Why whistleblowers need greater legal protection

David McBride and Richard Boyle are arguably Australia’s highest‑profile whistleblowers – and it is telling that McBride is now in jail and Boyle has been fighting for years to avoid the same fate.

Former military lawyer McBride has been both praised and vilified for leaking classified military documents that revealed alleged war crimes committed by Australian forces in Afghanistan.

Ex-public servant Boyle faces prosecution for exposing information about alleged unethical debt‑recovery practices within the Australian Taxation Office.

Complex legal and moral arguments aside, the predicaments of both men underscore the potential perils of speaking up in the public interest.

As a raft of reviews put the spotlight on Australia’s whistleblowing laws, whistleblowing expert Dr AJ Brown AM says the McBride and Boyle cases highlight the need for reforms that truly protect informants.

“Their prosecutions emphasise that the system is broken,” says Brown, who is also the public policy and law professor at Griffith University in Queensland.

“They are both tragic cases because they show that, when a public sector agency really wants to turn on a whistleblower and punish them, there are neither the legal protections nor the independent oversight to check on those agencies.”

Whistleblowing explained

Whistleblowing is the act of reporting unethical, illegal or otherwise improper conduct within an organisation. It is crucial for maintaining transparency, accountability and integrity within organisations.

Whistleblowers may be employees, former employees or other individuals who have access to information about the wrongdoing within an organisation, and they may reveal activities such as fraud, corruption, safety violations or other legal or ethical breaches.

Whistleblowers may report their concerns internally within the organisation or externally to regulators, police or the media.

A dedicated authority

Transparency International Australia, the Human Rights Law Centre and Griffith University’s Centre for Governance and Public Policy want a dedicated Whistleblower Protection Authority for Australia, describing it as “the missing piece of Australia’s integrity landscape”.

The three organisations also developed draft design principles for the proposed body.

Brown, who co-wrote the Whistling While They Work best-practice guide, says a dedicated authority would enforce improved legal protections for people who raise concerns about wrongdoing under federal laws. Its powers could include providing support to whistleblowers, facilitating whistleblower disclosures, and investigating and addressing complaints of unfair treatment.

On 1 July 2019, Australia introduced significant reforms to corporate sector whistleblower protections under the Corporations Act 2001. The reforms aimed to strengthen legal protections for whistleblowers and improve the remedies available to those who suffered detriment for reporting.

Five years on, Brown says it is time for government to initiate new and genuine reforms that shift whistleblowing protections from being a “politically symbolic exercise” to laws that boost the integrity and accountability of public and private institutions.

“Most of our whistleblower protections, even if they look good on paper, are simply not working effectively in practice when tested in any major way, especially in any difficult cases.”

The Australian Securities and Investments Commission (ASIC) is responsible for administering the whistleblower protection provisions for the corporate sector in the Corporations Act, including the whistleblower policy requirements.

Claire LaBouchardiere, senior executive leader for companies and small business at ASIC, says whistleblowing plays a key part in an organisation’s ability to detect misconduct and to identify, escalate and address issues early.

 

"Most of our whistleblower protections, even if they look good on paper, are simply not working effectively in practice when tested in any major way, especially in any difficult cases."

 

“We appreciate that potential whistleblowers may be reluctant to speak up due to fear of reprisals,” LaBouchardiere says.

“We consider that transparent whistleblower policies can encourage whistleblowers to come forward with their concerns, so they are essential to good risk management and corporate governance.”

ASIC has initiated civil penalty proceedings against companies and their directors in cases that involve alleged breaches of the whistleblower provisions.

LaBouchardiere adds that her team “values the people from inside companies and organisations who come to us with reports of potential misconduct or breaches of the law”.

Change on the horizon

Several reviews of Australian whistleblowing regulation are under way, including through the Tax Administration Act 1953 and the regulation of accounting, auditing and consulting firms in Australia and the aged care sector.

New whistleblower laws commenced in Australia on 1 July 2024, relating to the Tax Practitioners Board (TPB), and “extend whistleblower protections to individuals who ‘blow the whistle’ about a related entity to us, where they believe the information may assist us in performing our functions or duties under the Tax Agent Services Act 2009 (TASA)”.

In November 2023, Australian Attorney-General Mark Dreyfus released a consultation paper on public sector whistleblower reform. Dreyfus pledged that “these reforms will address the underlying complexity of the scheme and what steps can be taken to provide effective and accessible protections to public sector whistleblowers”.

However, Brown says the key to success will be to conduct a review that has the right terms of reference, goes beyond issues that affect the federal public service and addresses the Corporations Act, the Tax Administration Act and other whistleblowing regimes.

Recent scandals such as the Robodebt automated debt assessment scheme and fraud related to the National Disability Insurance Scheme (NDIS) signal the need for a more coordinated whistleblowing protection strategy, Brown adds.

“Those cases confirm that the protections will only work if they are consistent and seamless across the different public sector and private sector regimes.”

Corporate and public sector leaders also have a crucial role to play.

In 2021, ASIC urged CEOs to review whistleblowing policies that could in some cases be “unclear, incomplete and inaccurate”.

LaBouchardiere has reissued that call, advising corporate sector leaders to:

• clearly articulate how and to whom a person can make a disclosure that qualifies for the legal protections for whistleblowers
• carefully update their whistleblower policy to reflect the whistleblower protection regime that began on 1 July 2019
• accurately describe the legal rights and remedies whistleblowers can rely on if they make a qualifying disclosure, including confidentiality, protection from detriment, compensation, and civil, criminal and administrative liability protection.

