C-Suite Workshop: Modern Slavery, Anti-Bribery & Corruption, Privacy and Whistleblowers presented by Stephen Booth and Peter Stewart at Coleman Greig, Parramatta

1. Modern Slavery, Anti-Bribery
& Corruption, Privacy and
Whistleblowers
Peter Stewart, Principal/Director and
Stephen Booth Principal Lawyer

2. Our Services
Commercial Services
Private Services
Commercial Advice
Corporations Law
Mergers & Acquisitions
Franchising
Intellectual Property
Employment Law & WHS
Business Migration
Competition & Consumer Law
Debt Recovery & Insolvency
Commercial Litigation
Dispute Resolution & Mediation
Commercial Property – Sales & Leasing
Property Law
Building & Construction
Business Succession Planning
Public Notary Services
In-House Training & Compliance Services
Family Law
Family Law Mediation
Wills & Estates
Probate & Administration
Succession Planning
Conveyancing
Retirement Villages

3. Member of

4. CG In-House Training
Performance Management, Feedback and
Managing Terminations
Behaving Badly in the Workplace
Competition Law: What is acceptable,
and what to do if the ACCC calls
Consumer Law: How not to be misleading
or deceptive
A Complete Guide to Credit Management
Directors’ Duties: How to comply and
manage the risks
Protecting Intellectual Property and
Confidential Information
A series of seminars for managers and employees:

5. OFFICE LOCATIONS
Parramatta
Phone:
+61 2 9895 9200
Norwest Baulkham Hills
Phone:
+61 2 9895 9343
Penrith
Phone:
+61 2 9895 9300

6. Upcoming Events
Employment Law Workshop
Terminations: WHS, Drugs and Alcohol
Presented by Stephen Booth and Anna Ford
Tuesday, 7 May 2019
Coleman Greig Parramatta Office
Accountants and Financial Planners Briefing
Headwinds in the Property Market: Weathering the storm
with your clients
Presented by Andrew Grima
Friday, 12 April 2019
Penrith RSL Club

8. to access the presentation after the event.
Follow Coleman Greig Lawyers on

9. Modern slavery &
Bribery and corruption
Stephen Booth Principal Lawyer

10. Modern slavery
legislation and compliance

11. Context
The general context includes:
• 7/11 and franchisees exploiting workers
• other serious underpayment cases
verging on slavery
• vulnerable workers legislation attacking
underpayments in franchise chains and
within company groups
• big business using the cheapest
contractors or labour hirers – and the
workers being exploited

12. Context
• labour hire regulation:
Qld
Vic
SA
• Migrant Worker Taskforce: recommends Federal legislation – labour hire
regulation for horticulture, cleaning, security, meat processing
• and increased penalties and enforcement powers akin to ACCC

13. Modern slavery – NSW legislation
• companies with turnover over $50m
• with employees in NSW, engaged in supplying goods and services for gain,
• obligation to report on steps taken to ensure supply chain does not involve
modern slavery, areas of risk, steps taken to manage risk, training
• modern slavery defined as committing a variety of offences under Crimes
Act, Criminal Code Act, Human Tissue Act: slavery, servitude, forced
labour, human trafficking, debt bondage, sexual servitude
• penalties up to $1.1m for failure to prepare or publish statement or
publishing statement including false or misleading information
• government agencies mandated to take reasonable steps to ensure goods
and services procured are not the product of modern slavery
• Regulations awaited to put more flesh on the bones

14. Modern slavery – Federal legislation
• effective 1 July 2019: first report for 2019-20 if that is FY
• Australian resident companies with revenue over $100m
• and resident trusts and corporate limited partnerships, and other
partnerships formed or resident in Australia
• obligation to report annually
• public register
• report on risks, actions taken including assessment, due diligence,
remediation, policies and processes, training
• no penalty (but if there is a change in government …)
• covers “serious exploitation” – not mere substandard working conditions
or underpayment

