Recent insights on the whistleblowing protections under the Corporations Act

Since the whistleblower protections in the Corporations Act 2001 (Cth) were expanded from 1 July 2019, there has been limited case law dealing with how the enhanced protections operate. However, the first quarter of 2025 has seen two decisions – Mount v Dover Castle Metals Pty Ltd [2025] FCA 101 (DCM Decision) and Reiche v Neometals Ltd (No 2) [2025] FCA 125 – provide important guidance.

Both decisions confirm the Court will engage extensively with the factual circumstances of the case and carefully weigh up the evidence adduced by the parties to determine whether a company has breached the whistleblower protections under the Act. This highlights the importance of:

• maintaining robust records (including contemporaneous records) relating to the management of whistleblower matters and any employment processes involving whistleblowers, including decisions to terminate their employment; and
• ensuring people involved in making decisions in relation to whistleblower disclosure management and employment processes are ideally separate and distinct, limited in number, and make their decisions lawfully and based on legitimate business reasons.

The decisions provide useful commentary on various aspects of the enhanced protections, which we detail further below, including:

• the scope and interpretation of the whistleblower protections;
• what may amount to a reportable "improper state of affairs or circumstances";
• what is required for a whistleblower to have reasonable grounds for a suspicion of misconduct or an improper state of affairs or circumstances;
• whether a disclosure will retain its confidential nature where it is made to both an eligible and a non-eligible recipient;
• how the burden of proof operates in respect of victimisation claims; and
• what forms of relief are available to a whistleblower alleging a breach of the protections.

Background to the DCM and Neometals decisions

DCM decision

The DCM Decision involved a former CEO of a mining company, Dover Castle Metals Pty Ltd, who alleged that the company had breached the whistleblower protections under the Act by, firstly revealing his identity as a whistleblower in breach of the confidentiality protections, and secondly, by terminating his employment, demanding the return of his company car and damaging his reputation and financial position in breach of the victimisation protections. It was also alleged Dover Castle Metals had breached his employment contract by terminating his employment summarily.

The CEO sought damages for breach of contract, declarations that Dover Castle Metals and its directors had contravened the confidentiality and victimisation protections under the Act, and compensation on the basis his contract was terminated because of his disclosures. He also sought orders under the Act for exemplary damages and pecuniary penalties.

The whistleblower was appointed as Dover Castle Metals' CEO on 18 March 2021. Days before accepting the appointment, the CEO inspected the company's mine and identified a number of safety risks. Two days after the CEO began working with the company, he asked for a report on a safety concern from one of the directors who worked for Dover Castle Metals as a geologist. On 4 April 2021, the CEO emailed the directors regarding his whistleblower disclosures. Within days, DCM summarily terminated his contract – three weeks into its term.

Ultimately, the CEO's whistleblower protection claims against the company failed. The Court found that Dover Castle Metals dismissed the CEO due to its belief that he had engaged in misconduct, and not due to a belief or suspicion that he had raised a whistleblower disclosure.

Neometals decision

The Neometals Decision involved a former employee who brought a claim against Neometals Pty Ltd, alleging the company had engaged in detrimental conduct against him in breach of the whistleblower protections by making his role redundant, terminating his employment with payment in lieu of notice, rejecting his time-in-lieu (TIL) claim, and bullying and harassing him, following him making whistleblower disclosures.

The whistleblower alleged he had made six protected disclosures relating to the management, business or affairs of the company, including unlawful acquisition and exploitation of the intellectual property of a third party to obtain a business advantage, exposure to strategic risks in relation to a joint venture and an associated conflict of interest, and a forged signature on a document.

The former employee sought an injunction to restrain Neometals from engaging in detrimental conduct, reinstatement to his position, compensation for loss, damage and injury as a result of the alleged detrimental conduct and exemplary damages.

Neometals ultimately showed that the employee's role had been made redundant as part of a restructure for reasons unrelated to his disclosures. It was found that terminating the employment with payment in lieu of notice amounted to detrimental conduct however this was not done for reasons relating to his disclosures.

The Court also held that the rejection of the employee's TIL claim did not amount to detrimental conduct, as it was not arbitrary, capricious or unreasonable. Further, the Court was not satisfied that the employee had made out that Neometals caused detriment to him in the form of bullying or harassment.