LaBouchardiere also emphasises to all potential whistleblowers that ASIC is there to help.

Brown agrees that leaders have a significant role to play, noting that many organisations are doing well with their whistleblowing policies.

“We know that a lot of companies and a lot of employers get it right,” he says.

“It is never only because of the law. It is usually because leadership in those companies or agencies, and especially the leadership of the governance professionals in those agencies, is strong.”

At the same time, Brown says it is essential to have strong legal frameworks to support corporate whistleblowing programs when things go wrong.

“It is really important that the law works effectively as a backup to those regimes.”

Handling disclosures

In 2024, ASIC published Good Practices for Handling Whistleblower Disclosures, a report that summarises best practice based on a review of the whistleblower programs of seven large firms.

The findings recommend that organisations:

• establish a strong foundation for the whistleblowing program – for example, through procedures and systems to embed the program’s requirements
• foster a culture and practices to support whistleblowers
• inform and train those involved in receiving or handling whistleblower disclosures about protecting whistleblowers and treating material confidentially
• monitor, review and improve the program, including seeking feedback from whistleblowers
• use information from whistleblower disclosures to address underlying harms and improve company performance
• embed senior executive accountability for the program
• create frameworks to entrench effective director oversight.

ASIC’s Claire LaBouchardiere encourages firms to review the good practices identified in the ASIC report “and consider how they can be scaled and tailored to suit their firm’s arrangements”.

Getting it right

In its Global Economic Crime Survey for 2024, PwC notes that proper whistleblowing programs can “increase the pressure on companies to learn of and react to allegations of misconduct quickly”.

Based on his experience in the Malaysian market, PwC’s Alex Tan says most whistleblowers are naturally nervous to report misconduct and just want to know that they can speak up without retaliation.

For companies or organisations considering putting in place practical policies to encourage and support whistleblowing, Tan suggests five key actions.

1. Avoid complicated “legalese”

A multi-page whistleblowing policy written in legalese is likely to deter many well-meaning whistleblowers from coming forward, according to Tan. “Keep it simple,” he says. “Write a policy of one or two pages in simple everyday language that people from the top to the bottom of the company can easily understand.”

2. Accept anonymous tip-offs

Tan says many companies mistakenly implement policies that reject or discourage anonymous tip-offs from would-be whistleblowers. “As a whistleblower, if I’m anonymous or not anonymous, it shouldn’t matter,” he says. “It is the quality of the information I provide in support of my whistleblower hotline that counts.”

Tan concedes that anonymity can make follow‑up investigations into complaints more difficult to pursue (and, in fact, legislation in some countries does not support anonymous complaints), but he notes that crime-reporting services such as Crime Stoppers in Australia have long benefited from anonymous informants.

3. Triage’ any complaints to verify authenticity

Although anonymity can lead to vexatious or unsubstantiated claims from disgruntled employees, Tan says good governance demands that companies should want to know everything. “Then it is up to your triaging processes,” he says.

4. Train your whistleblowing response team 

Tan endorses ASIC’s call for organisations to train the people responsible for handling whistleblowing reports and communicating with whistleblowers. This can help streamline the triaging process and ensure that whistleblowers are treated fairly and responsibly “because you’re often dealing with people who can be very emotional or reluctant to impart information”.

5. Demonstrate buy-in from the top 

Tan says leaders should “walk the walk” when it comes to a culture of reporting problems or incidents. That means CEOs and board members should sit in on staff training sessions to underline their support for whistleblowing programs. “They’re effectively telling employees that ‘I want you to report’.”

In Malaysia and some other South-East Asian countries, there are incidences where disgruntled or victimised staff resort to surat laying, or “poison pen” letters, taking aim at alleged wrongdoing by individuals or companies.

“They tend to be anonymous and there can be an overflow of them but, at the end of the day, someone who writes a poison pen letter is still a whistleblower,” says PwC forensics and risk partner Alex Tan.

“If there is a deluge of poison pen letters, that means there is a good chance that there could be some troubles within the organisation.”

Tan says the Malaysian Government has taken a proactive stance on whistleblowing, unveiling a policy a few years ago to permit anonymous whistleblower reports.

In May 2024, Prime Minister Anwar bin Ibrahim announced the country’s plans to offer rewards to whistleblowers as part of its 2024–2028 National Anti‑Corruption Strategy.

Such moves come as some other Asian nations seek to ramp up whistleblowing provisions. The 2023 Asia Pacific Conduct Watch Survey from Deloitte collated responses from 500 organisations throughout the Asia-Pacific region, including Japan, South Korea, Mainland China and Southeast Asia.

The report reveals that 70 per cent of respondents see whistleblowing as a way of improving an organisation’s culture of ethics and integrity, 66 per cent see it as a means of detecting fraud and other misconduct and about 60 per cent see it as a strategy to “foster a positive and transparent working environment”.

Acknowledging the importance of transparency, Tan says it is crucial for whistleblower hotlines or forums to be accessible to people at the lowest levels of an organisation.

“Generally, the people at the top know how to raise an issue. They have access to the board and all the rest of it, but it is the people on the factory floor, the lower level or junior staff who need that ability to raise concerns.”