15. Modern slavery in Australia
• chef living in storeroom, washing in bucket:
Ram v D&D Indian Fine Food [2015] FCCA 389
• fruitpickers, trolley collectors, cleaners
• passports and visas held by employer …
• having company at the ATM …
• repercussions back in the village
• cultural networks

16. Modern slavery in Australia – how is this
supposed to work?
• a reporting obligation, not an obligation to do anything or to be perfect
• but the report is intended to assist consumers to choose
• and to focus businesses on looking for and removing risks in their supply
chains
• and publicity will spread the word and create an incentive to do better
• to do the report you have to make enquiries
• and the people of whom enquiries are made will not have $50m or
$100m turnover
• so the reach of the legislation will spread

17. Supply chain due diligence: what to do?
• Dept of Home Affairs Modern Slavery Act 2018 – Draft Guidance for
reporting entities
• www.homeaffairs.gov.au/how-to-engage-us-subsite/files/draft-modern-
slavery-act-reporting-entity-guidance.pdf
• out for consultation prior to final version
• emphasis on risk-based approach: assess risks and address most
significant
• more a matter of being actively engaged than having solved all problems –
at least in the early period of operation

18. Modern slavery – Federal legislation
Risks:
• you operate a factory using exploited labour
• you demand the cheapest possible labour and ignore evidence of
exploitation, or turn a blind eye to costs which prove exploitation
• you set unreasonable targets for delivery, which can only be met by
exploitation
• you sell products containing minerals coming from a country or region
known to use forced labour
• you fund overseas infrastructure and the local client uses contractors who
use forced labour
• reporting requires a scoping exercise, working off a list of risk factors and
making enquiries
• Australian or 1st World supply less risky – 3rd World more risky

19. And down the supply chain …
• companies having to report will want you
to guarantee your suppliers are clean
• codes of conduct to be complied with
• disclosure required: eg tell me who your
suppliers are and their addresses
• IP and confidentiality issues

20. Individual responsibility:
What to do?
• don’t recommend dodgy practices
• dissociate yourself from any you
find or which others propose
• dissociate yourself on the record:
– paper trail (emails, reports,
minutes …)
– refuse to participate?
• resign?

21. Anti-bribery & corruption
legislation

22. The law and the risks
• bribery and corruption illegal in
Australia
• AND OVERSEAS: conduct in
Australia, or outside Australia by
Australian company, citizen or
resident – Australian Criminal Code
• penalties for individuals of up to 10
years imprisonment and fines of
$2.1m
• penalties for corporations up to
$21m, three times the benefit
derived or 10% of annual group
turnover.

23. Improper payments
• paying or offering money or other
things of value with the purpose of
retaining or obtaining business
• direct or indirect (eg if channelled via
a third party)
• gifts, loans, services, shares, travel,
future employment …
• minor “facilitation payments” to
ensure routine things get done may be
OK (get advice before proceeding)

24. Foreign official
• elected officials
• government employees
• employees of government enterprises
• employees of international organisations
(UN, WTO, WHO, EU etc)
• employees, contractors, consultants
• all broadly defined: eg academics at
universities?
• and this can be very grey overseas

25. Risks
• unusually high or last-minute commissions, or commission recommended
by the government official
• commission by cash payment, payment out of the country, payment in
advance, payment split between different people
• unusually high price or price put up at customers instigation
• agents being totally inexperienced or asking for secrecy
• rumours, bad vibes …

26. Proposed legislation
• Crimes Legislation Amendment (Combatting Corporate Crime)
Bill 2017(Cth)
• strict liability for failure to prevent, detect and respond to
potential corruption: if associate convicted company liable
unless adequate prevention measures proven
• government to publish guidance on prevention?
• encourages corporate culture of compliance
• Deferred Prosecution Agreements: akin to enforceable
undertakings to allow prosecutors to make arrangements with
accused companies for remedial action to avoid prosecution
• encourages self-reporting to obtain leniency

