues where the rubber should really be hitting the road—on providing support for whistleblowers and providing remedies and recognition for whistleblowers—because of the public interest function they are serving, separately to the support that you would normally provide to any other employee who is stressed or whatever, not only do those crucial sorts of mechanisms drop away but the gaps between the public and the private and the not-for-profit sectors disappear. This is a really alarming finding for the public sector because it means that, when it comes to having really strong mechanisms in the public sector, despite all the years of effort that we have been putting into this, we have indications that it is not really translating into the operating procedures of public sector agencies either.

Senator O'NEILL: So the symbolic action—you know, the power of practical action—is clearly missing in all sectors with that revelation there.

Prof. Brown : Yes. It is clearly a serious challenge.

Senator O'NEILL: It is a symbol that says, 'We'll talk about it but we're not doing it,' really.

Prof. Brown : My own experience is that more often than not, certainly amongst these organisations who responded to our survey, the intention is there—the spirit is willing, certainly at a broad level and a senior management level. The spirit is willing. The intention is there. What is still lacking is proper knowledge about what to do, what is important, and what is not. And that is where a new standard and guidance on the importance of these more significant mechanisms will help and be taken up rapidly by employers. I have absolutely no doubt about it. Also, the statutory drivers need to be there—the enforceability, the accessibility of the remedies, things like rules. Effective rules on when it is appropriate for persons to go public will have a massive impact on this, because they will make companies go, 'We do have to take this seriously. What do we need to do?' As long as the legislative design is well calibrated and efficient so that there are things that employers and companies can do. In the public sector, there are questions of 'What's feasible for different types of agencies to do?' because we do deal with—

Senator O'NEILL: Matters of national security.

Prof. Brown : Well, we deal with all sorts of different matters. The diversity of organisations across the public sector is enormous, from small local councils through to some of the biggest employers in the southern hemisphere. At least in the public sector implementation and compliance can be more effectively driven by central integrity agencies, by the ombudsman, by an oversight agency. Some of the data here also shows that that is not necessarily desirable or as simple across the private and the not-for-profit sectors. So that is where the questions will be—what are the right legislative drivers, incentives and areas of enforcement to trigger that change, to get people over the line, to take it seriously and to understand its seriousness. Currently, as a result of the realities of business, it is just like, 'Is this another issue we have got to deal with?' I think that there are solutions to all of those, but they do have to be very carefully arrived at.

Senator XENOPHON: Can I go to the issue of enforcement and practicality. You could have the best laws on paper in the world, but you also need to have real access to justice for people. My office has had three cases recently where people have made what they thought was protected disclosure, and they are now caught up in court with the department's solicitors, who have very deep pockets, and it is completely demoralising. So what do you say in terms of how you deal with this in a practical sense, so that we actually ensure that it is effective? You may have on paper effective laws, but the practical aspects of it are not.

Prof. Brown : Certainly. One of the advances in both the Commonwealth Public Interest Disclosure Act 2013 and the Fair Work (Registered Organisations) Amendment Act is at least to protect whistleblowers who are applicants for remedies from exposure to having to meet the costs of their employer or the other side if they are unsuccessful, other than in circumstances where it is vexatious. In effect, it is a public interest costs rule, which at least means that the whistleblower is insulated from potentially having to meet the costs of the other side.

Senator XENOPHON: What about their own costs?

Prof. Brown : Exactly. That in and of itself is a step forward, but it does not deal with the reality of just how difficult it is to assert one's entitlements in this situation. I think increasingly there is support from unions and industrial organisations. One of the things we have found through previous research is that there was a stereotype out there that unions did not support whistleblowers, because unions were supporting the persons who were having allegations made against them—against management—and whistleblowers were left to hang out to dry. Through earlier research we found that was actually not true, that in fact most unions are quite good and some can be very good, that it is just routine they basically support both sides and that unions are increasingly recognised and active in supporting whistleblowers. But it is a huge question and a huge problem. The rewards-and-bounties type arrangements in the US have stepped into the gap, if you like, because there is enough of a financial incentive there to create a legal services market for whistleblowers to find lawyers who will go in and take the action, and then the recovery of those percentages serves as compensation.