What is considered an "improper state of affairs or circumstances"?

Under the Act, whistleblowers can make a protected disclosure about conduct they reasonably suspect may amount to misconduct or an "improper state of affairs or circumstances".

While misconduct is defined by the Act to include fraud, negligence, default, breach of trust and breach of duty, an improper state of affairs or circumstances is not defined, with ASIC previously releasing guidance stating it is an "intentionally broad" term. This has left employers with a great deal of uncertainty in determining whether a report of conduct may be protected as a whistleblower disclosure or should otherwise be triaged into other grievance channels.

Both decisions confirmed that an "improper state of affairs or circumstances" should be read broadly and in line with its ordinary meaning – meaning it can include conduct that is "not in accordance with truth, fact, reason or rule, abnormal, incorrect, inaccurate, erroneous or wrong." This still maintains a relatively broad interpretation of the term and leaves employers to continue navigating grey areas when considering if a disclosure of information will be protected.

However, in the Neometals decision, the Court provided further helpful commentary on the scope of an "improper state of affairs or circumstances", having regard to the purpose of the whistleblower protections under the Corporations Act and statutory interpretation principles. Importantly, the Court concluded that information does not qualify for protection if it would not engage or assist the regulatory functions of ASIC, APRA or another Commonwealth authority in relation to a company or a related body corporate. The Court observed in this context that the underlying purpose of the whistleblower protections is directed to compliance with and enforcement of Commonwealth laws. The Court further clarified that this may capture alleged conduct that does not involve a contravention of any particular law but amounts to systemic issues that may assist a regulator in the performance of its functions.

In a similar vein, the Court held that a person who causes detriment to a whistleblower (such as terminating their employment) may plausibly not have a reason to believe or suspect that they have made a protected disclosure where the information disclosed by a whistleblower does not obviously or readily engage or assist the regulatory functions (compliance, enforcement and/or discipline) of ASIC, APRA or another Commonwealth authority in relation to a company or related body corporate.

In the decisions, the following matters were found to amount to misconduct or an improper state of affairs or circumstances:

DCM decision

Disclosures which concerned alleged "widespread fraud" and "significant safety risks" on a mining site, including in respect of:

• a director and worker of Dover Castle Metals not revealing their personal interests in company projects (including directorships and shareholdings held in other companies), a worker of Dover Castle Metals working for another company and not at the Dover Castle Metals site, the company owning guns, and a director engaging in criminal activity by seeking and receiving secret commissions; and
• open and unfenced mine shafts which could compromise the safety of workers on the site, lack of development or implementation of a safety management system for the mine, absence of a safety box or register of keys, and the presence of guns at the mine site when alcohol was consumed at the site.

Neometals decision

Disclosures which concerned alleged "unresolved high-risk items" which were identified within the Neometals operations, particularly as they related to their joint venture with a separate entity, including in respect of:

• a lack of corrective action to address ongoing poor governance and substantial risk, which jeopardised compliance and ethical standing and potential financial exposure;
• resistance regarding the implementation of governance policies aimed at strengthening the joint venture's operational framework; and
• significant risks associated with the joint venture, which were identified by the board, but were unaddressed, which left Neometals vulnerable to significant financial, operational and legal risks.

In the DCM Decision, a number of other disclosures that the CEO sought to characterise as protected whistleblower disclosures were not accepted as such, including:

• allegations of insubordination, where the CEO raised concerns about inadequate health and safety measures on site and complained that a director had not followed his instructions;
• requests for reports or information from employees; and
• requests for assistance from board members.

Similarly in the Neometals Decision, it was found that strategic or commercial risks regarding how a joint venture was operating, which were raised in board meetings, did not readily or obviously involve disclosable matters. Evidence was given by members of the board that the risks identified addressed commercial strategic issues between Neometals and a third party, were not new issues and had been the subject of discussions at board meetings from time to time, and the board had developed strategies to address them. The Court noted there was no evidence the individual had raised matters with the board that indicated the company was not in compliance with its ASX requirements as to governance and disclosure or any other law. It was also noted that none of the presentations made to the board were identified as being a whistleblower disclosure.