27. Cost of erring: Securency
• 1999-2004: bribes to officials at note-issuing authorities in
Indonesia, Malaysia, Vietnam and Nepal - success fee
commissions paid, knowing some would be paid to officials
• RBA subsidiaries paid nearly $23m in penalties
• CEO: conspiring to bribe foreign officials in Malaysia and
Indonesia, and false accounting: 3 years suspended
• CFO: false accounting to conceal commissions: 6 months
suspended
• Managers: false accounting : 3 months suspended
• KL employee: 30 months suspended after 3 months in gaol
during extradition

28. Privacy and Whistleblowers
Peter Stewart, Principal/Director

29. 5 Minute Update on

30. a. Collection, storage and use of Personal Information governed by Privacy
Act 1988 ('Act'), Healthcare Identifiers Act 2010 ('HI Act'),My Health
Records Act 2012
b. Act enforced and monitored by the Office of the Australian Information
Commissioner (‘OAIC’)
c. Personal Information defined:
i. “… information or an opinion, whether true or not, and whether
recorded in a material form or not, about an identified individual or
an individual who is reasonably identifiable”
ii. eg: name, signature, address, phone number, DOB, Medicare
Number, TFN, medical records, bank details, commentary/opinion
about the person.
iii. Generally excludes employee records in private sector

31. e. Schedule 1: 13 Australian Privacy Principles (APPs):
• The open and transparent management of personal information
• Obligation to take reasonable steps to implement practices and
procedures and systems to ensure compliance (including having a
privacy policy)
• An individual having the option of transacting anonymously or using
a pseudonym where practicable
• The collection of solicited personal information and receipt of
unsolicited personal information including giving notice about
collection
• How personal information can be used and disclosed (including
overseas)

32. • Maintaining the quality of personal
information
• Keeping personal information secure
• right for individuals to access and
correct their personal information
• plus… cross border disclosure, use of
government identifiers and direct
marketing, what you must do to comply,
limitations on collection, storage and
use

33. f. Who does all this apply to:
i. Australian Government
Agencies
ii. Businesses including NFPs
with t/o > $3m
iii. Some smaller businesses
including:
1. all private sector Health
Service Providers
2. those that trade in
Personal Information

34. Notifiable
Data Breaches
(NDB) Scheme

35. Don’t you love statistics…
• Small businesses in Australia is the target of 43% of all cyber crime
• 60% of small businesses who experience a significant cyber breach go out
of business in the following 6 months
• 22% of small businesses that were breached by ransomware attacks in 2017
were so affected that they could not continue operating
• 87% of SME’s believe their business is safe from cyber attacks because they
use anti-virus software
• Cybercrime costs the Australia economy more than $1Bn annually
• 41% of peoples globally cannot identify a phishing e-mail
• 30% of phishing e-mails are opened, with 12% clicking on infected links or
attachments
Verizon, Microsoft, Veda, Symantec, OAIC, ACORN, PWC
Nearly two thirds of Australian companies see cyber breaches as an ‘IT
issue’, rather than a major business risk.
Australian Securities Exchange 2017 report

36. a. Commenced 22 February 2018
b. Applies as per Privacy Act but also to all Credit Providers and all
holders of TFNs regardless of turnover
c. Introduces the concept of an ‘eligible breach’
d. Introduces an obligation “to notify individuals whose personal
information is involved in a data breach that is likely to result in
serious harm”
e. Extends notification obligation to giving recommendations about
steps individuals should take in response to the breach

37. f. Obligation to notify Commissioner of
all ‘eligible data breaches’
g. Eligible Data Breach – three limbs:
i. Unauthorized access to or
disclosure of or loss of
personal information held by
an entity;
ii. Likely to result in serious harm
to one or more individuals;
iii. Entity hasn’t been able to
prevent the likely risk of
serious harm with remedial
action.

