Implementing decrees have now been published in relation to The Law on Transparency and Anti-Corruption which was enacted in December 2016 (see here). The requirement on employers to introduce a framework for whistleblowing must be complied with by 1 January 2018.
Until this recent Law, France did not have a global framework for whistleblowing procedures as the applicable regulations were diluted among several procedures and lacked overall coherence.
The new law defines for the first time the notion of a "whistleblower", which is defined as "a physical person who reports or reveals, in a disinterested manner and in good faith, a crime or offence, a severe and manifest violation of an international commitment, a law or regulation, or a threat or a severe harm to general interest, which he/she has personal knowledge of." This definition thus covers situations where an act of corruption is reported.
According to the new law, all companies employing at least 50 employees must implement, through internal regulations, an appropriate internal procedure to collect whistleblowing reports. The procedure must be well publicized to employees and must include the 3 following steps:
- The whistleblower alerts his/her immediate managers or the person designated to receive reports under the internal procedure. This designated person can be outside the company, for example, a law firm or a dedicated third party service provider.
- If the report is not addressed by the person to whom it is made within a reasonable time period, the matter can be raised with the relevant judicial or administrative authority or professional body.
- If the report is yet again not addressed within a 3-month period, the whistleblower can disclose it publicly.
The Law specifies that the whistleblower does not have to alert his/her manager in cases of absolute necessity to stop an imminent threat and can directly alert the relevant authority and disclose it to the public.
Once a report is received, it must be acknowledged and the whistleblower informed of the likely timeframe for dealing with the report and of the potential measures which might be taken as a result of the report. They should also be told of arrangements for the destruction of any documents which might allow them to be identified.
If the procedure incorporates any automated processing of a whistleblowing report, this must have approval from CNIL (the French data protection authority) and must be specified within the procedure.
The law also specifies that the implemented procedure must ensure that the identity of the whistleblower, the information provided, and the persons involved in the reported facts remain confidential during the entire whistleblowing process. Violation of such obligation of confidentiality will be subject to a penalty of two years’ imprisonment and a fine of EUR 30,000.
Although, the law does not provide for a specific sanction in case of failure to implement internal whistleblowing rules, implementing an appropriate procedure will enable a company to address potential whistleblowing issues and thus limit the risk of a concerned employees disclosing their concerns directly to the public. In addition, there is a risk of the courts deciding in future that the absence of an internal whistleblowing procedure constitutes a restraint on the right to raise concerns, which is punishable by up to one year of imprisonment and a criminal fine of up to EUR 15,000 for individuals and of up to EUR 75,000 for legal entities.