The Guardian recently reported on disclosures made to it by a whistleblower alleging misconduct in the data collection activities of McNair yellowSquares (McNair). This follows the Senate Economics References Committee’s recent recommendation that Australian Securities and Investments Commission (ASIC) should introduce a system to provide cash or other compensatory incentives for whistleblowers (see previous article). Now more than ever, companies need to improve their whistleblower management processes and systems.

McNair

In late August this year, claims of improper collection and misrepresentation of data by McNair on Australian Electoral Commission (AEC) and Department of Defence projects were brought to the attention of the Guardian, which it then published under the public interest provisions of the whistleblower laws.

The whistleblower’s claims included that:

• the whistleblower had been instructed by McNair to fabricate data collected for the AEC during the Voice referendum about the reach of the AEC’s information advertising campaign to the indigenous community
• a military recruitment survey conducted by McNair contained incorrect data. The whistleblower said that they were directed by McNair to fabricate research data about potential defence recruits.

Late last year, the whistleblower made both their disclosures internally to McNair. Dissatisfied with McNair’s response, the whistleblower made a disclosure to ASIC in March 2024. ASIC also declined to investigate the disclosure because the allegations were not in ASIC's investigative “remit”. Because of the internal disclosures made by the whistleblower, they remained eligible for whistleblower protection when they made their public disclosure to the Guardian.

The impact on McNair from the public disclosure has been very damaging, and happened very quickly. One day after the Guardian’s publication, the government suspended all government campaign work conducted by McNair. The Department of Finance wrote to all government departments asking that all suppliers suspend any work on government contracts being undertaken by McNair and not enter into any new arrangements with McNair until informed otherwise. A separate internal investigation is also being conducted by the government into the data collected by McNair the subject of the whistleblower’s disclosure.

The McNair case highlights the importance of:

• treating disclosures made by whistleblowers seriously and investigating them quickly and thoroughly
• establishing open channels of communication with whistleblowers to manage their expectations and allow early identification of any potential dissatisfaction with the handling of the investigation (and the risk of external escalation)
• communicating proactively with other stakeholders involved in the disclosure once the investigation is concluded, particularly where there is reputational risk.

The McNair disclosure demonstrates how damaging the whistleblower regime can be where a public interest disclosure is made. There is no obligation on the whistleblower to notify a company before “going public” and nothing a company can rely on to prevent a public disclosure from being made. McNair’s circumstances expose the unfortunate, wide-ranging implications of what may occur if a whistleblower disclosure is mishandled and the whistleblower approaches the media.

What next?

The government is focussing once more on the whistleblower regime and protections. The laws under the Corporations Act are due for their 5-year review. The Senate Committee’s report criticising ASIC’s enforcement effectiveness included an analysis of the regulator’s role in whistleblower matters. The government is also looking into reforms to the whistleblower regime in the public sector.

With these criticisms in mind, the government may, as part of the reform process, give serious consideration to the recommendations made by industry bodies advocating for the establishment of an independent whistleblower protection authority to walk would-be whistleblowers through the disclosure process. The establishment of such an authority will likely increase the number of disclosures made by whistleblowers which may in turn increase the number of disclosures that make their way to the media (similar to the one in McNair). 

It is prudent to be prepared for the risks associated with a public disclosure. If you find yourself in a position similar to McNair, facing media, political and client scrutiny, it is important to:

• seek legal advice promptly to manage a whistleblower investigation into the disclosure and advise on the findings of the investigation
• appoint an experienced investigator (ideally one that is external and independent) to undertake a confidential investigation into the disclosure
• get on the front foot in relation to communication management (from an internal, external stakeholder and public perspective) with the help of crisis communications experts.

Companies should also consider conducting a proactive health check on their whistleblower compliance framework, policies and processes. The reputational risks associated with mismanaging a whistleblower disclosure are far too great to ignore.