World@Work: Workplace sexual harassment and whistleblower investigations

Kirsten

Hello and welcome to Ashurst's Legal Outlook. You're listening to the latest episode in our Employment World@Work series. My name's Kirsten Scott and I'm a partner in the Perth Disputes, Investigations and Advisory team here at Ashurst in Australia.
In this episode, we're looking at recent issues in the context of workplace investigations, particularly relating to whistleblowing and sexual harassment issues. I'm joined on the podcast by Crowley Woodford, Head of Ashurst's European Employment practice, Andreas Mauroschat, partner in our German Employment practice, Cristina Grande, who heads up our Spanish Employment practice, Norman Ibnuaji, Senior Associate in our Jakarta practice, and Jordan Cohen from our Paris practice. Welcome to all of you.

So we'll start in Australia where I'm based. Here, we're seeing a noticeable increase in both whistleblower and sexual harassment investigations. The increase in sexual harassment investigations isn't surprising and it continues a trend that started following the release of the Australian Human Rights Commission's Respect@Work Report in 2020, which was most recently followed by the release in March 2025 of the Commonwealth Government's Health and Safety (Sexual and Gender-based Harassment) Code of Practice.

If we turn to Spain to start with, Cristina, you've described the current experience in Spain as a "boom" of internal investigations, particularly relating to sexual harassment and harassment. What do you think is causing this "boom"?

Cristina

Yes, employers are becoming more and more aware that they need to take action to prevent these situations. The Organic Law of the Integral Guarantee of Sexual Freedom introduced in 2022 changes in the Spanish Criminal Code that increased the fight against sexual harassment and employers can be found guilty where sexual harassment takes place at work and they did nothing. So to avoid – or at least limit liabilities – employers must establish measures aimed at prevention and awareness raising and carry out internal investigations.

Kirsten

Thanks, Cristina. That reflects an interesting trend in Australia too with a focus on avoiding psychosocial risk and having an investigation process that avoids re-traumatising people who report issues for investigation. Jordan, I understand employee well-being is also a focus in France.

Jordan

Hi Kirsten. Yes, you're perfectly right. Even though internal investigations are not specifically governed by the French Labour Code, employers are still required to comply with key principles established primarily through case law. Recently, the French Labour Administration issued a practical recommendation aimed at ensuring that internal investigations are both effective and protective of employees' well-being. The main steps are:

• establishing an investigation committee;
• conducting interviews with the alleged victim and accused employee or employees and also potential witnesses;
• preparing the investigation report; and lastly,
• determining the outcome by making recommendations on potential disciplinary action.

Kirsten

Now those steps are pretty consistent with the approach in Australia too. What is different in France though is a recent decision where the French Court of Cassation recently held that implementing an internal investigation by the employer is not automatically required following a report of harassment by an employee.
What can you tell us about that, Jordan?

Jordan

Yes, you are absolutely right, Kirsten. There is a recent case law where an HR director had reported to be the victim of harassment. However, management did not initiate any internal investigation, which later led the HR director to claim that the employer had failed in its duty to protect his health and safety. The court rejected this claim. The judges noted that management had promptly addressed the dispute between the two employees by providing a response within three days, and then the judge concluded that the employer had not breached its safety obligation and was not required to conduct an internal investigation. So, this ruling highlights that while an employer may not always be legally required to conduct an internal investigation, they must still be able to demonstrate that appropriate measures were taken to safeguard the health and safety of the employee. However, it is to be noted that the internal investigation is still mandatory when a staff representative, such as the works council, reports a situation involving serious and imminent danger within the company.

Kirsten

So there's that well-being focus again. Now, Jordan, if the HR director had reported sexual harassment, rather than harassment, do you think the outcome would've been different?

Jordan

That's a very good question, Kirsten, and to be honest, it's a bit tricky to answer such a question with certainty. Sexual harassment is indeed a more complex and sensitive issue than moral harassment, which tends to involve more subjective elements, but the consequences can be just as serious as for the victim. From a strictly labour law standpoint, both types of harassment are generally addressed and sanctioned in the same way. So in principle, the outcome in a case of sexual harassment should be the same. That being said, in my personal opinion, the nature of the fact and the accusation could have led the Court to take a stricter approach and show less leniency towards the employer if in this case we are dealing with the case of sexual harassment.