Senator XENOPHON: But they have stupendous rewards in the US—ridiculous.

Prof. Brown : Quite. That is not a silver bullet solution.

Senator XENOPHON: I think Associate Professor Hall wants to jump in.

Prof. Brown : We do have to look at both provision of better support services, whether it is general legal aid or whether it is a specialist type of legal support that is available for these sorts of situations above and beyond, and having an oversight or regulatory body that is in a position to step in, intervene and force a matter to settle, or to recommend a mechanism that is more based in an informal tribunal which, again, is low cost for people to be able to trigger.

Senator XENOPHON: Perhaps an inquisitorial type system rather than adversarial.

Prof. Brown : Exactly.

Senator XENOPHON: Associate Professor Hall, I think, wanted to jump in.

Prof. Hall : I think there are two elements of the Fair Work (Registered Organisations) Amendment Act that offer potential in this area. One is that it is now possible under that legislation for a whistleblower to make a disclosure through a lawyer. That provision, if it were more broadly implemented, would create a market for lawyers in acting for whistleblowers, and then law firms can offer deferred payment systems such as the classic 'no-win, no-fee' arrangement in this area.

Senator XENOPHON: All the asterisked conditions apply.

Prof. Hall : Yes, conditions apply. I would like to highlight this aspect of the legislation because one of the things that has happened in the US as a result of the bounties is that a bar, as they call it—a part of the legal profession—has developed with expertise in this area. I would think that this provision would encourage a lot of whistleblowers not to go straight to a hotline but to go first to a lawyer, and that lawyer is then is a position to advise them on whether they have a valid claim and how that claim should be formulated. That offers incredible incentives to the framework as a whole, because once that information was actually disclosed—assuming it was—it would be in a better format that would be usable by regulators or organisations. That is one of the main functions of the bar in the US.

Secondly, it would enable law firms to offer a service to clients, where they saw the potential for an action continuing, of not having to fund the costs up front, as is normally the case, but in fact taking their costs at the end. I want to add another feature of the Fair Work (Registered Organisations) Amendment Act which is, I believe, incredibly useful in this context and which circumvents the discussion on bounties, and that is the provision on exemplary damages.

Senator XENOPHON: Subject to much negotiation with the government, I can tell you.

Prof. Hall : Yes. At the moment, there is not actually a lot of jurisprudence in Australia on what that could mean. The way bounties work in the US is that the whistleblower receives a proportion of the fine that is paid to the government. That raises a whole lot of issues in Australia, as we know. That is a very different issue around exemplary damages. What this would say is that, assuming that the provisions enabled a whistleblower to get full compensation for their loss—and full compensation under the UK model is probably the best model that is available and that includes not just current loss but future loss and future possible loss of employment—so leaving aside compensation, exemplary damages could offer the possibility of a court awarding damages against an employer on the basis of the sorts of factors that we do have in Australia under intellectual property legislation that does allow for exemplary damages.

Those sorts of calculations of exemplary damages are based on the seriousness of the infringement, the need to deter similar conduct, the conduct of the party that engaged in the action—so it is reserved for egregious cases. But what could it do in theory? Firstly, it would enable a greater incentive for whistleblowers because they receive those exemplary damages. It is also possible that a proportion of those exemplary damages could be returned to a fund, an organisation or an oversight body for the benefit of future cases or to training or education, or whatever else is needed.

Senator XENOPHON: The government's undertaking is on the record that there will be an expert advisory panel established after this committee hands down its findings for the government to implement those findings, or at the very least is committed to expanding or furthering the registered organisations amendments for the corporate sector and eventually the public and not-for-profit sectors as well. Can we go to some of the other elements about the good faith and the like because I think that forms a basis for this discussion. That seems to be the government's stated position, that they will not retreat from anything that is in the Fair Work (Registered Organisations) Amendment Act for the context of expanding this to other sectors.

Prof. Hall : Well, that does not have the good faith requirement. There are a number of things, in my opinion, about the registered organisations legislation that is incredibly attractive. One of the first is the definition—

Senator XENOPHON: You should maybe confine to the whistleblowers because that itself is controversial.

