Legal basis for whistleblowing

1. Which body of rules govern the status of whistleblowers?

In France, whistleblowing was governed by Law No, 2016-1691 on transparency, the fight against corruption and the modernisation of economic life, also known as Sapin II.

A few years later, the European Parliament adopted Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law.

The main objective of the EU Directive is to harmonise EU member states’ legislation about whistleblowing.

In France, the transposition laws of the EU Directive were definitively adopted and came into force on 21 March 2022:

• an “ordinary” law aimed at improving the protection of whistleblowers; and

• an “organic” law aimed at strengthening the role of the French Human Rights Defender in terms of whistleblowing.

These new local Laws comply perfectly with European standards and make numerous amendments to Sapin II.

Implementation of the whistleblowing procedure

2. Which companies must implement a whistleblowing procedure?

The scope of the whistleblowing procedure is very broad. Companies with more than 50 employees, public-sector institutions, authorities and municipalities with 10,000 or more inhabitants must set up internal reporting channels for whistleblowers.

3. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

The procedure for collecting and processing alerts may be common to several or all of the companies in a group, under the terms set by an application Decree to be published.

4. Is there a specific sanction if whistleblowing procedures are absent within the Company?

There is no specific legal sanction for failing to create a whistleblowing procedure.

However, the absence of an internal reporting channel increases the risk for the company’s reputation as whistleblowers could use external reporting such as public disclosure in the press or social media.

Besides, any person who obstructs the transmission of a report may be exposed to criminal suit and a penalty of up to one year’s imprisonment and a fine of 15,000 EUR.

5. Are the employee representative bodies involved in the implementation of this system?

A company’s work council must be informed and consulted before the implementation of a whistleblowing procedure.

Indeed, work councils are informed and consulted “on all questions which are linked to the organisation, management and general running of the company and in particular on conditions of employment, professional training, working conditions and on the introduction of new technologies or any significant change in health and safety conditions or working conditions” (article L. 2312-8 of the Labor Code).

6. What are the publicity measures of the whistleblowing procedure within the company?

From 1 September 2022, the internal regulation applicable within the company must mention the whistleblowing process and protection.The internal regulations will be brought to the attention of all persons having access to the workplace.

Moreover, if there is implementation or modification of the whistleblowing process, we recommend informing employees by all means.

7. Should employers manage the reporting channel itself or can it be outsourced?

Employers can subcontract the management of the whistleblowing procedure to an external supplier, which will be in charge of:

• setting up the reporting channel available;

• receiving complaints; and

• investigating the reported facts

In practice and as an example, the external supplier can set up a telephone hotline or an email address for the collection of reports. These are then transmitted to the employer to decide on any action to be taken.

8. What are the obligations of the employer regarding the protection of data collected related to the whistleblowing procedure?

The persons who have their data collected and used in the context of a whistleblowing procedure – starting with the whistleblower him or herself – benefit from the guarantees of the European General Data Protection Regulation (GDPR) as follows:

• they must be properly informed about the processing of their personal data, from the very beginning of the whistleblowing process; and

• they can exercise the rights of access, opposition, rectification and deletion guaranteed to them by the "Informatique et Libertés" law of 1978, as amended to adapt French law to the GDPR.

Information that could identify the whistleblower can only be disclosed with his or her consent. In practice it is recommended to obtain written consent.

However, this information can be communicated to the appropriate judicial authority when the employer has to report facts. In such a case, the whistleblower must be informed unless this information would jeopardise the judicial process.

For example, the employer must report the following:

• In the public sector, a constituted authority, public official or civil servant who, in the performance of his or her duties, becomes aware of a crime or misdemeanour must report it without delay to the General Prosecutor and must provide all relevant information, minutes and documents relating to the offence (article 40, paragraph 2 of the Criminal Procedure Code).

• Regarding money laundering, insurers, mutual health insurance companies or credit institutions are required under certain conditions to report to the Tracfin Agency the amounts entered in their books or transactions involving money that they know, suspect or have good reason to suspect come from an offence or are linked with terrorist financing (article L. 561-15 of the Monetary and Financial Code).

Data relating to alerts may only be kept for as long as strictly necessary and proportionate to processing the alert and for the protection of the authors, concerned persons and any third parties mentioned in the alerts, taking into account the time required for any further investigations.

Also, when personal data relating to alerts is collected, it must be kept under the provisions of the GDPR.

9. What precautions should be taken when setting up a whistleblowing procedure?

During the processing of the report, the procedure implemented must guarantee the confidentiality of the identity of its authors, the persons concerned and any third party mentioned within.

Moreover, the company must respect guarantees of independence and impartiality in the treatment of reports. These guarantees must be specified in a published application decree.

Companies are also required to comply with GDPR obligations. In this regard, the French Data Protection Authority (CNIL) has published a frame of reference to help public and private organisations implement whistleblowing procedures in compliance with data protection regulations (CNIL deliberation dated 18 July 2019).

