Law no. 2016-1691 of 9 December 2016 on transparency, anticorruption and the modernization of the economy, known as “Sapin II”, supplemented by decree no. 2017-564 of 19 April 2017, establishes a single whistle-blower status and requires the setting up of a professional whistle-blowing system from 1 January 2018.
Article 8 of the Sapin II law requires legal persons under public or private law with at least fifty employees to set up a suitable system “for alerts raised by their staff members or by outside collaborators”.
This staff threshold is calculated in accordance with the common-law methods set forth under the Labor Code1 . Under the decree of 19 April 2017, the company must have reached this fifty-employee threshold over a period of twelve months, whether consecutive or not, over the past three years.
The decree also specifies that several companies, including within the same group, can set up an alert procedure common to several of them.
Purpose of the alert
The Sapin II law broadly defines events or deeds that can be the subject of alerts. An alert may concern:
- A crime or an offence;
- A grave and clear violation of an international commitment regularly ratified or approved by France, a unilateral act by an international organization adopted based on such a commitment, law or regulation; or
- A threat or a serious damage to the public interest.
Events or deeds covered by national defense, medical and lawyer-client confidentiality are outside the scope of this alert.
Who can be a whistle-blower?
Only a natural person can raise an alert under the alert system.
Those concerned include not only the company’s staff, but also “external or temporary staff” such as temporary workers, interns, subcontractors’ employees, etc.
What are the conditions for granting the whistle-blower status?
- To enjoy the status of whistle-blower, one must:
- Have had personal knowledge of the alleged events or deeds;
- Act in good faith; and
Be disinterested, meaning they must not derive any personal gain from the alert. Whistle-blower protection is excluded if the whistle-blower is acting with the intent of hurting the person they are blowing the whistle on.
Implementation of the alert system Even if the Sapin II law and the decree do not specify it, implementing such a system requires prior reporting to, and consultation with, the works council and the committee on hygiene, safety and working conditions (CHSCT in French).
A step-by-step procedure
The Sapin II law has laid down a three-phase procedure:
1. Internal avenue: Whistle-blowers must bring the facts known to them to the attention of their supervisor, whether direct or indirect, employer or a point of contact appointed by the latter.
Under the decree, the point of contact can be a legal or natural person and may be external to the company. The person must have, “by virtue of their position, the sufficient skill, authority and resources for the performance of their duties”.
2. Communication to the competent authorities: If the recipient of the alerts fails to take action within a reasonable time frame, the whistle-blower can go to the legal authority, administrative authority or professional bodies.
3. Disclosure to the public: If none of the above authorities deals with the alerts within a three-month period, the whistle-blower can go public.
In case of serious and imminent danger or of a risk of irreversible harm, the whistle-blower can talk directly to the competent authorities or go public with their alert.
Lastly, the Sapin II law allows anyone to go to rights advocates in order to be directed to the appropriate alert-gathering body.
The company must determine “the instrument best suited to meeting the obligation to set up an alert procedure”.
The alert procedure must indicate:
- How the whistle-blower can raise an alert (form of the alert, the facts or information to be provided, etc.).
- The steps taken to inform the whistle-blower “without delay” about receipt of their alert, the “reasonable and foreseeable time frame” for reviewing its admissibility, and how they will be informed about what action has been taken following their alert.
- Measures guaranteeing strict confidentiality of the identity of the whistle-blower, persons concerned by the alert and the facts reported, including in case of disclosure to third parties when this is necessary.
- Retention period: the decree also provides for a maximum period of two months from the conclusion of admissibility or verification operations after which the company must destroy the information on the file identifying the whistleblower and the persons concerned by the alert where no action was taken. The whistle-blower and the subjects of the alert must be informed about the closing of the file.
- Existence of automated processing of alerts after prior authorization by the French data protection authority (Commission Nationale de l’Informatique et des Libertés).
The company must inform its employees and external or temporary collaborators about the existence of the alert procedure by all means (posters, publication, website).
Immunity from disciplinary action
The whistle-blower is protected from any disciplinary measure or any disciplinary sanction based on the fact that they raised an alert in accordance with the appropriate applicable procedure.
In the event that the whistle-blower is terminated following an alert, he or she may file an application for an interim injunction with the industrial tribunal.
They are also covered by a favorable rule of evidence. In the event of sanction, it is up to the employer to show that its decision is based on objective facts unrelated to the whistleblower’s testimony.
Immunity from prosecution
The Sapin II law creates a new cause for exemption from criminal liability in case of disclosure of some secrets protected by law (with the exception of secrets excluded from the scope of the alert), subject to:
- The person fitting the definition of whistle-blower;
- The disclosure being necessary and proportionate;
- The disclosure being made under the alert procedure.
Also, where a libel suit is filed against the whistle-blower, the civil fine that may be imposed is EUR 30,000.
Lastly, any hindrance to the forwarding of an alert is punishable by a one-year prison term and a fine of EUR 15,000.