Prof. Hall : Yes, to the whistleblowers, and that is the definition of a reprisal. In fact, what it basically does, as I read it, is enable a whistleblower once they have made a protected disclosure to then seek a remedy if there is a reprisal. As I read it, in a sense it shifts the burden back on the organisation to prove in fact that there was no reprisal. 'Reprisal' is very broadly defined. It is defined as a series of behaviours but that can be connected to either a protected disclosure or even the suspicion that a protected disclosure may be made. To me, it strikes a very good balance between who needs to prove what. Then, ultimately, the way it shifts it back to the whistleblower is that the court is not required to make any of the orders if there is the belief or suspicion that the disclosure by the whistleblower is not any part of the reason for the reprisal. So the burden of proof for the whistleblower and the obligations in terms of the organisation are, in my opinion, much better balanced.

Senator XENOPHON: The second substantive paragraph in the submission from Griffith University by you, Professor Brown, to the committee states:

… only very limited protections that were enacted for non-government workers in part 9.4AAA of the Corporations Act in 2004, and in limited specific industries—

such as in the Banking Act and the Life Insurance Act. If these protections, as set out in the Fair Work (Registered Organisations) Act now, were extended to the Corporations Act, what difference would that make? How much would that expand things and how much would that improve the position of the corporate whistleblowers—the Jeff Morrises of this world—that Senator Williams referred to?

Prof. Brown : The short answer is: significantly. But there is a lot more that needs to be done either in the Corporations Act, the Banking Act or, preferably, in some overarching replacement piece of legislation that was necessary to be done in something like the Fair Work (Registered Organisations) Act because of the purposes and the confines of that act. It was to establish a regulator and the registered organisations commission and then to deal primarily with disclosures to that commission or to other workplace regulators, whereas we are talking now about something which is broader than simply that piece of legislation. But, of the seven key things that I think are significant in the Fair Work (Registered Organisations) Act amendments, we have already spoken about three of them—the anonymity issue and the public interest costs for exemplary damages.

We have touched on the definition of reprisal and the availability and the scope of the remedies. Currently, in the Corporations Act and the other private sector legislation, there is no scope for getting civil remedies unless a criminal offence of reprisal is first shown to have occurred. Under the Fair Work (Registered Organisations) Act it already moves away from that very huge problem so that, in theory, civil liability and civil remedies would be available irrespective of whether there was any criminal reprisal. But it is still a problem for the legislative design to have those two things mashed up together in the way that they still currently are in the fair work legislation, which was largely copied from the PID Act and from the public sector legislation.

This is a uniquely Australian problem. No country in the world has criminalised reprisals against whistleblowers the way that we have since the 1990s, so no other country has created the problem for itself of then trying to figure out how to provide civil compensation remedies for the same reprisals if, in fact, they have already been identified as criminal. So what is the onus of proof and what type of reprisals are we talking about being able to attract the civil remedies versus the criminal—

Ms BUTLER: There is no reason why you could not do both, is there?

Prof. Brown : There is not, but my aim—

Ms BUTLER: A court would not hear them in parallel because of the potential for issue estoppel or res judicata, but you could wait until the criminal proceeding has been done and then bring civil proceedings?

Prof. Brown : You could, and some of the current public sector legislation allows for that. But, based on our new data, the reality of what we now think is happening in organisations in the public sector is that they just go: 'Okay, reprisal is a criminal offence. Someone is alleging reprisal, so we'll go looking for either the ingredients of a criminal offence—deliberate intent to do a reprisal'—

Senator XENOPHON: Which is problematic.

Prof. Brown : 'or something very close to it. We don't find that, lo and behold, because it's very hard to find and may not be present because the damage that might have been done might have been done just through pure negligence.' So they say: 'I didn't realise that it was'—

Ms BUTLER: That I was not willing to sack someone.

Prof. Brown : 'likely that everybody was going ostracise him or her and that their career was going to go down the toilet. I wasn't intending that there be any harm.' Once an organisation goes looking—or an internal investigator, an auditor, an ethics officer or whatever—for responsibility for the reprisal, and if those criminal type ingredients are not present, then it is a bit like there is nothing there. They could say: 'Nobody is responsible. There's nothing we could've done. Nobody deliberately caused this.' That, then, is the end of the story. I think that—

Ms BUTLER: Sorry to interrupt you, but that is why there is so much importance in having the reverse onus that Mr Whitton talked about when it comes to people who have taken adverse action against whistleblowers. You need to be in a position where people understand that, if someone blows the whistle and then a week later they are sacked, there is going to be some attention given to that and, if you are doing the sacking, you are going to have to do some justification of that sacking. And I just interrupted you, Associate Professor Hall; I am sorry.