What is considered "reasonable grounds for suspicion"?

Before any disclosure qualifies for protection under the Act, a whistleblower must have reasonable grounds for forming a suspicion that there has been misconduct or an improper state of affairs or circumstances. The DCM Decision confirms this requires "the existence of facts which are sufficient to induce that state of mind in a reasonable person". This does not require a disclosure to set out the relevant "reasonable grounds", but there must be some evidence supporting the allegations.

Further, matters that are not known to a whistleblower at the time they make a disclosure, but rather come to light at a later date, are not relevant to the assessment of whether the whistleblower had "reasonable grounds" to suspect the matters which are the subject of their disclosure. Rather, whether a whistleblower has "reasonable grounds" for suspecting the matters they have raised can only be assessed based on what the whistleblower actually knew at the time their disclosure was made.

The Court in the Neometals Decision summarised that the whistleblower must subjectively possess grounds to suspect the relevant information, and there must be objectively reasonable grounds for that suspicion. The Court went on to state that it is relevant whether a person who is accused of engaging in detrimental conduct against a whistleblower also believed or suspected the whistleblower subjectively possessed grounds for having a suspicion of a disclosable matter and, if so, whether those grounds objectively would be reasonable grounds for that decision. The Court said that inquiry is informed, in part, by the nature of the information subjectively possessed by the whistleblower and the extent to which it obviously and readily concerns misconduct or an improper state of affairs or circumstances.

When a disclosure is made to both an eligible and a non-eligible recipient

The DCM Decision confirms that, where a whistleblower makes a disclosure to both an eligible and a non-eligible recipient, whistleblower protections can still apply to the disclosure made to the eligible recipient.

The DCM Decision did leave open the possibility of an argument that where a whistleblower discloses allegations to a non-eligible recipient (as well as an eligible recipient), they have waived their right to the confidentiality protections under the Act. As this issue was not specifically raised in the matter, no concrete findings were made. It may be that, in future, clarity is provided as to potential waivers of confidentiality but, at this stage, employers should continue to assume that whistleblower disclosures must be treated strictly confidentially notwithstanding any further or related disclosures made by the whistleblower that are not protected.

In the DCM Decision, the Court also noted that where a disclosure containing confidential information about alleged misconduct or an improper state of affairs is made to an non-eligible recipient, it may be open to the company to terminate the discloser's contract on the basis that the disclosure was a breach of their contract. Conversely, the Court said no action could be taken against the discloser on the basis that confidential information is disclosed to an eligible recipient.

In light of the above, it will be important for companies to ensure that senior staff who may qualify as eligible recipients for the purpose of the Act are clearly defined and aware of their obligations as a potential eligible recipient, including how to recognise and handle a whistleblower disclosure. This will assist with reducing the potential for inadvertent breaches of the whistleblower protections.

Disclosing the substance of a whistleblower's disclosure

In the DCM Decision, the CEO alleged that Dover Castle Metals had breached his confidentiality protections under the Act by disclosing his identity as a whistleblower. The CEO's allegation was based on the fact that individuals who were not recipients of his disclosure had become aware of the substance of his disclosures.

Specifically, the CEO alleged that an eligible recipient who had received the CEO's disclosure through an email, had disclosed the fact that the CEO had made a qualifying disclosure, or information that could have led to the identification of the CEO as the person who made the disclosure, to other directors of the company. The Court found that there was not enough evidence to substantiate this and that the claim was based on mere speculation. This included the fact that there was no phone log of the alleged conversation/s between the eligible recipient and the other director/s, no conversation recordings of the alleged conversation between the eligible recipient and the other director/s, and no evidence of the breach in the documentary evidence adduced.

The DCM Decision also confirms the Act does not prohibit disclosing the existence of a whistleblower report or disclosing information provided by the whistleblower where it is not likely to lead to the identification of the whistleblower.

Whether or not the substance of a disclosure may reveal likely identifying information is not always clear and practical challenges can arise in addressing disclosures where the nature of allegations raised or the surrounding circumstances have the potential to lead to the disclosure of a whistleblower's identify. The optimal approach is to ask the eligible whistleblower for their consent to disclose identifying information from their disclosure. However, where consent is not received, there can still be options for how a company can progress an investigation or review into the disclosures with appropriate de-identification.

