Short answer. He can file, but a genuinely private complaint made to the person responsible for acting on it is one of the exceptions in Article 354 of the Revised Penal Code. Malice is not presumed for a private communication made in the performance of a legal, moral or social duty.
What the law says
A private communication made by any person to another in the performance of any legal, moral or social duty
Revised Penal Code, Article 354 — Requirement For Publicity. Read the full provision →
The presumption the exception saves you from
Article 354 begins from a hard rule: every defamatory imputation is presumed malicious, even if it be true, unless a good intention and justifiable motive is shown. Truth alone is therefore not a complete answer in this area of the law. What the article then does is carve out two situations where that presumption does not operate. The first is the privileged private communication. The second is a fair and true report, made in good faith and without comments or remarks, of judicial, legislative or other official proceedings that are not confidential, or of acts performed by public officers in the exercise of their functions.
What makes a complaint privileged
Three things, read together. The communication must be private — addressed to the person concerned and not broadcast beyond them. It must be made to someone with a corresponding interest or duty to receive it, which is why a supervisor, a human resources officer or a disciplining authority is the right addressee. And it must be made in the performance of a legal, moral or social duty, meaning you had a real reason to report rather than a wish to injure. A complaint that stays inside the proper channel, sticks to what you actually observed, and asks for the matter to be looked into sits squarely inside the exception.
How the privilege is lost
The protection is not absolute, and most people lose it in the same three ways. Copying in people who have no business receiving it — a group chat, the whole department, a public post — destroys the private character of the communication. Going beyond what the duty required, by adding insults, speculation about someone's morals, or accusations unrelated to the workplace issue, takes the surplus outside the privilege. And a complaint shown to have been made knowing it was false, or in reckless disregard of the truth, is malice in fact, which defeats the exception no matter how properly it was routed.
If a complaint is threatened, and the online angle
Keep the original written complaint and the record of exactly who received it — the strongest evidence for the exception is usually the distribution list. Note also that a private letter is treated very differently from a post. If the same accusation is repeated on social media, it leaves the privilege behind entirely and enters the territory of libel, where the cybercrime law provides a heavier penalty for defamation committed through a computer system. So the safest response to a threatened case is silence outside the process, not a public explanation. Take advice on the wording actually used; nothing here predicts an outcome.