Kirsten

Thanks, Jordan. That's interesting. Now we're moving to Indonesia. Norman, I understand that the Ministry of Manpower has issued specific guidelines for investigations related to sexual harassment. What do these guidelines require of employers?

Norman

That is correct, Kirsten. The Ministry of Manpower has issued Decree No. 88 of 2023, which provides the guidelines for preventing and handling sexual harassment in the workplace. While the decree does not explicitly specify the procedures for an investigation, it mandates that employers establish a sexual harassment prevention task force that will conduct the investigation. The task force must include representatives from both the employer and the employees. Additionally, similar to the regulations in Spain and France, there's also an emphasis on employee well-being. According to the decree, victims of sexual harassment are entitled to several forms of benefits. These include additional sick leave during recovery, removal of any negative employment appraisals which relate to the sexual harassment case and may include re-employment if the employee was dismissed, and also coverage of medical expenses.

Kirsten

Now moving from sexual harassment to whistleblowing, the increase in whistleblower complaints in Australia seems to be driven by different factors. One possibility is that the establishment of the National Anti-Corruption Commission in 2023 and the introduction of increased protections for whistleblowers in the public sector has had a flow-on effect into the private sector, despite in fact there being no substantive changes to private sector whistleblowing laws. One issue that's common to both sexual harassment and whistleblowing issues is the need to appropriately triage employee complaints. Crowley, I know that this is an issue you've been looking into closely. Why is the complaint triage process so important?

Crowley

Thanks, Kirsten. Yes, unpacking the allegations is going to be critical to identify each of the claims being made, and certainly in my experience, most complaints will contain several different allegations which are not necessarily clearly set out and sometimes are mixed together and muddled. Taking the time at the beginning of the process to carefully consider each of the allegations, identify them, and determining how they should be dealt with, for example, either under an internal grievance procedure or as a whistleblowing complaint, will save the employer time in the long run because the correct procedural routes will be followed in respect of each of those allegations.

Kirsten

And Crowley, how do these procedures differ in the UK?

Crowley

Well, in the UK, the internal grievance procedure will be followed where the complaint affects the employee individually, such as an issue relating to their employment contract or personal treatment in the workplace. And in these circumstances, the employee is seeking personal reparation of what's gone wrong for them. However, where an employee raises concerns such as bullying and harassment, maybe as a broader organisational concern, an employer in that case should be considering whether they should be utilising their whistleblowing procedure. And this is because the employee may state that those sorts of actions are, for example, health and safety risks and that they're worried about colleagues who have been subject to that wrongful behaviour. Essentially, their allegation goes beyond the personal and there is some sort of organisational change which is being sought.

Kirsten

So interestingly, we see different approaches here in Australia where bullying or harassment are raised as part of a broader organisational concern. Generally speaking, a whistleblower procedure will apply to reports of misconduct, or an improper state of affairs as defined in the Corporations Act, and most internal whistleblower policies adopt those definitions and the framework of that Act. Now, some organisations take a similar approach to what you've described, Crowley, and they interpret an organisation-wide concern as falling within that definition, being an improper state of affairs.

Others we find manage these concerns as safety issues and may, for instance, conduct workplace cultural reviews pursuant to the safety policies in place to deal with those issues. What we're also seeing is where multiple reporters raise individual complaints solely about their own treatment, but which collectively raise wider concerns, they might also be managed outside the whistleblower regime as a personal work-related grievance. What that's intended to do is to limit the application of the significant confidentiality obligations that apply under the statutory whistleblower scheme. However, where one person raises organisation-wide issues on behalf of others, it's still more usual to see those complaints managed as whistleblower complaints.

So Crowley, how similar are the grievance procedure and whistleblower investigation procedure in the UK?