Notably, a company can still disclose certain information that does not reveal the identity of the whistleblower where it is reasonably necessary for the purposes of investigating the matter and all reasonable steps are taken to reduce the risk that the whistleblower will be identified as a result of the disclosure of the information.

While the Act does not impose an obligation upon employers to conduct an investigation after a disclosure which qualifies for protection is made, public and private companies must have a policy that sets out information regarding how they will investigate disclosures that qualify for protection. In the Neometals Decision, the Court noted that, practically, company policy documents are likely to impose some level of obligation to investigate.

Companies can seek to reduce the risk of identifying a whistleblower by, among other things, removing the whistleblower's name, position title and other identifying details from information relayed from their disclosure. However, these steps may not definitively remove the risk that a whistleblower is likely to be identified and care should be taken when disclosing information for the purposes of an investigation process where a whistleblower has not consented to the disclosure of identifying information.

Whistleblowers cannot seek pecuniary penalty orders for breaches of the confidentiality and victimisation protections

The DCM Decision confirms that whistleblowers cannot seek pecuniary penalty orders under the Corporations Act for breaches of the confidentiality and victimisation protections – their only avenue is to seek general declaratory relief from a court, or compensation and other specified remedies for a breach of the victimisation obligations. Only those expressly authorised under the Act to pursue pecuniary penalty orders, such as ASIC, are entitled to do so.

While individuals cannot seek pecuniary penalty orders under the Act for breaches of the confidentiality and victimisation protections, moving forward we are expecting to see increased regulatory action in this space. For example, ASIC has noted that governance and directors' duties failures are going to be a key focus area as part of their enduring priorities for 2025 and has previously acknowledged in guidance that whistleblowers provide ASIC with important information and help ASIC enforce the laws it administers and to address and prevent harm to consumers.

Employers can continue with performance management and termination processes

While fact dependent, both decisions clarify that, where an individual makes a whistleblower disclosure, employers can carry on with their performance management and termination processes against the individual so long as there are clear and valid reasons for that action, and any action associated with their process is not based wholly or partly on a belief or suspicion that the individual has made a whistleblower disclosure.

Onus of proof

Where a whistleblower is seeking to make out a breach of the victimisation protections, the onus of proof initially rests with the applicant to prove that there is a reasonable possibility that the respondent engaged in detrimental conduct. However, once that burden is met, the onus shifts to the respondent to prove that they did not take detrimental action against the applicant due to the belief or suspicion that the applicant made, may have made, propose to make or could make a protected whistleblower disclosure.

In the DCM Decision, after heavily weighing up the evidence adduced by both parties, the Court held that the decision to terminate the former CEO's employment was not linked to his whistleblower disclosures, as there was no direct evidence that the decisions-makers had an awareness of the CEO's disclosure at the time the decision to terminate the CEO's employment was made. Rather, the evidence showed decision-makers only became aware of his whistleblower disclosures after the former CEO had brought the claims against the company.

Specifically, the Court accepted that an eligible recipient had not read an email containing the CEO's whistleblower disclosure. The Court also drew inferences that other decision makers were not aware of the CEO's whistleblower disclosures, as it would have been expected that they would have referred to the matters raised in the disclosures in the board meetings or in email or texts sent between them before the CEO was dismissed, particularly as they had been accused of serious matters. The absence of any evidence to suggest that the decision makers were aware of the CEO's disclosures fortified the Court's view that the company's reasons for terminating the CEO's employment did not include any belief or suspicion that he had made a disclosure which qualified for protection.

Similarly in the Neometals Decision, the Court found that, although the individuals who recommended that the employee's role be made redundant did have a belief or suspicion that he had made a disclosure, there was no evidence that the members of the board, who decided to make his role redundant, were aware that the employee had made disclosures or may have made disclosures which qualified for protection at the time the redundancy decision was reached. It was further found by the Court that the individuals who recommended the employee's role be made redundant were not motivated by a belief or suspicion that a whistleblower disclosure when making their recommendation.

