By amending the “Sapin II” law, France has become the fourth EU country to transpose the EU Whistleblower Directive as of 21 March 2022, following Denmark, Sweden and Portugal.

Sapin II introduced, in December 2016, mandatory whistleblowing schemes (amongst other things) for certain private and public sector organisations.

Scope

On 21 March 2022, France enacted a law “aiming to improve the protection of whistleblowers” by making numerous amendments to the Sapin II Law, as well as to the labor code, the public service code, the criminal code and other laws.

Consistent with the previous version of the Sapin II Law, the new law is not restricted to breaches of EU law, as provided for in the EU Whistleblower Directive, but also applies to breaches of French law or a threat or prejudice to the general interest.

The law does not apply in cases where French or EU law establishes specific reporting regulations (notably as set out under Part II of the Annex to the EU Whistleblower Directive, covering EU law in the fields of financial services, AML-FCT, transport and environment).

Moreover, the new law expands the type of information that falls outside its scope to include information protected by the secrecy of judicial deliberations and judicial investigations, in addition to information protected by national defense secrecy, medical secrecy, and lawyers’ professional secrecy.

Changes regarding who is protected by the law

Several changes have been made to the definition of whistleblowers (in French “lanceur d’alerte”), which are individuals who “report or reveal facts about : (i)  a crime or an offence, or (ii) a threat or prejudice to the general interest, or (iii) a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France, of a unilateral act of an international organization adopted on the basis of such commitment, or of EU or French legislation and regulation”. To benefit from the protection a whistleblower must report “without direct financial compensation and in good faith”.

The law expands the scope of persons who can blow the whistle to include, in addition to employees and persons that collaborate occasionally with the company, the following persons:

• Job applicants

• Shareholders and officers

• Business partners or subcontractors (or as the case may be their staff, shareholders and officers)

• Individuals that report anonymously and which name is disclosed afterwards

Whistleblowers no longer need to have first-hand knowledge when reporting on facts that “have occurred or are very likely to occur within the organisation” and that they have become aware of “in the course of their professional activities” (in other cases, first-hand knowledge is required).

The scope of the protection has also been extended, in particular, to cover:

• “Facilitators” i.e., individuals or private non-profits, who help the whistleblower make his/her report

• Individuals having a relation with the whistleblower and that could suffer from retaliation in a work-related context

• Entities controlled by the whistleblower or for which the latter works or with which he/she is otherwise connected with in a work-related context

Changes to the reporting process

As provided in the EU Whistleblower Directive, organizations in the private sector with less than 249 employees can  share resources for the purposes of reporting provide that they comply with the provisions of a future implementing decree to be issued by the government (after consultation with the Conseil d’Etat).

French law does not seem to have adopted the interpretation by the EU Expert Group and the European Commission that each subsidiary with 250 or more employees would have to have a separate internal reporting channel at the local level, and to give whistleblowers the option to report at the local or group level. Indeed, the new French law expressly authorizes a common reporting and investigation scheme within the same corporate group. However, there may yet be certain restrictions or constraints placed on this right, since the law provides for an implementing decree to be issued by the government on this particular point.

More generally, implementing decrees are to be enacted by the government (after consultation with the Conseil d’Etat) on the process that such reporting schemes have to abide by, and on prior consultation with employee representatives.

Moving away from the past strict three-tiered reporting model, whistleblowers will now be allowed to:

• report externally (with or without a prior internal report) to specific authorities or courts at the French or EU level, including as set out in an implementing decree by the government (after consultation with the Conseil d’Etat); and

• report publicly in certain cases set out by the law (in some cases, after at least an external report that was made did not lead to appropriate follow up actions).

For companies that do not have a whistleblowing scheme, reports can be made to a direct or indirect supervisor or a referee appointed for this purpose. (However, as before, implementation of such schemes remains mandatory for organizations that have more than 50 employees.)

Confidentiality is required not only for the identity of the whistleblower and that of the person in regard to which a report is submitted, but also for “any third party mentioned in the report”. As before, the disclosure of such identities and the information collected is sanctioned by up to two years of imprisonment and a €30,000 fine.

Information may only be retained for as long as strictly necessary or must be anonymized.

Enhancement to the protection measures

The law augments the list of prohibited reprisals against whistleblowers by including, in addition to discrimination at work or disciplinary sanctions for employees or job candidates, the following actions (amongst others): intimidation and harassment; damage to reputation (including online); financial loss (loss of business or revenue); inclusion on an industry wide blacklist; early termination of business relations; cancellation of licence; and improper referral to psychiatric or medical treatment.

The new law provides that is it for the person who has taken a detrimental measure against a whistleblower to prove that their action was not linked in any way to the whistleblower’s reporting or public disclosure, and would have been taken anyway.

Whistleblowers will not be subject to criminal or civil liability for damages caused by reporting publicly if they had reasonable grounds to believe that public disclosure was necessary to protect the interests at stake.

As before, interfering with the transmission of a report may be punishable by up to one year of imprisonment and a €15,000 fine; however, the civil fine for abusive court action against a whistleblower has been increased to €60,000.

Moreover, criminal or civil courts have the possibility to allocate to the whistleblower provisions for court costs or, when his/ her financial situation has seriously deteriorated due to the report or public disclosure, a provision for financial assistance (in French “subsides”). A labor court may order the employer to contribute to the whistleblower’s personal training account.

The law also clarifies that the identity of the whistleblower can be disclosed to a court without his or her consent, when necessary.

Effective date and next steps

The changes to the law will take effect on 1 September 2022. In the meantime, implementation decrees by the governement (after consultation of the Conseil d’Etat) are to be issued as discussed above. Moreover, the French data protection authority, the CNIL, may have to amend its standard of best practice or Referential (in French, “référentiel”) of December 2019 concerning the processing of personal data in the context of whistleblower hotlines.

Key takeaways

Companies should begin assessing and planning for implementation of the changes they will need to make over the next six months in order to adapt their existing whistleblower policies, procedures and information notices to meet the new requirements, and also to prepare for consultation with employee representatives.

Once the implementing decrees are enacted and the CNIL Referential is updated, companies are likely to have to carry out or update the Data Protection Impact Assessments covering their whistleblower schemes.