Crowley

The procedures are not vastly different, but there are some notable differences, which I just wanted to flag. For these reasons, it is important for employers to ensure that each complaint is investigated following the correct procedure. If they don't, they may open themselves up to potentially increased compensation claims in the UK and generally when the internal grievance procedures are followed, employees are given more information and more rights through the process compared with a standard whistleblowing procedure. And to give you a flavour of the differences that exist, when the grievance procedure is followed, the employee will be invited to a hearing and they're allowed to bring a colleague or a trade union representative to that meeting.

The employee is entitled to receive a written decision and a written explanation for that decision, and they also have a right of appeal embedded in that process. In contrast to that, a whistleblowing procedure often doesn't have these type of processes and there may be good reasons for that. For example, confidentiality might be especially vital when an investigation meeting is held. So for example, bringing a colleague may not be a viable option there. Additionally, the employer doesn't have to report back to the whistleblower because it may be tricky to provide information on the outcome and the decision-making process in a sensitive investigation. Having said that, in practice, many employers' whistleblowing policies do provide for this to happen and that can lead to a level of discussion around what is appropriate disclosure to the whistleblower during that process.

Kirsten

And what are the consequences for the employer if they get these procedures wrong?

Crowley

Where allegations are dealt with as grievances rather than whistleblowing disclosures, an employer in the UK has to comply both with their internal grievance procedure and also a code issued by the Advisory, Conciliation and Arbitration Service, which is commonly known as ACAS, and the ACAS Code contains the steps which have to be followed when dealing with a grievance. They're essentially the same as those I've already outlined, being fair investigation, holding a hearing, allowing the right to be accompanied and providing written outcomes and an appeal. However, when any employers have not complied with the Code, any dismissal will be unfair and employee compensation that might ordinarily be awarded can be increased by the tribunal by up to 25%.

Kirsten

Wow, that's a significant increase, Crowley. Andreas, what's the position in Germany with respect to whistleblower versus other processes to raise workplace issues?

Andreas

Here in Germany, employees have two legal options to raise workplace issues. The first is to file a complaint under the General Equal Treatment Act, and the second is to report a violation under the Whistleblower Protection Act. Now, the Equal Treatment Act is a bit of a special situation tool, and that is available if employees experience discrimination based on race, gender, religion, disability, age, or sexual orientation. And opposed to that, the scope of permitted complaints under the Whistleblower Protection Act is much broader and it includes a wide range of legal violations including criminal and administrative offences, consumer rights violations, and a lot of other matters.

Kirsten

Now, I understand Germany has strict statutory timeframes under its whistleblower regime.

Andreas

Yes, Kirsten, that's right. There are strict deadlines. For example, employers have to confirm receipt of a whistleblowing report within seven days and let the employee know about any actions they've taken to address the matter within three months. In contrast, the Equal Treatment Act doesn't set any such specific deadlines and it's generally much less formal on procedure.

Kirsten

And what happens if an employer doesn't meet the timeframes?

Andreas

Well, there are no statutory fines under the Act for not meeting deadlines, but employers may well face damage claims from employees if they suffer any disadvantage.

Kirsten

Now, Cristina, let's come back to you. What are the critical issues for employers in Spain to be aware of when managing whistleblowers?

Cristina

Kirsten, it's important to bear in mind with regard to whistleblowers, or those who raised complaints, that as per Law 2/2023, which transposed the Whistleblowing Directive, those employees who file internal claims through the internal channels are protected against retaliation during the following years as from the end of any investigations carried out into their complaints. In practice, this means that any unjustified measure such as contractual modifications or dismissals motivated by previous complaints will be considered null and void.

For example, in the event of a dismissal, if it's declared null and void, the employee will have to be reinstated on the same conditions and will have to be paid the processing salaries (that is the salaries accrued between their dismissal and its reinstatement). In addition, those employees retaliated against may be entitled to damages compensation and the Company can be sanctioned with an administrative fine by the employment inspectorate of up to €225,018. So employers need to be cautious when taking actions against complainants.