As is well established, ignorance of the law is not a defence, which meant that had the relevant decision makers being aware of a disclosure or potential disclosure at the time of making their decision, but unaware of such a disclosure attracting whistleblower protections, a decision to take detrimental action may still have been in contravention of the protections. Of course, a decision maker may be aware that a whistleblower has made a protected disclosure (or may have made, proposes to make or could make a protected disclosure) when deciding to take action that is detrimental to the whistleblower, so long as the reasons for that decision to take that action are not wholly or partly based on that protected disclosure.

Evidence required to discharge onus of proof

The Neometals Decision held that direct evidence from a person who engaged in the detrimental conduct, which is accepted as reliable, is capable of discharging the onus of proof. The Court added that it is necessary to have regard to all of the circumstances and evidence in order to reach a conclusion about a person's state of mind in this context.

The Neometals Decision also observed that difficulties can arise where the decision to engage in detrimental conduct can be contributed to the state of mind of more than one person or the board of directors as an organ of the company. The Court held that if just one person or member of the board reached the decision partly, or in whole, due to a belief or suspicion that the whistleblower had made a protected disclosure, the whole decision will be tainted, and therefore in breach of the whistleblower protections under the Act.

In the DCM Decision, the Court noted that greater weight is usually given to contemporaneous documents than oral accounts, unless the oral accounts are supported by contemporaneous documents. The Court highlighted that oral accounts may be less reliable as, in the process of taking witness statements, memories may be created rather than restored. This emphasises the importance of good record-keeping when dealing with whistleblowers and related employment processes.

What will amount to detriment

The Courts in the decisions gave consideration to what may amount to "detriment" under the whistleblower provisions in the Corporations Act and reached the following findings:

DCM decision

• Terminating the CEO's employment was detrimental conduct, as it was common ground between both parties that Dover Castle Metals had dismissed the CEO from his employment, and that the dismissal had caused him a detriment.
• The demand for the return of the company car did not amount to detrimental conduct. The detriment suffered was the termination of the contract, and with it, the right to possession of the vehicle, and not, as the CEO alleged, the "forcible" towing of the company's car from his property.
• Disparaging remarks did not amount to detrimental conduct. This is because, notwithstanding that it was possible that certain individuals thought less of the CEO after certain remarks were made, the Court was not satisfied that the CEO had proven that his reputation was in fact damaged by defamatory remarks.

Neometals decision

• Terminating employment immediately with payment in lieu of notice was detrimental conduct, on the basis it reduced the period in which the employee would otherwise have had to find employment in order for him to satisfy a visa condition. However, it was found such detrimental conduct arose in this case because the employee had not engaged with Neometals in relation to his employment and was not in connection with a whistleblower disclosure.
• Rejection of the TIL claim was not detrimental conduct where there was no contractual entitlement to TIL in this case, and there was no arbitrary, capricious or unreasonable rejection of the claim.
• While bullying and harassment can amount to detrimental conduct, in this case there was no bullying and harassment.

The breach of contract claim

In addition to the whistleblower allegations, in the DCM Decision, the former CEO also alleged that Dover Castle Metals had breached his contract by summarily dismissing him. Dover Castle Metals alleged it summarily terminated the CEO's employment because his conduct, which included allegedly being complicit in the improper removal of directors from a Board meeting against their will, breaking down cohesion of the board, misusing company funds to engage legal representation without the authorisation of the Board, and disclosing confidential information to a former director, amounted to a breach of his duties to Dover Castle Metals.

In considering this matter, the Court determined that Dover Castle Metals did not have a valid reason to summarily terminate the CEO's employment because, although it held suspicions that the CEO had engaged in conduct that breached his duties, it did not have a sufficient foundation to sustain them. This conclusion is important when considered in light of the findings above that the termination of the CEO's employment was in no way connected to the whistleblower disclosures because, even where an employer is ultimately unable to establish that it had a valid reason to summarily terminate an employee, the Court may still determine that the decision to terminate was not in connection with a whistleblower's disclosure.

While the Court found that Dover Castle Metals had breached the contract of employment by summarily terminating the CEO, it also held that he had mitigated any loss suffered as a result of his termination, as he had earned more through the income of his consultancy company than he would have had he continued in his employment with Dover Castle Metals, resulting in the CEO being awarded no damages or compensation as a result of his claims.