The Law 2016-1691 of December 9, 2016 on transparency, fight against corruption and modernisation of the economy (the “Law Sapin II”, hereinafter “the Law”) provides for a protection regime applicable to persons, notably employed persons, who report, selflessly and in good faith, certain serious facts of which they have personal knowledge. For further information on such regime, see our article “New whistleblowing regime under the law Sapin II”.
According to article 8, III of the Law, legal persons governed by private law of at least 50 employees as well as certain public organisations must implement appropriate procedures for gathering alerts issued by their staff or external and occasional partners (referred hereinafter as the “professional whistleblowing procedures”).
The modalities of such procedures are specified by the decree 2017-564 dated April 19, 2017. Said decree will come into force on January 1, 2018.
The present publication aims at describing such modalities, it being underlined that only the rules governing legal persons governed by private law will be developed.
Companies with a workforce of at least 50 employees must implement such professional whistleblowing procedures.
The threshold of 50 employees is determined in accordance with the rules set forth in articles L.1111-2 (referring to the workforce to be taken into account for calculating the headcount), L.1111-3 (referring to the work force to be excluded from the headcount) and L.2322-2, al.1 of the Labor Code (referring to the period under which such threshold must be reached). In this respect, the threshold has to be reached during 12 months, consecutive or not, within the three previous years.
Implementation of the procedure
Each company concerned has the choice to determine the most appropriate legal instrument to comply with the obligation of implementing such professional whistleblowing procedure and adopts it in accordance with the laws and regulations applicable to it.
A common procedure to several companies may be implemented as long as they reach a concurring decision taken by their competent bodies. For instance, it can be the case within groups.
Modalities of the procedure
The professional whistleblowing procedure has to precise the conditions under which the whistleblower:
- discloses the alert to the line manager, direct or indirect, to the employer or to a specific point of contact (the identity of the point of contact being mentioned in such procedure);
- provides facts, information and documents, in whatever form and by whatever medium, that would substantiate his alert when he has such elements at his disposal;
- provides elements needed to interact with the recipient of the alert.
Such procedure specifies the arrangements taken by the company:
- to inform without delay the whistleblower of the receipt of his alert as well as of the reasonable and foreseeable deadline needed to examine its admissibility and the modalities under which he will be advised of the outcome;
- to guarantee that the whistleblower’s identity, the facts and the people targeted by the alert remain confidential, including in case of disclosure to third parties where it is needed for the sole purpose of verifying or treating the alert;
- to destroy the elements of the file that would permit to identify the whistleblower and people targeted by the alert when no action has been taken.
Moreover, the procedure must indicate the existence of an automated processing of alerts implemented following the authorization of the French data protection authority (CNIL).
Please note that if this professional whistleblowing system complies with the conditions set by the CNIL in its decision of December 8, 2005 as amended from time to time, it may be subject to a simplified preliminary statement with the CNIL. Otherwise, a standard preliminary statement with the latter has to be made.
Displaying the procedure
The company must display the whistleblowing procedure by any means, notably by way of notification, posting or publication, if any on its website, in such conditions that make it available to its staff and to its external or occasional partners. This information may be made through electronic channels.
The point of contact
The point of contact designated by the employer:
- can be someone outside the company;
- can be a physical person or, whatever its denomination, any entity governed by private or public law, with legal personality or not;
- has, through its positioning, the expertise, authority and sufficient resources to exercise its missions.
The point of contact as well as any person called upon to hear the alert is subject to the confidentiality obligations set forth by the Law.
In this respect, they cannot disclose, except to the judiciary authority, any elements that might identify the whistleblower without the consent of the former and any information that might identify the people targeted by the alert before it has been proven to be justified. A breach of confidentiality is punishable by 2 year’s imprisonment and a fine of 30,000 € (for a physical person) and by a fine of 150,000 € (for a legal person).