The first post in this series outlined the meaning of gender-based violence and processes that apply to all higher education staff and students. The second post looked at processes when a complaint of gender-based violence is made.

Legislative references, unless otherwise specified, are to the Universities Accord (National Higher Education Code to Prevent and Respond to Gender‑based Violence) Bill 2025. The draft code is here; it uses the language of ‘standards’ but I will refer to code ‘sections’ when noting a specific rule or requirement.

Update 20/10/2025: The enacted legislation is here. The enacted code is here.

Reporting

The code comes with very extensive reporting requirements. All the different things providers must report on run for four pages in the code: standard 6, pp. 17-20.

The code stresses the role of the data collected on programs to reduce gender-based violence: code section 6.1.

The Secretary can disclose information received as part of this reporting: sections 43 and 44.

The Secretary must produce an annual report to be included in the Department’s annual report (which is usually tabled in Parliament in October): section 47.

Given the Department of Education’s chronic failure to release higher education data in a timely way a statutory requirement to publish an annual report is good.

While the Department’s annual report operates on a financial year basis it would be helpful to produce the data on a calendar year basis as well, to reflect the operating cycle of universities.

Limits on usefulness of reporting

There is no requirement in the bill or the code for the Department or the universities to conduct surveys such as the student safety survey. I realise there is a problem with too many surveys and low response rates. But universities already reporting data along the lines proposed by the code receive low numbers of complaints – sometimes less than 200 in institutions with 70,000+ students.

Given what we know from survey evidence – both the student safety survey and ABS surveys of common student demographics – the true incidence of sexual harassment and assault in a 70,000+ population would be much higher. The subset of students who make complaints is not large enough to provide strong evidence either way on whether policies are having an effect. [Update 27/8/25: Universities Australia has commissioned a survey for 2026.]

For evaluation purposes another problem is the code’s prescriptive approach. It reduces space for experiments in policies and practices. From reading the work of Jess Hill I have found that the government’s prevention education and training approach has not been found to be very effective in changing behaviour (as opposed to reported attitudes; see this literature review she cites, perhaps because university students are good at repeating back what they think the university wants to hear without truly learning). The training however has other purposes, such as ensuring perpetrators cannot claim they were not informed of the rules.

National Student Ombudsman

Students don’t need the gender-based violence legislation to make a complaint to the National Student Ombudsman on a sexual harassment/assault issue. They can do that right now. Similarly the NSO does not need the gender-based violence legislation to make recommendations to education providers on improving their response to gender-based violence issues.

However, as foreshadowed, the bill allows the code to require providers to accept recommendations of the NSO on matters of gender-based violence: section 17(2)(p). This is in the code at section 2.9.

Presumably the NSO will be careful in what they recommend, but with the government’s propensity to set multiple agencies onto the same problem this could get messy: there is the prescriptive code itself, the Department of Education’s power to force rewrites of university plans, in the case of staff other state and federal laws on sexual misconduct, and TEQSA’s more general regulation of student safety.

Penalties

If a provider fails to comply with the code the civil penalty provision is a fine of 200 penalty units or $66,000 on current penalty unit rates: section 20. However civil penalty provisions are not necessarily as they seem due to the Regulatory Powers (Standard Provisions) Act 2014. If an alleged failure to comply proceeds to court the penalty is determined by the court: section 82(3) of the Regulatory Powers (Standard Provisions) Act 2014. If the claim is against a ‘body corporate’ (e.g. a university) the maximum penalty the court can determine is 5 times the civil penalty provision, i.e. $330,000: section 82(5). I am not expert on civil penalties, but in doing some background reading it seems that civil penalties are primarily about deterrence.

When the Secretary believes a breach has occurred the first step is to issue an infringement notice. The notice has to be issued within 12 months of the alleged contravention: section 103(2) of the Regulatory Powers (Standard Provisions) Act 2014. If there is only one contravention the penalty stated in the infringement notice is the lesser of one-fifth of the maximum penalty that could be imposed or in the case of a body corporate (e.g. a university) 60 penalty units, $19,800. A small fine would be more about the reputational damage than the money. If there are multiple contraventions, however, these figures are multiplied by the number of contraventions: sections 104(2) & (3) of the Regulatory Powers (Standard Provisions) Act 2014.

