Legislative Alert: Critical Lessons from the first sexual harassment case under Fair Work
with
When one incident is enough
The first concluded case under section 527D of the Fair Work Act 2009 (Cth) signals a quiet but material shift in how regulators, courts, and boards should think about workplace harassment. The price of “isolated incident” has changed.
What Happened?
The legal community spent two years waiting for the first concluded case under section 527D of the Fair Work Act. It arrived on 26 March 2026, in a judgment that ran a little over forty pages, in a matter most people will never have heard of. A Canberra café. A young waitress. A wallet. An unwanted kiss.
The judgment is Mejia v Capital City Café-Bar [2026] FedCFamC2G 468. The headline number is $90,000 in penalties and compensation, awarded against a sole director after his company went into liquidation. The deeper story is what the case tells us about how the Fair Work Act now operates as a workplace harassment regime — and what that means for the people sitting in boardrooms reading the news.
What section 527D changed
Section 527D was inserted into the Fair Work Act in 2023 by the Fair Work Legislation Amendment (Secure Jobs, Better Pay) Act 2022 (Cth). It was the legislative answer to the Respect@Work report, and it did something the old framework did not. It made sexual harassment “in connection with work” a civil penalty contravention. Not just an unlawful act that could be pursued through the Sex Discrimination Act. A breach of the workplace law itself, with the federal penalty machinery sitting behind it.
Three things shifted with that change. The definition of “worker” broadened to align with the Work Health and Safety Act 2011 — employees, contractors, apprentices, volunteers, work-experience students. The pathway broadened too, with the Fair Work Commission able to deal with disputes, and applicants able to seek civil penalties and uncapped compensation. And the liability widened. Under section 550, individuals involved in a contravention can be held accessorily liable. Sole directors of small companies are in scope. So are managers and supervisors.
The facts of Mejia
Ms Mejia was 23. She was a casual waitress at Capital City Café-Bar, in Canberra. She was on a Bridging Visa. She had been in the job for twelve weeks.
The morning of 29 July 2024, she queried discrepancies in her pay with the café’s sole director, Mr Kehal. Shortly afterwards she was alone in the café’s kitchen, washing dishes. Mr Kehal came up behind her, hugged her, pressed against her, pinned her to the sink, waved his wallet, and pressed her to take some money. She grabbed a $50 note and tried to push him away. He kissed her on the lips.
She did not return to work. Over the following days he sent her a series of text messages. He described the incident as a “blunder”. He asked whether she intended to tell his wife. He pleaded with her to come back because the café was short-staffed.
She filed proceedings under the Fair Work Act. By the time the matter reached the court, the corporate employer had entered liquidation. Mr Kehal, as sole director, was the principal respondent.
What the Court did
Justice Mansfield made the following orders, by consent of the parties:
- $50,000 in non-economic compensation to Ms Mejia for hurt, distress and humiliation suffered as a result of the sexual harassment;
- $9,390 pecuniary penalty for the breach of section 527D — fifty per cent of the maximum civil penalty available;
- $30,610 in pecuniary penalties for related contraventions, including underpayment, failure to provide payslips, provision of false and misleading payslips, failure to pay superannuation, and failure to provide required employment information.
The total: $90,000. Awarded against the director personally.
Three pieces of judicial reasoning matter for any business owner, director or person of influence in a business.
- First, the Court was explicit that a single incident is sufficient to attract both penalty and compensation. There was no pattern. There was no permissive culture. There was one act. That act was the contravention.
- Second, the Court treated the applicant’s vulnerability as an aggravating factor. Her youth. Her migrant status. Her financial position. Her limited social network. These were not background. They lifted the seriousness of the contravention.
- Third, the Court took a dim view of the apologies. Late admissions and self-protective apologies did not earn discount. If anything, they cost.
What Does this mean for all leaders – boards and executives and managers?
A judgment in a small civil case from a café in Canberra is not going to change the world. But it does establish three things that boards, CEOs and Heads of People should now treat as settled.
The “isolated incident” defence has narrowed.
A single act of sexual harassment, in connection with work, is now sufficient for civil penalty and compensation. The pattern threshold that organisations sometimes leaned on — “we are dealing with this, there is no pattern” — does not, in itself, defeat liability under section 527D. It may go to penalty quantum. It will not defeat the contravention.
Vulnerability is a board-level concept now.
The Court’s reasoning made the applicant’s vulnerability a substantive factor in penalty assessment. For a board, this means that risk maps should explicitly identify where vulnerable workers sit — by visa status, by employment type, by social isolation, by financial precarity. These are not abstract demographic categories. They are now legally relevant risk concentrations. This meets requirements under the WHS Managing Psychosocial Hazards also.
Personal director liability is operational.
Under section 550, the sole director of a small company in administration was held personally accountable for the full $90,000. The principle scales. Directors of larger entities are not protected by corporate insurance when they are personally involved in a contravention. Insurance policies, indemnities, and governance protocols should all be tested against this reality.
The apology problem
There is a piece of this judgment that does not feature prominently in the legal commentary, but should. It is the way the Court treated Mr Kehal’s apology messages.