38. h. What might a breach look like?
i. Lost or stolen laptop
ii. Transfer of digital storage without adequate wiping
iii. Hacking of personal information database
iv. Employees accessing/disclosing information outside their
permitted level
v. Paper records stolen from insecure recycling or garbage facility
vi. Provision of personal information to incorrect recipient
vii. Leaving your phone on the bus

39. For example – in January 2019
• Bunnings
• Facebook
• Optus
• Marriott Hotel Group
• Hawthorne Football Club
• Big W
• Victorian Public Service

40. Some more statistics, courtesy of the
Commissioner…

41. i. Likelihood of ‘serious harm’ – the
‘reasonable person’ test.
i. Consider type of data – financial,
identity, Sensitive?
ii. Scale of breach
iii. Existence of any safeguards such
as encryption

42. j. Nature of likely harm:
i. Identity theft?
ii. Financial loss?
iii. Threat to safety?
iv. Loss of employment / business
opportunity?
v. Humiliation, reputational or
relationship damage?
vi. Workplace or social bullying?

43. k. How do you notify?
i. Direct communication or
ii. Website and newspaper
publication

44. l. What if you get it wrong?
i. Compensation for loss or
damage
ii. Enforceable undertakings
iii. Civil penalties up to $360k for
individuals and $1.8m for
corporates
iv. Injunction preventing
offending action.

45. m. Maximising getting it right:
i. Know what personal information you collect and why
ii. Understand how it is stored and who is responsible
iii. Train staff to identify and notify situations of risk or breach
iv. Develop a plan to identify and address any breach
v. Ensure upstream contracts contain obligations to notify you
of any breach
vi. Take any breach seriously

46. n. Developing a Data Breach Response Plan
Privacy Management Framework
• Embed – a culture of Privacy
• Establish – robust and effective procedures and systems
• Evaluate – monitor, document, measure
• Enhance – based on results of Evaluate

47. GDPR
General Data
Protection
Regulation

48. a. Commenced 25 May 2018
b. In force throughout 29 member states in the EU including UK,
France, Germany, Italy
c. Applies to all Australian entities (regardless of turnover):
a. having an establishment in the EU;
b. offering goods and services in the EU; or
c. monitoring the behaviour of individuals in the EU
ie: applies to all entities processing and holding personal data of
data subjects residing in the European Union, regardless of the
entity’s location.

49. a. Introduces obligations:
a. to notify data breach to relevant supervisory body within 72 hours
except where unlikely to result in risk to the rights and freedoms of
natural persons
b. to develop data protection policies
c. to ensure ‘consent’ is demonstrable
b. Where ‘large scale, regular and systematic monitoring’, need an EU
Representative (‘Data Protection Officer’) who must undertake
compulsory impact assessment prior to data processing in ‘high risk’
situations
b. ‘Personal Data’ ‘any information relating to an identified or identifiable
natural person’ such as ‘name, ID number, location data, online identifier
or one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that person’

50. a. ‘Consent’ - GDPR:
a. Freely given
b. Specific
c. Informed
d. An unambiguous indication of the data subject’s wishes by which he
or she, by a statement or by a clear affirmative action, signifies
agreement to the processing
‘Consent’ - Australia:
a. Express or implied;
b. Individual is adequately informed before giving consent;
c. Individual gives consent voluntarily
d. Consent is current and specific
e. Individual has capacity to understand and communicate consent

51. a. Penalties for breach of GDPR
1. Greater of:
i. 20 million Euros; or
ii. 4% of global annual turnover
2. Tiered approach – 2% for not
having records in order or for not
notifying a breach
https://www.eugdpr.org

52. Whistleblowers

53. The current law is set out as follows:
a. Protections in the tax and corporate sectors are found in the
Corporations Act 2001 and Taxation Administration Act 1953.
b. Protections for public interest disclosures are found in the Banking Act
1959, Insurance Act 1973, Life Insurance Act 1995 and Superannuation
Industry (Supervision) Act 1993.
c. Protections in federal legislation are found in the Public Interest
Disclosure Act 2013, the Corporations Act 2001 and the Fair Work
(Registered Organisations) Act 2009.