Mr Brown : If I can just finish these key points, the thing that the Fair Work (Registered Organisations) Act does, though, for the first time is actually to say that civil liability can be attracted where there is a failure on the part of somebody to fulfil a duty to either protect or support, or to control others who are likely to undertake a reprisal, so it does shift the ground significantly in a positive direction. That is an issue on which there has now been some positive movement, but the ultimate solution on this is something that really needs to be worked through.

The other two key things are the replacement of the 'good faith' requirement with something more appropriate for whistleblowing scenarios. That is fairly straightforward and, I think, something that, from submissions, it appears many people who previously defended the need for a 'good faith' requirement to be there for whistleblowers have now accepted is not the right sort of test and that having a more standard sort of test that provides that somebody has acted honestly on a reasonable belief is all that is required and that you do not have to demonstrate 'good faith', whatever that may mean. That is definitely a step forward which changes the game.

The other key one is the broadening of the definition of 'whistleblowers' from simply just employees to also other types of organisational insiders. I think the committee will hear some evidence from some people that would say, 'Well, whistleblower protection should be available for anybody—any citizen, any member of the public.' But I think it is valid to remain focused on the reason for this, which is whistleblowers as not only organisational insiders—people with access to the information about wrongdoing that other people would not have—but also people who are exposed to the risks of reprisal or of their own career being in jeopardy as a result.

Ms BUTLER: We do, though, have some protection for members of the public in the Queensland whistleblowing regime when there are special circumstances. For example, people with a disability might be being exploited. A member of the public can blow the whistle then without having to be an organisational insider. Would you say that where there is special vulnerability you would extend it out to that point?

Mr Brown : My own view is that that protection should be located elsewhere, not in the Whistleblowers Protection Act, so that we can keep whistleblower protection focused on the challenge of organisations' governance processes and the protection of their own employees and officers. Other people will have a different view, but that has always been my view. We do need to make sure that protections are in place for other persons, especially vulnerable persons—especially vulnerable clients or their families. But I think the key thing about the Fair Work (Registered Organisations) Act, and this is now common in quite a few of the state public sector organisations, is that a whistleblower who can attract those protections is effectively somebody who is any worker in the organisation plus any other officer or somebody with inside knowledge. So it clearly needs to be more than just employees; it should extend to contractors who are located within that workplace or within that organisation. In some cases—

Senator O'NEILL: They may come from a very different cultural context, and so they see things in a very different way as well.

Mr Brown : And very often very usefully. A number of whistleblowers are people who have been parachuted into an organisation and said, 'Wow, they really do things differently in here.' But their contract or their employment is just as at risk as if they were an employee. And then the others are volunteers. Certainly, for the public sector, but possibly also for parts of the private sector and for the not-for-profit sector, you are talking about people with a whole range of different employment-type relationships with organisations that need to be included, but my own view is that protection for other types of complainants or informants or witnesses or victims of wrongdoing who do not fall within that organisational responsibility remit belongs in other regulatory legislation.

Senator XENOPHON: Can we just follow up on that. There is an increasing use of contractors in workplaces and, for instance, there could be a casual contractor that goes into a workplace and notices serious occupational health and safety breaches. They may never go back there again, but they are worried about the people that are left behind or the risk that is posed to the public. They are not an employee of the organisation, but if they do speak out it could be that the contracting company says, 'You're trouble. We're not going to use you again', even though it relates not to the contractor themselves but the company to whom they have been contracted. Are you suggesting that they would or would not be covered as whistleblowers?

Prof. Brown : I am suggesting that they would be covered. Currently under some public sector legislation, including the Commonwealth PID legislation, they would be covered employees of contractors.

Senator XENOPHON: I just want to ask a couple of questions, and you may want to take them on notice. Chair, you have been very patient, unlike Senator Williams when he is chair of committees.

CHAIR: Thank you.

