While whistleblowing has given rise to legislation since the end of the 1980s in the United States and the end of the 1990s in the United Kingdom, France has only recently caught up by enacting the “Sapin II” Act on December 9, 2016.
A decree of application was published on April 19, 2017 that becomes effective as of January 1, 2018, specifying how employers must implement the new whistleblowing requirements.
1. Who is protected as a whistleblower?
A protected whistleblower is “a natural person who reports or reveals, without personal interest and in good faith, a crime or offence, a serious and clear violation of an international commitment, a law or a regulation, or a threat or a serious harm to the public interest, of which the individual has personally gained knowledge”.
2. How is the whistleblower protected?
The whistleblower cannot be criminally liable.
His/her identity must remain confidential, except in relation to the judicial authorities and only with his/her consent.
Any decisions of the employer made in respect of the whistleblower’s disclosure, which impacts him/ her, may be considered to be discriminatory and therefore null and void.
A person is not protected as a whistleblower if they do not meet the legal conditions mentioned in paragraph 1 above and/or breach: (i) the National security; (ii) medical confidentiality; and/or (iii) lawyer-client privilege.
3. Which employers are affected and what are their legal obligations to implement the whistleblower protection?
All companies with 50 employees or more are required to implement an internal disclosures procedure (hereinafter referred to as the “whistleblowing procedure”).
The 50 employees-threshold is assessed month by month and must be reached over 12 months, whether or not consecutive, over the last three years.
Companies with less than 50 employees are not required to implement this procedure, but could do so on a voluntary basis.
IMPLEMENTING THE WHISTLEBLOWING PROCEDURE
The whistleblowing procedure could be implemented by any legal vehicle (e.g. the employer’s unilateral decision, a company/groupwide collective bargaining agreement, the company’s internal regulations, etc.). If the company has employees’ representative bodies, they must be informed and consulted prior to the implementation of the whistleblowing procedure.
(a) The employer must ensure that the whistleblowing procedure addresses the following:
• the ways in which the whistleblower can report his/her disclosure;
• the recipient of the disclosure, who can be the whistleblower’s manager, the employer or a person designated by the employer ;
• the measures taken by the employer to inform: (i) the whistleblower about the way in which his/her disclosure will be addressed, including prospective timing; and (ii) the person(s) referred to in the disclosure about the closure of the investigation and the disclosures admissibility;
• the measures taken by the employer to guarantee the confidentiality of the whistleblower, the reported facts, the person(s) referred to in the disclosure, etc.;
• the measures taken by the employer to ensure the destruction of the disclosure file, when the disclosure is inadmissible or on the expiry of a two months period following the end of the investigation; and
• the existence of an automated processing of the disclosure data, as duly submitted to the French Data Protection Authority (“CNIL”).
(b) The employer must inform its employees and temporary/occasional workers about the whistleblowing procedure.
4. What are the risks of not complying with the whistleblowing legislation?
Neither the Sapin II Act nor its decree of application provides for a specific sanction if the employer fails to implement a whistleblowing procedure.
However, such a failure could be damaging for the employer in litigation – notably with a whistleblower. In addition, if an disclosure is not addressed within a reasonable time period by the recipient, it can be directly disclosed to the relevant authorities (including a judge). If the disclosure is not addressed by the relevant authorities, disclosure it could ultimately be disclosed to the public.
Revealing information that could lead to the identification of a whistleblower will constitute a criminal offence, punishable by up to two years’ imprisonment and/or a fine of €30,000.
If a company is part of an international group that has already implemented a whistleblowing policy, it is advisable to review that policy and adapt it to the French requirements, if necessary, instead of implementing a new policy.