54. The new Bill:
• The federal government’s new
legislation, the Treasury Laws
Amendment (Enhancing
Whistleblower Protections) Bill 2018,
was passed by both Houses of
Parliament on 19 February 2019.
• The new legislation will commence
on 1 July 2019.

55. • The Bill does the following:
a. amends, consolidates and broadens the whistleblower protection
regime found in the Corporations Act 2001;
b. amends the Taxation Administration Act 1953 to create a regime for
disclosures of breaches of tax laws and tax avoidance; and
c. repeals the financial sector whistleblower protection regimes in the
Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995 and
Superannuation Industry (Supervision) Act 1993.

56. • The new law:
a. broadens what type of
disclosure is protected;
b. broadens the class of who can
make protected disclosures;
c. amends the people and bodies
that can receive disclosures;
d. implements heavier penalties;
and
e. requires that public companies
and large proprietary companies
to implement a whistleblower
policy.

57. • Information can be disclosed under the following circumstances:
a. if the discloser has reasonable grounds to suspect that the
information concerns misconduct, or an improper state of affairs
or circumstances in relation to the entity;
b. if the discloser has reasonable grounds to suspect that the entity
or an officer or employee of the entity has engaged in a civil or
criminal offence or an offence under legislation that requires ASIC
or APRA’s oversight; or
c. if there is information about activity that represents a danger to
the public or financial system.

58. • The definition of eligible whistleblowers has been widened to include the
following:
a. an officer of the entity;
b. an employee of the entity;
c. an individual who supplies services or goods to the regulated entity
(whether paid or unpaid), and their employees;
d. an individual who is an associate of the entity; and
e. a relative or a dependant of any of the above individuals.
• Whistleblowers do not have to disclose their identity to be protected.

59. • The disclosure must be made to one of the following people or bodies:
a. an officer or senior manager of the company;
b. an auditor, or a member of an audit team conducting an audit into the
company;
c. an actuary of the company;
d. a person authorised by the company to receive disclosures;
e. ASIC;
f. APRA;
g. a lawyer, for the purpose of legal representation; and
h. parliament or a journalist (only where it is a public interest or
emergency disclosure).

60. Confidentiality of the disclosure
a. The identity of the whistleblower
cannot be disclosed.
b. It is not unlawful to disclose
information relating to the
disclosure provided that it is
reasonably necessary to investigate
the disclosure and steps are taken
to reduce the risk of disclosing the
whistleblower’s identity.

61. Protections and Immunities
a. The new laws expand protections for whistleblowers.
b. It is unlawful for a person to engage in conduct that causes detriment to
a whistleblower or an associate of the whistleblower in the belief of a
suspicion that the person has made, may make, proposes to make or
could make protected disclosure.
c. It is unlawful for a person to purport to terminate an employee because
of protected disclosure.
d. A person will not be subject to any civil, criminal or administrative
liability or contractual right or remedy for making a protected disclosure.

62. Whistleblower Policy
• All public companies, large proprietary companies and proprietary
companies that are the trustee of a registrable superannuation entity
must develop a whistleblower policy, which includes information about:
a. what protections are available to whistleblowers;
b. whom disclosures can be made to and how they are to be made;
c. how the company will support whistleblowers and protect them from
detriment;
d. how the company will investigate disclosures;
e. how the company will ensure fair treatment of employees; and
f. how the policy will be made available.
• This policy must be in place three months after Royal Assent is
given. Failure to have a policy can result in a penalty.
• Failure to comply is a criminal offence.

63. • The civil penalties for disclosing
whistleblower identity or victimising
a whistleblower are as follows:
a. For a body corporate: 50,000
penalty units (approx. $10.5
million), three times the benefit
derived or detriment avoided, or
10% of annual turnover.
b. For an individual: 5,000 penalty
units (approx. $1.05 million) or
three times the benefit derived
or detriment avoided.
c. The criminal penalties are:
maximum of 60 penalty units
and/or 2 years imprisonment.

64. Questions?

65. Thank you for attending.
Please complete your Feedback Forms