On 11 December 2016, the law targeting transparency, anti-corruption and the modernization of the economy, also known as "Sapin II", entered into force, creating a new legal framework for defining and protecting whistleblowers.
On 20 April 2017, the Ministry of economic and finance published the Decree n°2017-564, dated 19 April 2017, implementing Article 8 (III) of Sapin II, pursuant to which any company having at least 50 employees in France is under the duty to implement "appropriate procedures to receive concerns from employees and external/casual collaborators".
This duty will enter into force on 1 January 2018.
Wide definition of a whistleblower
Sapin II defines a whistleblower as "a physical person who reports, selflessly and in good faith, a crime or an offence, a serious and obvious breach of an international commitment duly ratified or approved by France, of a unilateral act from an international organization issued on the basis of such commitment, of law or regulation, or a serious threat or harm to the public interest, of which he has personal knowledge".1
Whistlebower protection / Criminal penalties
Whistleblowers must not be subject to discriminatory measures or any retaliation by an employer. Any such actions will be null and void under French labor Law.
Preventing someone from raising a concern is a criminal offence punishable by up to one year of imprisonment and a fine of up to EUR 15,000 (the legal entity itself may face a fine of up to five times this amount, i.e. EUR 75,000).
According to Sapin II, the whistleblowing process should take place as follows:
- The whistleblower should raise the alert with his/her hierarchical manager, employer or the person designated by the employer for that purpose (the "Whistleblowing Officer");
- If the alert is not addressed within a reasonable time period, the alert can be raised to the relevant administrative or judicial authority, or to the professional authorities; and
- If the alert is still not addressed within three months, the whistleblower can disclose it to the public through the press or social media.
Where there is a serious and imminent threat or risk of irreversible damage, the whistleblower may bring the alert directly to the attention of the administrative or judicial authority, or to the professional authorities. The whistleblower may also alert the public directly.
Pursuant to Article 9 of Sapin II, during the entire whistleblowing process, the identity of the whistleblower and that of the person(s) referred to in the alert, as well as the information received, must remain confidential. Revealing information that could lead to the identification of a whistleblower is punishable by up to two years’ imprisonment and a criminal fine of up to EUR 30,000 (the legal entity itself may face a criminal fine of up to five times this amount, i.e. EUR 150,000).
Implementing Decree of 19 April 2017
The Decree of 19 April 2017 sets out, in particular, the following measures:
- Employers must determine the appropriate legal instrument for raising concerns but there is no obligation to set up a hotline or any other electronic process;
- The Whistleblowing Officer’s identity must be specified in the procedure, i.e. a member of the same company or an external individual or legal entity (such as a third-party contractor).
- The Whistleblowing Officer and, generally speaking, all persons who may know about a concern raised are bound by a duty of confidentiality (see Article 9 above mentioned).
Please note that the procedure enabling whistleblowing has to mention the existence of an automatic processing report implemented upon authorization from the French data protection authority (the "CNIL"). Indeed, any procedure involving personal data processing is currently subject to a prior authorization from the CNIL. However, as from 25 May 2018, the new General Data Protection Regulation will replace French laws in relation to data protection and will no longer require obtaining such prior authorization.
Finally, before implementing or modifying existing whistleblowing procedures, a prior information and consultation of the relevant employees’ representative bodies (e.g. works council, health and safety committee) will have to be carried out as well as other implementation formalities before the labor inspectorate and the employees themselves.