Scope of the whistleblowing procedure

10. What precautions should be taken when setting up a whistleblowing procedure?

The list of breaches and violations provided by the law is very wide. It covers:

• crime and offences;

• threat or harm to the public interest;

• violation of an international commitment duly ratified or approved by France, or of a unilateral act of an international organisation taken based on such a commitment; and

• a violation of the law of the European Union, or its regulations.

However, facts, information or documents, covered either by national defence, medical or lawyer/client confidentiality are excluded from the whistleblower rules. This means that it is not possible to divulge that kind of information. If the whistleblower does it anyway, he or she will not benefit from whistleblower protection.

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

There are special whistleblowing procedures for some areas, including banking and insurance; these industries which may offer additional advantages, such as a simplified reporting procedure.

For instance, the Financial Market Authority (FMA) has deployed a whistleblowing system reserved for persons looking to provide the FMA with strictly confidential information concerning infringements of European legislation, the Monetary and Financial Code or the FMA General Regulation.

A whistleblower who has learned of such events in his or her working life or business relationships can report them in writing (in electronic format or on paper), verbally by phone, or by meeting in person with specialist members of the staff in the offices of the AMF.

An acknowledgement of receipt is sent within seven days.

Guarantees apply to whistleblowers who report infringements accurately:

• the originator of the report, the person targeted and the information collected are strictly confidential during receipt and processing; and

• the whistleblower would also not be subject to dismissal, punishment or discriminatory measures, whether direct or indirect, notably concerning compensation or career development, or any other unfavourable measure, for having in good faith reported an infringement to the FMA.

(DOC-2018-13 – Procedures for whistleblowers reporting infringements of the regulations to the FMA; Act 2016-1691 of 9 December 2016 on transparency, anti-corruption and economic modernisation, article L.634-1 of the Monetary and Financial Code)

Identification of the whistleblower

12. What is the legal definition of a whistleblower?

A whistleblower is defined by the EU directive as a “person who reports or discloses, without direct financial consideration and in good faith, information relating to a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of an international commitment regularly ratified or approved by France, a unilateral act of an international organisation taken on the basis of such a commitment, European Union law, or the law or regulations”.

13. Who can be a whistleblower?

To benefit from whistleblower protection, the individual can be:

• an employee;

• a former employee when the information was obtained in the course of his or her employment;

• applicants for a job;

• shareholders or partners of the entity concerned;

• external and occasional employees of the entity; and

• contractors and subcontractors.

14. Are there requirements to fulfil to be considered as a whistleblower?

A whistleblower must fulfil the following requirements:

• Be a natural person. It excludes legal entities such as Companies, Works Councils or associations.

• Act in good faith.

• Do not research any direct financial compensation.

15. Are anonymous alerts admissible?

French law allows anonymous whistleblowing reports.

The processing of anonymous alerts is subject to the same rules as for identifiable alerts. However, provisions requiring feedback from the author of an internal or external alert are not applicable in the case of an anonymous alert.

The CNIL states that anonymous reports are the exception, not the rule, and should be managed with particular guarantees.

It means that when an employer receives an anonymous alert, it is preconized: to establish the seriousness of the reported violation, to establish the existence of detailed factual elements, to subject it to prior examination by the first recipient of the report before the initiation of further investigations and also to make clear, during any transmission relating to this alert, that it is anonymous.

The anonymous whistleblower is covered by the same protections as an identified whistleblower. It means that if an employer refuses to process an anonymous alert, it could be subject to an obstruction:

• Interfering with the transmission of an alert is a criminal offence punishable by up to one year of imprisonment and a fine of 15,000 EUR.

• In parallel, according to the law the maximum civil fine for any dilatory or abusive procedures against a whistleblower due to the information reported or disclosed is 60,000 EUR.

• In addition to these fines, the author of the obstruction may be ordered to pay damages to the whistleblower.

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

The law distinguishes two situations:

• information obtained in the course of professional activity: in this case, indirect knowledge is sufficient; and

• Information not obtained in the course of professional activity; in this case the whistleblower must have personal knowledge of these facts.

For example, if a person said to a co-worker that he had witnessed some illegal behaviour within the company, the co-worker could make a report through the intern alert channel even if he had not directly witnessed the facts.

Processing of the whistleblowing procedure

17. What are the terms and conditions of the whistleblowing procedure?

French law provides for specific requirements regarding independence, impartiality, confidentiality and data protection.

• Independence and impartiality: the whistleblowing procedure must be independent and impartial in the treatment of the report and respect time limits in providing feedback to the author of the alert (fixed by decree to be published).

• Confidentiality: the procedure must protect the identity of the authors, the persons concerned and any third party mentioned in the report.

• Data protection: data relating to alerts may be kept only for as long as is strictly necessary and proportionate to process the alert and for the protection of the authors, concerned persons and any third parties mentioned in the alerts, taking into account the time required for any further investigations.

Employers should also be careful regarding any action directed toward the whistleblower, as some behaviour could be considered a form of retaliation (disciplinary sanctions, intimidation and harassment, damage to reputation, financial loss, etc).