He apologised. He used the word “blunder”. He acknowledged that something had happened. By many measures of incident response, this is what we tell people to do. Acknowledge. Express regret. Take responsibility.
The Court read those apologies and found them self-protective. The phrasing was framed against the consequences. The concern about whether his wife would find out was, in the Court’s view, the giveaway. The apologies were not, in the end, taken in mitigation. They were taken as evidence.
The lesson is not that apologies are dangerous. The lesson is that apologies sent in the immediate aftermath of an incident, by a person who is also the potential respondent and perpetrator, almost always need to be drafted with legal input. The window for unguided written communication after an alleged incident is closed.
The wage-and-harassment compound
The judgment also did something quiet but important. It linked the harassment contravention to the underpayment contraventions. Not in the legal mechanism — those were separate breaches — but in the factual narrative. The harassment occurred minutes after the worker queried her pay. The pay records were false. The compounded risk was greater than either issue alone.
For risk professionals, this is a signal. The compliance silos — payroll on one side, ER on the other, WHS in a third box — are not how regulators or courts now think about the risk. They are increasingly treating wage theft and harassment as a single compliance posture.
What do all leaders (including managers) need to do?
Leaders must ensure their organisations:
Proactively Identify Psychosocial Hazards:
Conduct regular psychosocial risk assessments.
Use validated tools and surveys to capture anonymous employee feedback.
Include psychosocial factors in routine risk assessments.
- Identify your vulnerable cohorts and map where they sit – casuals, apprentices, visa holders, contractors, sole shift workers, new starters.
- Brief your directors and managers on their duties and obligations – Fair Work, WHS, Discrimination Act.
2. Be Proactive (its your duty):
- Don’t wait for a complaint. Ensure your communications, messaging and cultural norms reflect a zero tolerance for sexual harassment.
Review your incident reports where single reports of issues have appeared – have the appropriate responses/actions been taken.?
- Ensure you have a strong complaints process that is trusted.
3.Strengthen Leadership and Support Structures:
- Train leaders in mental health first aid, psychosocial risk management, and compassionate leadership.
- Establish clear reporting lines and local accountability.
- Create peer support networks and accessible EEO officers.
4. Promote a Just Culture:
Ensure procedural fairness and transparent decision-making.
Implement robust reward and recognition systems.
Foster open communication and psychological safety.
5.Audit and Review Continuously:
Regularly audit psychosocial risk controls.
Involve workers in safety committees and consultations.
Use leading indicators (e.g., survey results, hours worked) to predict and prevent harm.
“A person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers engaged, or caused to be engaged by the person, while the workers are at work in the business or undertaking.”
Example scenarios
Too often, poor behaviour is being excused because it is “messy”, “uncomfortable” . All of which could be avoided if organisations are very clear about a zero tolerance for any forms of sexual harassment. Many leaders are afraid of employees “weaponising” the new regulations. Our experience has been that there is only room for weaponising when the organisation has not been proactive and disciplined in managing behavioural misconduct.
Scenario A — The “isolated incident” defence.
A regional manager kisses a junior staff member at a Christmas party. There is no prior pattern. The staff member resigns. Under the old framing, the company might rely on “first-time, low-level, no pattern”. Under section 527D, the single incident is the contravention. The defence position needs rebuilding from the ground up.
Scenario B — The migrant worker in a small team.
A casual worker on a student visa raises a pay query with the business owner. The owner makes a suggestive comment in response. The worker is now the only witness to two contraventions — the response, and any subsequent pay irregularity. The combined exposure is the larger risk.
Scenario C — The well-meaning apology.
A director, told that a worker felt unsafe in a meeting, sends a long apologetic email referring to the incident as “a moment of poor judgement”. That email becomes evidence. If it admits to the conduct, it removes the defence. If it minimises the conduct, it weighs against remorse. The window for unguided written communication is closed.
Must-Do for Leaders: Manage Your Exposure to Personal and Organisational Risk
1. Treat Psychosocial Risks as Critical Operational Hazards
Integrate psychosocial risk management into your core safety systems.
Use data-driven tools to identify and monitor risks continuously.
2. Educate and Empower Your Leaders
Train directors, executives, and line managers in psychosocial risk management.
Equip them with skills to lead with empathy, clarity, and accountability.
3. Implement Verifiable Controls
Use technology to enforce working hour limits and fatigue policies.
Ensure remote and matrix-managed workers are not excluded from protections.
4. Build a Psychologically Safe Culture
Encourage reporting without fear of reprisal.
Respond to concerns with visible and meaningful action.
5. Engage Experts Early
Partner with specialists in organisational psychology, WHS law, and human factors.
Conduct independent audits and gap analyses.
6. Prepare for Scrutiny
Regulators are increasingly focused on psychosocial safety.
Document everything: risk assessments, controls, training, and responses.
“Neuroscience is the foundation for the approach we bring to every engagement. Partnering with our leaders to provide the insights that allow for improved decision making resulting in organisational resilience. Carolyn Grant
Interested in Learning More?
Book a briefing on psycho-social assessments and organisational resilience today. Mitigate your greatest risk and drive high performing, thriving teams.