Senator XENOPHON: I am sure that will change.

Prof. Brown : The one thing we should add while we are on that topic, because it will be easier for the transcript, is former employees. I think a significant issue that some public sector jurisdictions are grappling with is the importance of—

Senator XENOPHON: I think Associate Professor Hall is bursting to say something

Prof. Hall : I just want to return to your question about the corporations legislation and whether it is big enough or a suitable place. In my opinion it is not. If you look at a whole range of conduct around which we would like to see whistleblowers protected, they are not contained in the Corporations Act. Bribery and corruption, gross mismanagement, dangers to public health, fraud, conflicts of interest, human rights violations—none of those are. In fact, the sort of offences that a whistleblower would have to report on under the Corporations Act are very narrow. One possibility would be to protect whistleblowers who report on offences under any breach of Commonwealth law—for example, in the Commonwealth Bank case, the breaches of the law were not under the Corporations Act.

Senator XENOPHON: My final question goes to an issue relating to sections 70 and 79 of the Commonwealth Crimes Act. Section 70 relates to the disclosure of information by Commonwealth officers, and section 79 relates to the receipt of that information, particularly by journalists. There is even an argument about members of parliament. There are interesting issues of parliamentary privilege. Are you aware that last year there were raids by the Federal Police on the offices of former Senator Conroy and one of his staffers—and there may be some charges pending in respect of that—to do with NBN Co issues?

Would section 70 of the Crimes Act, of necessity, need to be amended in the context of a whistleblower protection regime? Otherwise there would be an argument that section 70 would be paramount, and people would not come forward because they would face a two-year jail term for disclosing information that, under that section, they are not meant to disclose.

Prof. Brown : Currently if you make a public interest disclosure under the Commonwealth PID Act then it is the Commonwealth PID Act that provides you automatically with a public interest defence against any prosecution under section 70. Part of the purpose of whistleblower protection legislation is to provide a defence and, basically, immunity from prosecution. Currently a Commonwealth public servant who is in a position to claim the protection of the PID Act is immune from prosecution; they would automatically have a conclusive defence to a prosecution under section 70. The purpose of whistleblower protection legislation is to override those types of offences or risks.

Senator XENOPHON: But if you did not go forward in the case of the NBN—and I am not au fait with it. If you said, 'If I do this and I want to blow up my career by going through this contentious issue', where does that leave you?

Prof. Brown : The issue really arises because of the fact that people will make disclosures or reveal information that may not come under the Public Interest Disclosure Act and where they might well be entitled to a public interest defence of some sort, which is currently not allowed for under section 70. It is for that reason that the Australian Law Reform Commission recommended, quite a few years ago now, that section 70 needed amendment in order to recognise that a public interest defence might need to be available to almost anybody who might be in the situation of breaching a criminal law that requires them not to disclose particular information. So you actually need to do both.

Section 70 of the Crimes Act needs to be amended to allow for a general public interest defence exception, so that it is only if you make that disclosure or disclose that Commonwealth information unreasonably or unjustifiably, without reasonable excuse, that you can be prosecuted and not as a blanket prohibition on disclosure. That needs to happen irrespective of whistleblower protection legislation. Whistleblower protection legislation, if it is effective, will just simply override any criminal liability like that, or any other civil liability. It will override employers' instructions that you are not allowed to breach confidentiality or reveal official information. If it is public interest wrongdoing, if it is disclosed according to the act, then automatically the legal effect of the legislation would be to override that type of liability.

Mr KEOGH: Is the effect of the Public Interest Disclosure Act to make someone who is afforded the protections an authorised discloser?

Prof. Brown : In effect.

Mr KEOGH: Section 70 of the Crimes Act operates where you are not authorised. So if the PID Act effectively authorises you then you could not commit an offence.

Prof. Brown : That is basically the effect of having an automatic defence. It is implicitly—

Mr KEOGH: It would be more than a defence; it would be that one of the fundamental elements of the offence is not being made out.

Prof. Brown : But it is a de facto authorisation; it may not be a situation where the organisation can be clearly said to have said, 'We have authorised you.'

Mr KEOGH: There are other laws that authorise you.

Prof. Brown : Exactly.