18. Is there a hierarchy between the different reporting channels?

The whistleblower can choose one of the following reporting channels:

• internal via its hierarchy in the company or the referent designated by the employer acccording to the applicable whistleblowing procedure; or

• external, either after having made an internal report, or directly to:

1. the competent authority among those designated by a future decree;

2. the Defender of Rights, who will direct them to the authority or authorities best able to handle it;

3. the judicial or administrative authority; or

4. an institution, body or agency of the European Union competent to collect information on violations falling within the scope of the 2019 Directive

A decree to be published will establish the list of authorities competent to collect and process external alerts.

Eventually, public disclosure of the alert is possible in the following situations:

• no appropriate action has been taken in response to an alert made by an external channel at the end of a certain time set by decree;

• imminent or obvious danger to the public; or

• when an external notification would run the risk of retaliation or would not allow an effective remedy for the subject of the disclosure (for example, suspicion of conflict of interest, risk of concealment or destruction of evidence and collusion).

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

French law does not require an employer to inform external authorities about the reports.

However, this obligation does exist in certain situations. For example:

• in the public sector, a constituted authority, public official or civil servant who, in the performance of his or her duties, becomes aware of a crime or misdemeanour must report it without delay to the General Prosecutor and must provide all relevant information, minutes and documents relating to the offence (article 40, paragraph 2 of the Criminal Procedure Code); and

• regarding money laundering, insurers, mutual health insurance companies or credit institutions are required under certain conditions to report to the Tracfin Agency the amounts entered in their books or transactions involving money that they know, suspect or have good reason to suspect come from an offence or are linked with terrorist financing (article L. 561-15 of the Monetary and Financial Code).

In any case, it is highly recommended for the employer, when appropriate, to inform competent authorities if they about punishable facts through the whistleblowing channel. Indeed, silence from the employer would increase the risk of collusion or damages to the image and reputation of the Company.

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

The whistleblower must report the facts in good faith. Thus, reports of unproven facts in good faith are not condemnable.

However, a whistleblower guilty of false accusation is liable for criminal penalties of up to five years’ imprisonment and a fine of 45,000 EUR.

If the whistleblower does not respect the whistleblowing procedure, he or she will not benefit from the regime provided by the law.

21. What are the sanctions if there is obstruction of the whistleblower?

Interfering with the communication of a report is a criminal offence punishable by up to one year of imprisonment and a fine of 15,000 EUR.

According to French law, the maximum civil fine for any retaliatory or abusive procedures against a whistleblower due to information they have reported or disclosed is 60,000 EUR.

In addition to these fines, the obstructor may be ordered to pay damages to the whistleblower.

Whistleblower Protection

22. What procedure must the whistleblower follow to receive protection?

The whistleblower has the choice between the following reporting procedures:

• Internal reporting procedure: the employee notifies his or her hierarchy or goes through the applicable internal procedure.

• External reporting procedure: the employee reports to:

1. the competent authority among those designated by a future decree;

2. the Defender of Rights, who will direct them to the authority or authorities best able to handle it;

3. the judicial or administrative authority; or

4. an institution, body or agency of the European Union competent to collect information on violations falling within the scope of the 2019 Directive

A decree will establish the list of authorities competent to collect and process external alerts.

Public disclosure of information may also take place in the following situations :

• no appropriate action has been taken in response to an alert made by an external channel at the end of a certain time set by decree;

• imminent or obvious danger to the public; or

• when an external notification would run the risk of retaliation or would not allow an effective remedy for the subject of the disclosure (for example, suspicion of conflict of interest, risk of concealment or destruction of evidence and collusion).

23. What is the scope of the protection?

Whistleblowers benefit from protection in several areas:

• The whistleblower benefits from a criminal immunity for breaching a secret protected by law if the disclosure is necessary, proportionate to safeguard interests at stake and done in compliance with the applicable process.

• Retaliation against whistleblowers is prohibited. This includes: discrimination at work, disciplinary sanctions, intimidation and harassment, damage to reputation, financial loss, inclusion on a blacklist at the business or industry sector that would prevent the whistleblower finding a job, early termination of business relations, cancellation of licence, and improper referral to psychiatric or medical treatment.

The author of a detrimental measure against a whistleblower must prove that their action was not related to the whistleblower’s reporting or public disclosure, and would have been taken anyway.

The Law also provides for a specific legal action for whistleblowers who can bring a claim in summary proceedings in the event of dismissal that occurs after the whistleblower raised a concern or an alert.

24. What are the support measures attached to the status of whistleblower?

Many support measures are set up by the law:

• Courts can allocate provisions for legal expenses to whistleblowers.

• Moreover, courts can grant temporary financial assistance, at the expense of the opposing party, if the whistleblower's financial situation has seriously deteriorated as a result of the report.

• French law can attempt to ensure psychological support for whistleblowers.

• Finally, a labour court could order the company to contribute to the whistleblower’s personal training account (up to 8,000 EUR for low-skilled employees and 5,000 EUR for other employees).

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

A whistleblower who is guilty of false accusation is liable to criminal penalties of up to five years’ imprisonment and a fine of 45,000 EUR.

If the whistleblower does not respect the whistleblowing procedure, he or she will not benefit from the regime provided by the law.