The financial risk for universities is greatest where one system fault could lead to multiple contraventions, e.g. thousands of staff not compliant with working with children checks. However, under section 12 of the gender-based violence bill the Secretary is required to comply with the principle of ‘proportionate regulation’, so that their exercise of power is in proportion to the non-compliance or the risk of future non-compliance.

If the university decides to take the matter to court, it is not necessary for the Secretary to prove that the university deliberately breached the code: section 94 of the Regulatory Powers (Standard Provisions) Act 2014. However, there is a potential mistake of fact defence in section 95. In this defence, a university would have needed to consider whether certain facts existed and held a reasonable although mistaken belief about those facts.

If the matter goes to court, there are also limits on penalties. The court must take into account the nature and extent of the contravention, the nature and extent of any loss or damage, the circumstances in which the contravention took place, and whether a court has previously found the ‘person’ (in this case, the university) to have engaged in similar conduct: section 82(6) of the Regulatory Powers (Standard Provisions) Act 2014.

Enforceable undertakings

In addition to the civil penalties discussed above, the Secretary has other enforcement options.

Under section 39 of the bill, the Secretary can apply for an enforceable undertaking. These are regulated under section 114 of the Regulatory Powers (Standard Provisions) Act 2014. Under these undertakings a provider would agree to take or refrain from taking specified actions (some universities already face these due to casual underpayments).

If the provider fails to comply with the enforceable undertaking a court can order it to comply, direct the provider to compensate persons who have suffered loss or damage as a result of the breach, or any other order that the court considers appropriate: section 115(2) of the Regulatory Powers (Standard Provisions) Act 2014.

Similarly, the Secretary can seek an injunction: section 40 of the gender-based violence bill. An injunction can restrain a provider from engaging in certain conduct or force them to engage in certain conduct: section 121 of the Regulatory Powers (Standard Provisions) Act 2014.

Approval as a higher education provider

A separate bill amends the Higher Education Support Act 2003 to make compliance with the code also mandatory under that legislation (a new section 19-20, in a subdivision labelled ‘the quality requirements’).

The minister could issue a compliance notice for a breach of section 19-20. Not complying with the compliance notice has a fine of 60 penalty units ($19,800): section 19-82 of HESA 2003. However a university cannot be liable for more than one pecuniary penalty for the same conduct: section 84(2) of the Regulatory Powers (Standard Provisions) Act 2014.

The significance of the HESA 2003 amendment is likely less the fines than section 22-15 of HESA 2003, which allows the minister to revoke a body’s approval as a higher education provider. This would not invalidate the provider’s TEQSA registration (a separate approval) but would deny their students access to CSPs, HELP loans, and student income support. The minister must consider a range of factors, including whether the breach is minor or major and whether it has occurred before. There is a teach-out provision enabling students already enrolled to complete with Commonwealth assistance: section 22-32 of HESA 2003.

One legal point I am not 100% clear on here is whether section 22-15 applies to Table A (public university) or Table B (private university) providers. They are specifically listed in HESA 2003, while other providers are approved by the minister under section 16-50. I think 22-15 probably does not apply in the cases of Table A and Table B but I could be wrong. In any case, I think it would be politically impossible for the minister to effectively close down a Table A provider for any reason short of massive dysfunction in its core teaching and research responsibilities.

Conclusion

As is often the case with this government, the gender-based violence policy comes with very high levels of bureaucracy and consequent compliance costs. This is concerning across the system but particularly for small higher education providers that don’t have the bureaucracies of the big public universities. Based on complaint numbers at these big institutions, the smaller higher providers may get no or very small numbers of sexual misconduct complaints each year. Yet they will still need staff with relevant experience and training to comply with the code. Not having these staff could lead to fines and loss of FEE-HELP for their students. Perhaps there is scope for some shared support services, to offset what otherwise seems to be an unreasonable bureaucratic burden.