In October 2023, Melbourne Magistrates’ Court convicted a hospital cafe operator and fined his two companies a combined $290,000 for failing to provide a workplace free from sexual harassment. It was the first time Victorian WHS laws had been used to prosecute an employer specifically for sexual harassment, and the case laid out, in uncomfortable detail, exactly how far short the businesses had fallen.
Six workers, some as young as 16, had complained of physical and verbal sexual harassment by the boss. The conduct dated back to 2014. WorkSafe Victoria investigated and found that while the businesses had sexual harassment policies, those policies didn’t give employees enough information to make a complaint. The only reporting avenue was through the manager, the person doing the harassing.
The two companies, Whitelom Investments Pty Ltd and Whitelom Pty Ltd, were fined $110,000 and $140,000 respectively. The director was convicted on two charges and fined $40,000 personally. A younger worker accused of groping a colleague received a 12-month diversion plan.
This wasn’t the only one
Blisspell Pty Ltd, trading as Toy Networx from a warehouse in Reservoir, was fined $100,000 plus $6,000 in costs after WorkSafe prosecuted over a director’s inappropriate comments, including sexual remarks, to an employee. The company’s only risk-management measure was a monthly meeting, which the Magistrates’ Court found “wholly inadequate.” The court said reasonably practicable steps would have included behaviour policies, reporting mechanisms with response procedures, and workplace behaviour training at all levels.
WorkSafe Victoria has also prosecuted a video production company and its director, fining them $55,000 over harassment risk, and an electrician fined $15,000 for bullying and sexual harassment of a colleague.
The pattern across these cases is consistent. The regulator isn’t prosecuting because harassment occurred, it’s prosecuting because the employer failed to have functioning systems to prevent it.
Where the law sits now
Sexual harassment has always been unlawful under anti-discrimination legislation. What’s changed is that regulators are now treating it as a work health and safety hazard, which means it falls under the same framework as any other workplace danger.
The legal logic is straightforward. Sexual harassment creates a risk to workers’ psychological and physical health. Employers have a duty under WHS legislation to eliminate or minimise risks to health and safety so far as reasonably practicable. When an employer fails to take reasonable steps to prevent sexual harassment, they’ve breached their primary duty of care.
This means the regulator doesn’t need to prove the harassment happened in the way an anti-discrimination tribunal would. It needs to prove the employer failed to manage the risk. The focus shifts from “did this incident occur?” to “what did the employer do to prevent incidents like this?”
That’s a fundamentally different question, and for employers, it’s a harder one to answer.
The positive duty
Since December 2022, the Sex Discrimination Act has imposed a positive duty on employers to take reasonable and proportionate measures to eliminate sexual harassment. The Australian Human Rights Commission can investigate and enforce compliance, even without a complaint.
This sits alongside the WHS obligations. An employer now faces potential enforcement from two directions: the AHRC under the positive duty, and the state or territory WHS regulator under safety legislation. The Whitelom prosecution shows that WHS regulators are willing to act. The positive duty shows that the AHRC can act even when no individual complaint has been made.
What “reasonably practicable” actually means
The courts have been specific about what they expect. The $100,000 Victorian case is particularly instructive because the court spelled out what the employer should have done:
Behaviour policies. Not a generic document downloaded from the internet. A policy that defines unacceptable conduct, gives examples relevant to the workplace, and explains the consequences. Workers need to know what the line is and what happens when someone crosses it.
Reporting mechanisms with response procedures. Workers need a way to report that doesn’t require them to report to the person causing the problem. The Whitelom case is a textbook example of this failure, the only reporting avenue was the harasser himself. Multiple reporting channels, including external options, are the baseline.
Training at all levels. Not just workers but everyone, including managers and senior leaders. Workers need to understand what constitutes harassment, how to report it, and what happens next. Managers need to know how to receive and respond to reports. Senior leaders need to understand their personal legal exposure.
Monitoring and review. Set it up and then check whether it’s working. Review complaints data. Conduct climate surveys. Ask workers whether they feel safe. Adjust the controls based on what you find.
The gap between policy and practice
The employers prosecuted in these cases had some kind of policy or monthly meetings. Whitelom had a sexual harassment policy. Blisspell Pty Ltd held monthly meetings. These weren’t businesses that had never heard of their obligations.
The problem wasn’t the existence of a policy. It was the distance between the policy and reality. A policy that doesn’t explain how to report is a policy in name only. A monthly meeting that doesn’t address the director’s own conduct is a performance of risk management, not the thing itself.
WorkSafe Victoria’s head of enforcement said after the Whitelom prosecution that the conviction “sends a strong message that employers will be held to account if they allow sexual harassment to occur in their workplace.” The key word is “allow.” Not “commit”, “allow.” The employer’s failure was permissive. They created the conditions for harassment to continue unchecked.
What this means for your business
If your sexual harassment policy is a document that nobody has read, sitting in a folder that nobody can find, describing a reporting process that nobody would use, you have a problem that won’t wait for a complaint to become urgent. It’s already a compliance failure. The only question is whether a regulator will notice before a worker is harmed, or after.
Review your systems now. Not because it’s a good idea. Because the alternative is a magistrate explaining to you, with numbers attached, exactly what you should have done.