Kirsten

Here in Australia, the key threshold issue for managing whistleblowers is ensuring that these confidentiality protections are complied with. Cristina, I understand it's similar in Spain and you've got a recent example of where this went wrong for an employer at some cost.

Cristina

Yes, Kirsten. Confidentiality is key. The principle of data minimisation must be observed and the anonymity of the whistleblower and information collected must be guaranteed during that process. The Spanish Data Protection Agency is also focused on these internal investigations. For example, in February 2025, a resolution of the Spanish Data Protection Authority was published, sanctioning a company with a fine up to €200,000 for non-compliance of one of the principles of data processing because the identity of the individuals, including names and surnames involved with internal investigation was shared by email with the Works Council and also with 15 other employees. So in Spain, we are recommending clients be really cautious with these aspects to avoid sanctions.

Kirsten

And Jordan, the situation is similar in France, isn't it?

Jordan

Yes, you're right. Kirsten. Special care should be taken when it comes to whistleblowers in France who benefit from special protection including immunity from criminal liability and protection against any employment retaliation, suspension or even termination of employment. Any disciplinary action taken against a whistleblower may be deemed null and void, and the employer could indeed face liability and be ordered to pay damages based on the prejudice suffered by the whistleblower.

Kirsten

Similar whistleblower protections also exist in Australia. Andreas, what about in Germany?

Andreas

Kirsten, there are very strict rules under the German Act when it comes to protecting the whistleblower's identity. As a fundamental principle, it is generally prohibited to disclose the whistleblower's identity without their specific and explicit consent. Now, that's the maximum level of protection that's possible. There are a few exceptions. For example, the identity of a whistleblower must be disclosed upon request of authorities and courts. Also, if a whistleblower intentionally or by gross negligence makes false accusations, their identity may be disclosed even without their consent. Moreover, they're liable for any damages resulting from such false reports. Now, this prevents malicious whistleblowers who hide behind the shield of whistleblower protection. It's worth noting though that the accused and other individuals concerned do not enjoy a comparable protection. Their identity can be disclosed under certain conditions even without their consent. In particular, the identity of the accused, say a manager accused of sexual harassment can be disclosed without their consent if that is necessary to conduct an internal investigation or to take disciplinary sanctions or other measures. Again, this never applies to the whistleblower who stays protected no matter what, unless they agree otherwise.

Kirsten

And I assume that confidentiality requirements are not nearly as stringent as for other workplace issues?

Andreas

That's right. Under the General Treatment Act, the confidentiality rules aren't nearly as strict. If an employee files a confidential complaint about discrimination with the designated employer's complaint office, their identity must be disclosed to the employer if the complaint seems justified, even against the will of that complainant. So complainants must expect their identity may be disclosed both internally and externally.

Kirsten

Norman, what about in Indonesia?

Norman

There are indeed protections for whistleblowers and justice collaborators in Indonesia. Justice collaborators are the suspects in criminal cases who cooperate with law enforcement to solve those cases.

The legal framework for this protection is provided by Law Number 13 of 2006 regarding the Protection of Witnesses and Victims. The law ensures that individuals who report criminal acts are entitled to various forms of protections. This include anonymity, physical security, legal assistance, and immunity or partial immunity from criminal or civil liabilities provided that, of course, their actions are made in good faith. The law also prohibits employers from obstructing or retaliating against employees who report the violations. Any attempt to intimidate or penalise whistleblowers may result in criminal liability for both individuals and corporations involved.

Five key institutions in Indonesia, which are the Witness and Victim Protection Agency, the Corruption Eradication Agency, the National Police Force, the Attorney General, and the Ministry of Law also issued a joint regulation, which provides a coordinated mechanism for whistleblower protection, aiming to ensure consistency in enforcement and safeguard institutional cooperation.

Kirsten

Now, that's quite a lot of institutions involved. Crowley, if we can come back to you and bring in another institution, are there any additional considerations if an employer is a company regulated in the UK by the Financial Conduct Authority or the Prudential Regulation Authority, that is, where it's within your financial services sector?