CHAIR: Professor Brown, the Institute of Company Directors, which you mentioned earlier, are urging tougher penalties for unlawful reprisals against whistleblowers and for greater compensation, rather than the idea of US-style bounties. Which direction would you favour out of those two?

Prof. Brown : I think there is room for both. Certainly the common ground should be that we need to look at more serious remedies, in general, for compensation, for damage done, or for the risk of damage, for detrimental action. But I think it would be good if the committee seriously considers and has a look at what role bounty-type arrangements might play, not necessarily as a straight copy of the US arrangements, and the reasons for not creating perverse incentives and artificial legal services markets—that is, creating a whistleblowing industry. We have to look seriously at what is perverse and what is attractive out of those sorts of options.

But I think one of the virtues of having a regime, whether it is exemplary damages, recovery of some of the fraud or the penalties imposed in those cases, is that it basically creates a revenue stream, whether that revenue goes directly to the individual whistleblower in those cases, or whether it could also fund more general whistleblower compensation and support in addition to those individual cases. There are some options that we can look at that are not just simply to copy the US approach but to do something that would be more tailor-made for Australia. It would, I think, probably be more palatable, from the point of view of our particular take on our own democratic values, that we do not commercialise whistleblowing.

At the same time it would be fair and just if a proportion of the frauds recovered or the penalties imposed as a result of people having made public interest disclosures were directed back into better supporting, protecting and compensating whistleblowers in general, and I think that would be something that is well within our values set. But that is not what currently happens in the US. So I think we have the opportunity to do something different that is informed by some of what has happened in the US but is not necessarily a straight copy.

CHAIR: Does any of your research data show that the tightening or improvement of whistleblowing laws has commercialised and created a whistleblowing industry following changes in laws in other jurisdictions?

Prof. Brown : None of our current research goes directly to that sort of question.

CHAIR: Okay.

Ms BUTLER: On the question of a bounty versus firmer penalties and compensation, isn't the problem that the latter relies on the individual who has had reprisals taken against them to go out and seek those remedies whereas if it is a bounty or an incentive then it is the regulator that provides that without further—I mean, all you have to have done is blown the whistle. So, for a bounty, if you blow the whistle you get the bounty. For penalties and compensation, there is certainly a lot of room for them but you have to, having had your career ruined, find the money to go to court and seek those penalties and that compensation, don't you? Isn't that the difference?

Prof. Brown : It varies between the different regimes in the US—between the SEC regime, the tax regime and the false-claims regime—as to exactly how it works. You will probably receive evidence that those different regimes are more or less effective for different reasons in different ways. If you are entirely dependent on the SEC's discretion as to whether you get anything, you have got to await the outcome of a bureaucratic process, in effect, as opposed to a false claims action, where your lawyer is the one who drives it. In broad terms, what you have described as a problem is definitely a problem, but it really comes back to the committee wanting to design a regime whereby we need to recognise that most whistleblowers will not have resources at their disposal. When they get to the point where they need to assert those sorts of rights, they will have been through a lot and it will be easier to walk away than it will be to actually achieve any kind of justice.

It really falls back on the regulatory agencies who are tasked with making these processes work to have both a mandate and an obligation and to have the resources to be able to at least take enough of the demonstration cases on behalf of whistleblowers to both achieve justice in a higher range of cases and deliver more general support services to whistleblowers. Accurate, quality advice services are missing at the moment. But, certainly, at least enough demonstration cases to make the enforceability real to then have an effect on employers culture and practice. That is well within our grasp, I think, to do that. To my mind, the issue is not really whether we go down the road of bounties or rewards for individual whistleblowers but how we recognise that whistleblowers provide information of incredibly high value. That value then manifests very often in the recovery of fraud lost and in the imposition of justifiable penalties for wrongdoing of a whole variety of kinds. If that value is manifesting in a financial sense, then, rather than the Commonwealth or government just collecting that value or the company just recollecting that value, some of that value should be going to support whistleblowers and achieving compensation and support for whistleblowers. We are all benefiting from the information that the whistleblowers provided, but, too often, the whistleblower is the one who is still left hung out to dry even when the rest of society and even the company and the employer has benefited from their information.

