France already has fairly extensive legislative protection in place for whistleblowers under its “Sapin II” law, with certain private and public organisations required to operate whistleblowing schemes, but the scope of this protection is being expanded to ensure compliance with the EU Whistleblowing Directive. Legislation to that effect was supposed to go live in each EU member state by December last year but by what appears to be general and unspoken consent, most have focussed instead on more pressing matters relating to Covid and conflict in Ukraine, and it is only now that we are beginning to see material progress on the whistleblowing front.

Our summary of the Directive is here. UK businesses with French operations will need to accommodate the very significant difference in emphasis between the existing UK whistleblowing rules and this new regime which gives whistleblowers both passive protections and positive rights which go well beyond the UK provision. For UK businesses with French operations, this is not just a question of translating your UK whistleblowing rules into French and hoping that will do. It won’t.

On 21 March 2022, the French government implemented a new law that will make a number of important changes to Sapin II, as well as changes to the Code de Travail/Labour Code and various other laws.

At this stage the precise obligations that will be placed on affected businesses remain unclear. Further implementing legislation in the form of separate Decrees is to be introduced to provide the missing detail, but the next key date for employers is now 1 September 2022, when the changes are due to come into force in full. 

Key changes to note are: 

• For employers with less than 50 employees with no internal reporting channels, the reporting can be made to the employee’s supervisor, or the employer or a referent designated by the employer. The Sapin II Law already requires employers with 50 or more staff to implement internal reporting channels. Under the new provisions, private companies with fewer than 250 employees will be able to share resources when bringing in such channels and group companies will be able to have a common reporting and investigation process. Those channels will need to be the subject of prior consultation with employee representatives.  Like a number of other EU member states, France has allowed employers to use a common reporting and investigation scheme for companies within the same corporate group. Nothing surprising about that approach except that it is in direct contrast to the interpretation of the Whistleblowing Directive adopted by the EU Expert Group and the European Commission – they both said (on grounds which seem to us to bear little scrutiny) that each subsidiary with 250 or more employees must have its own internal reporting channel at the local level, with the option to report at either local or group level. Having said that, it is still possible that restrictions may be imposed on this option, as we are waiting for implementing legislation on this particular point.    

• In a move away from the current three-tiered reporting model, whistleblowers will be allowed to make reports externally (with or without a previous internal report) to specific authorities at French or EU level. Again, further details are to follow in the form of the implementing Decree. Whistleblowers will also be allowed to report publicly in certain circumstances set out in the law.

• The definition of “whistleblower” has been expanded and is now defined as any person who, “without direct financial compensation” and in good faith, reports or discloses facts about: (i) a crime or an offence; (ii) a threat or prejudice to the general interest; or (iii) a violation, or an attempt to conceal a violation, of an international commitment duly ratified or approved by France, of a unilateral act of an international organisation adopted on the basis of such a commitment, or of EU or French legislation and regulation. It therefore remains wider than the strict requirements of the Whistleblowing Directive, which is only concerned with breaches of EU law.

• Whistleblowers will no longer be required to have first-hand knowledge of matters when reporting on facts that “have occurred or are very likely to occur within the organisation” and that they have become aware of “in the course of their professional activities”. 

• The category of individuals who can blow the whistle and gain the protection of the new law has also been expanded to include not just employees and individuals who occasionally collaborate with the company, but also job applicants, shareholders and officers, business partners and subcontractors (or, as the case may be, their staff, shareholders and officers) and individuals who report anonymously but whose names are subsequently disclosed. Protection for whistleblowers has also been extended to cover “facilitators”, i.e. individuals or private non-profits who help the whistleblower make their report, individuals who have a relationship with the whistleblower and who could suffer from retaliation in the workplace and entities controlled by the whistleblower or for whom the latter works or with whom they are otherwise connected within a work-related context. It is an extremely wide population and the scope for satellite litigation around choice of subcontractor is very considerable – any prior belief that employers have unfettered discretion around which external contractors they use will need to be very carefully checked.

• The new provisions will increase the degree of confidentiality required surrounding whistleblowing disclosures and the identity of whistleblowers. It will also expand the types of action that employers must not take against whistleblowers, including not only discrimination in any form and formal disciplinary action, but also any forms of intimidation and harassment and damage to reputation, amongst other things. Mainly, the burden of proof will be on employers to prove that any detrimental action taken was not linked in any way to the disclosure and that it was justified by a “due cause”.

• In addition, employers must include in their internal regulations the existence of the whistleblower protection system. Thus, the internal regulations will have to contain a reminder of the whistleblower protection system, in the same way as it already exists for provisions relating to moral and sexual harassment and gender-based violence.

• In the event of action taken against a retaliatory measure in which the whistleblower is a plaintiff or in the context of civil or criminal proceedings in which they are a defendant and present facts that make it possible to assume that the proceedings initiated were intended to hinder their reporting or disclosure, the courts will have the ability to award court costs in favour of the whistleblower. In the event of termination of the employment contract following a report, the Labour courts will be able to order an employer to make a contribution towards the whistleblower’s training account (all private sector employees are required to have a personal training account in France). The law also increases the maximum civil fine for taking abusive court action against a whistleblower to €60,000. Whistleblowers’ civil and criminal immunity is also increased. Under Sapin II Law, they were already not subject to criminal or civil liability for any damage caused by going public if they had reasonable grounds to believe that public disclosure was necessary to protect the interests at stake. Whistleblowers and accomplices will not be criminally liable when they have removed, misappropriated or concealed documents or any other medium containing information of which they had knowledge of lawfully and which they report or disclose under the conditions defined by the law.

Action to take now

Affected French companies should now be (i) reviewing their existing whistleblowing policies, practices and information notices to ensure they are compliant with the new requirements; (ii) preparing for consultation with existing employee representatives in relation to any changes; (iii) updating their internal regulations to include reference to the whistleblowers’ protection system and (iv) dusting off their procurement processes to ensure that any choice to use or not use any particular external contractor in any respect can be justified on its merits and is not tainted by some previous alleged disclosure by a current or would-be contractor’s employee.

They should keep an eye out for the various implementing Decrees, which will set out further details on what is required under the new internal reporting channels. As the French data protection authority, the CNIL, may also make changes to its standard of best practice concerning the processing of personal data in the context of whistleblower hotlines in light of the proposed legislative changes, employers may also need to revisit their data protection impact assessments.