Crowley

Thanks, Kirsten. Yes, there are in relation to whistleblowing, the two regulators you mentioned, the FCA and the PRA, they're both regulators in the UK financial services industry, and they have put in place specific whistleblowing rules for certain firms that they regulate, which relate to UK deposit takers with assets of £250 million or more. The rules provide a framework so that firms in scope can take a consistent approach to whistleblowing based on that best practice.

Kirsten

And what do those rules require?

Crowley

So the regulatory rules provide that a firm must establish, implement, and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers. And interestingly, anyone can be a whistleblower. So for example, it doesn't have to be just an employee, it could be a customer or indeed an employee of another firm. And the FCA and the PRA definitions of reportable concern are very similar but not identical, and the definition is quite wide-ranging within that regulatory sector. It relates to the activities of the firm and includes information that would be a protected disclosure under the UK's usual statutory whistleblowing rules.

The information under the statutory rules relates to six topics, the most common being breach of a legal obligation, a criminal offence or the health and safety of an individual has been endangered. However, reportable concern goes further than this by including concerns of breach of, for example, the firm's policies and procedures and behaviour that harms or is likely to harm the reputation or financial well-being of the firm. And that results in a very broad definition, which means that individuals can use the whistleblowing arrangements to raise personal employment grievances provided that those relate to the regulatory wrongdoing of the firm that's being regulated.

Kirsten

That approach sounds similar to ours here in Australia under the Corporations Act, except we've got a carve out for the personal work-related grievances. Now, as we've talked about earlier, in practice, many employers still treat personal work-related grievances as a whistleblower disclosure, particularly where they form part of this broader whistleblower disclosure because it can be quite hard to extricate those parts out. Norman, I understand Indonesia also has specific rules for workplace investigations in the banking and financial services sector. Are these whistleblower related or are they broader?

Norman

The rules enacted by the Financial Services Authority are whistleblower-related. Kirsten. Generally speaking, financial services institutions in Indonesia must comply with various good corporate governance requirements that are more strict when compared to other sectors. One particular aspect is on fraud prevention. Pursuant to the Financial Services Authority Regulation Number 12 of 2024, financial services institutions are required to develop an anti-fraud policy and establish an anti-fraud task force.

The policy must be submitted to the Financial Services Authority for review, specifically regarding whistleblowing. The regulation provides that whistleblowers may report anonymously, are protected from retaliation, and they will be rewarded for a report that is proven right. The anti-fraud task force is mandated to implement the anti-fraud policy and report its implementation to the Financial Services Authority periodically every six months and no later than three business days after the occurrence of a fraud.

Kirsten

Now, unfortunately, we're nearly out of time. Does anyone want to share any final thoughts?

Crowley

Thanks, Kirsten. Just a couple of points and I'll be quick. Two points worth mentioning about whistleblower regimes specifically within the FCA, PRA environment. First, a range of communication methods have to be in place, for example, a dedicated phone line or email address for concerns to be reported to. And the second point is that firms must have a whistleblower champion and the champion is expected to be a non-executive director. As whistleblowing is a prescribed responsibility by the regulator, it means that there is an individual who is personally responsible for the effectiveness of the whistleblowing arrangements. The champion doesn't need to be involved in day-to-day handling of disclosures, but has to oversee the integrity, independence, and effectiveness of the firm's whistleblowing policies and procedures.

Kirsten

And that's all we have time for today. Thank you to Crowley, Cristina, Norman, Andreas, and Jordan, for your time today. It's been really interesting to hear your perspectives and experiences and to you, our audience, for listening. We hope you found this episode informative.

If you'd like to find out more about the issues raised in this episode of Ashurst's Legal Outlook, feel free to get in touch or visit ashurst.com. To ensure you don't miss any future episodes of Legal Outlook, you can subscribe now on Apple Podcasts, Spotify, or your favourite podcast platform. And while you're there, please feel free to keep the conversation going and leave us a rating or a review. Thanks very much for listening, and goodbye for now.