Mr VAN MANEN: Thank you for your testimony, Professor Brown. My question goes more to the nature of culture of organisations. We speak a lot about openness, transparency and all of those sorts of things. You said early on in the piece, and I think Professor Hall touched on it as well, that there is a disconnect between what a company's stated policies are and what they do in reality. In your research, have you identified why there is that disconnect, or is that part of the research you are still working on to identify?

Prof. Brown : I am looking at Dr Lawrence, because this is the model that we are currently implementing through the next big phase of our research. The primary aim of our research project is actually to do the in-depth research in organisations to see what the factors are that explain why particular incidents and the implementation of the procedures in entire organisations is producing better or worse outcomes. What is it?

Is it commitment values of individuals? Is it the culture, which we measure? Is it the quality of ethical leadership in that organisation? Is it training? Is it simply knowledge and awareness? Is it particular types of whistleblowing challenges and the power dynamics that they cause, so that, even when everything else is going in favour, it is hard for the internal audit manager to turn around and say to the CEO, 'No, we mustn't sack that person, because they've done the right thing—sure, they might have blown the whistle on your little brother who you've been protecting for years'? Is it critical incidents and power relationships? What is the range of factors?

That is why we have so many organisations participating and we have so many partners supporting us in unpacking that really complex box. We are hoping that we will have more concrete data on that than anybody has ever had before and at least some preliminary data on that before the inquiry wraps up. We are going hell for leather. We do still need, or want, more organisations in the pool as well to increase the power of that data. I am hoping we will actually have some more answers on that. The reason why it is so important is that it is not just an abstract question. The obligations that are imposed in terms of rules and processes and procedures under this legislative reform need to be targeted, if possible, on knowing what the problem or range of problems that we are actually trying to address inside the organisation is. At the moment, we have simply never had that in any kind of systematic way. So hopefully we will give you a better answer in a few months.

Mr VAN MANEN: I worked in large businesses prior to my time in parliament. They have, over the years, become very bureaucratic in their own right. Is part of what you are looking at those bureaucratic processes that have become inherent in large businesses, which are in part their risk management processes, I suppose, and they are using that as a tool to hide behind and to not deal with those particular issues?

Prof. Brown : That is a very complex question in and of itself. I am not sure. We would have to go back and look at the model to see what we have got that would tap into that particular problem. Certainly we have designed all our research so that it makes sense in a complete diversity of organisation types from small to big. We are focused on processes and dynamics, not just on formal procedures. I think one of the reasons why we do have some big organisations involved is that they know that, notwithstanding, and sometimes possibly because of, their formalised systems, they are still not necessarily getting the results that they want. So it is: how do they cut through their own systems? We would have to go away and think about that, about what indicators we would have that would help unpack exactly that dynamic. But in some ways I think we are trying to transcend that particular type of problem.

Prof. Hall : Just to comment on that: I think that is a widespread issue across corporate governance in particular—how to move from once a policy is introduced, a tick-the-box approach, to something that is substantive and really changes behaviour. Culture, corporate culture, is part of what we are looking at. It is a very difficult thing to measure, but that is part of what AJ is talking about here. We are actually trying to find measures for what ultimately creates a corporate internal culture of compliance as opposed to a process of compliance.

CHAIR: Maybe you could look at how the US companies operate within their jurisdiction and outside their jurisdiction. It would give you a good comparison.

Dr Dozo : It is also worth adding that, in the survey research, the questions are asked to employees and managers and board members, so we are looking at the range. I know we have touched on how directors deal with these issues but also: what is the perception from employees of what the organisation is doing? We have seen in previous and upcoming research, exactly as you were saying: is the organisation just hiding behind its rhetoric? They can say, 'We have these policies and procedures,' but, if the employees are then reporting to us, 'I don't even know that they exist,' that is when we know that there is a problem in the organisation. So that is another way that we are trying to get at it, by thinking of the culture question, by looking at not just what the managers' perception is but what the employees see and what perhaps the board members want to know and see.

Senator KETTER: In relation to your survey of 700 entities, public sector businesses, not-for-profits, and the private sector, is this across the full range of the private sector? I just wanted to double-check that the banking and financial services companies are included in your survey.

Prof. Brown : Yes. That preliminary report you have there—this was attachment 3 to the submission—if you turn to page 7, table 4 gives you the breakdown by 10 industry sectors for both private and not-for-profits. Of the private sector entities in there, 54, or 36 per cent, are from the financial or insurance services sectors, as well as some not-for-profits. So we do have some quite good data on how at least some sectors are comparing with the rest. That is not broken down in this report, but we are certainly using it currently in our analysis. I can tell you it is very interesting.

Senator KETTER: Can you share any of that analysis with us, particularly in relation to the banking and financial services area?

Prof. Brown : I probably cannot today because we have not finished analysing it yet. Then we have to go through our own process of releasing it through the research team and the partners. But certainly it is safe to say that there are big differences between the sectors. The claims of the banks, for example—but more broadly than just the banks—that they have state-of-the-art processes and procedures in place is being supported to the extent to which that sector is coming up as stronger than other sectors. I think what we have got to be careful of is assuming that, just because you are stronger than the rest of the pack, that means your processes are state-of-the-art, because we know that there are systemic weaknesses and unknowns right across the board.

Senator KETTER: What might look good on paper may not necessarily in practice work.

Prof. Brown : For anybody at the moment. You could have the best. I have said this to some of the financial institutions. I think it is incredibly valuable and worthwhile that the Australian Bankers Association has actually done quite a good job of trying to take stock of what whistleblowing processes and procedures are like in the sector and benchmarking it against international standards. The problem is that I do not know of an international standard that I would want to be benchmarking myself against. That is not the fault of our banks or financial institutions. It is just a general problem that we have all got. That is really why we are doing this research—to identify some better standards and better indicators of what a really comprehensive approach might look like.

Senator KETTER: You advocate an overarching holistic approach to whistleblower protection. You are familiar with the case of Jeff Morris from the financial planning scandal with the Commonwealth Bank. If your preferred model had been in place, how would that have played out? Where would Mr Morris go, presumably internally, first? If not, there would be some sort of organisation such a fair work ombudsman type of organisation to assist with the process. I am just interested. Could you tell us how that might work?

Prof. Brown : If a comprehensive legislative regime was working, ideally Jeff Morris would have had people within the Commonwealth Bank who he could have gone to and trusted, and they would have sorted it out and dealt with it and disclosed to regulators if they needed to or whatever. The chances of that should be increased. In some circumstances, that still will not be possible or still will not work, in which case he would be able to—he and his colleagues, the fellow ferrets or whatever—go to the appropriate regulator, whether it is ASIC or APRA. Under this regime, they would have a clearer sense of their responsibilities. We know now, especially in the light of recent years, that our regulators are rapidly learning that they need to handle these things differently to the way they might have in the past.

The key thing is that, under a new comprehensive regime, as soon as those processes start to hit any problems or there is a lack of responsiveness or even uncertainty or fear—but certainly if there are active repercussions that start to flow or inaction in relation to any of those disclosures—there will be somebody else that Jeff Morris and colleagues could go to to say, 'Look, we've made these disclosures' and either 'Nothing is happening' or 'We have been sacked' or 'We have been threatened' or 'It's all going pear-shaped', and they would have a mechanism whereby they could get better advice and support. There would be a mechanism whereby that oversight body/agency would be able, if necessary, to go to ASIC or go to APRA and say, 'Are you handling this? What's going on?' and, if the repercussions still end up being adverse at the end of the day or if in fact there is an adverse employment outcome or termination or whatever, not only would there be fairer rules for someone in Jeff Morris's position—if able to get legal support to access the remedies to which they are entitled, to take action to get remedies or compensation—but there would be that other support/oversight agency which would be in a position to help make sure that that occurs in cases where it should occur.

I think there are a range of practical ways in which a proper comprehensive scheme would result in a completely different set of outcomes for Jeff Morris and colleagues, for the Commonwealth Bank, for ASIC and the regulators and for public trust in both the industry and in institutions more generally.

CHAIR: That was a very elegant conclusion. Thank you very much to all the witnesses. You may receive some questions on notice. Could you provide those to the committee if possible by 17 March through the secretariat. Thank you for attending the hearing and for your evidence today. The committee will now suspend for lunch.

Proceedings suspended from 12:32 to 13 : 21