Firm: CAPSTAN Avocats 

Pursuant to various HR law reforms in 2017, most of which are applicable as of 2018, your HR department will need to take immediate action to bring your company into compliance. Here is an overview of the most significant measures.

Goodbye Works Council, hello Social and Economic Committee!

In all companies, Staff Delegates, the Works Council and the Health and Safety Committee must be replaced by the Social and Economic Committee (SEC). It should be noted that in companies with multiple sites, in addition to the company level SEC, you may have to elect site level staff representation bodies.

Depending on your organisation’s current situation, you will have to put in place the SEC sometime between now and 31 December 2019. Until then, the current representative bodies continue to work according to the old rules.

If you have no staff representatives in place and the headcount has reached the equivalent of at least 11 full-time employees for the past 12 consecutive months, you must launch the SEC election process as soon as possible. If staff representatives are already in place, the SEC must be put in place when their current term of office expires or by 31 December 2019, whichever is earlier. As needed, this deadline can be altered:

  • If the current terms of office are due to expire in 2018, they may be reduced or extended for a maximum of one year, either through a collective bargaining agreement or by a unilateral decision from the employer after consultation of the existing staff representative bodies.
  • If there are multiple representative bodies and their terms do not end at the same time, one or more of them may be reduced or extended as needed so that they coincide, either through a collective bargaining agreement or by a unilateral decision from the employer after consultation of the existing staff representative bodies.

It should be noted that the election process for the SEC differs slightly from the processes that were previously applicable.

Are you ready for the GDPR?

The EU General Data Protection Regulation (GDPR) will come into force on 25 May 2018. When it does, it will have an immediate impact on your operations located in France, which must have adapted the way they collect, use and transfer data, including their employees’ personal data by this date. Additionally, an upcoming law is expected in France that will provide minor adjustments to the GDPR.

As non-compliance could lead to fines of up to EUR 20 million or 4% of global annual turnover, it is worth giving this issue careful thought.

Here is an overview of how the new set of rules flowing from the GDPR will impact your HR management.

The obligation to give notice of personal data processing to the French data protection authority (CNIL) will be replaced by a general principle of accountability. Thus, all companies will have to comply and be able to demonstrate that they are compliant with the law at all times.

Employees’ rights will be strengthened: the employer will have to provide its staff, job applicants and interns with clear and transparent information about – among others - the purposes and the legal basis for the processing, the recipients of the data, the period for which the personal data will be stored, and their individual rights (e.g. their rights to access, correct or delete their data and the right to lodge a complaint with a supervisory authority).

Personal data can be collected:

  • If it is strictly required for the employer to fulfil its legal and contractual obligations, from the beginning of the employment relationship to its termination, without the employee’s consent.
  • If the employer has a legitimate interest in doing so (e.g. transfer of personal data in relation to an acquisition project); or
  • If these two options are not applicable, the employer must obtain the employee’s consent. In this case, the employee must give his or her express and unambiguous consent and should be informed of his or her right to withdraw their consent at any time. A general acceptance clause included in the employment contract will not be sufficient to prove compliance with this new obligation.

Companies with at least 250 employees will be required to maintain internal records of their processing activities, including the content and purpose of the data collection or processing, recipients, the conservation period, transfer to a non-EU country, technical and organizational security measures in place, etc.

All companies will have to conduct a Data Privacy Impact Assessment where the processing is likely to result in a high risk that the rights and freedoms of the employees may be violated.

Depending on their core activity, companies may also need to appoint a Data Protection Officer (DPO), who is either an employee or an external data protection expert. This DPO will replace the current Correspondant Informatique et Libertés and will have special protection against dismissal.

When HR functions are outsourced (e.g. recruitment, payroll, occupational health services, etc), it will be necessary to update service contracts to ensure that subcontractors also comply with GDPR and do not put the company at risk.

Transferring employees’ data to non-EU countries, even within the group, will remain conditioned upon the Privacy Shield (transfers to the United States) or other measures ensuring adequate protection for the transferred data (use of approved standard contractual clauses or binding corporate rules).

These changes will require updating the company’s Internal Rules, employment contracts, HR policies, etc. Informing and/or consulting staff representatives may also be necessary.

Capstan Avocats and Ius Laboris have developed a specific tool to help your organisation assess its compliance.

Make sure you have a valid whistleblowing policy in place

Since 1 June 2017, companies with at least 500 employees (or part of a group with at least 500 employees, whose parent company’s head office is based in France) and a turnover or consolidated turnover exceeding EUR 100 million have been required to implement an anti-corruption policy. This policy must include a code of conduct that must be appended to the company’s Internal Rules (règlement intérieur), a formalised whistleblowing policy that allows employees to report acts or behaviours that violate laws and regulations or the company’s code of conduct, a training programme as well as disciplinary procedures.

In addition, since 1 January 2018, there is a general obligation to implement a whistleblowing policy for all companies with at least 50 employees.

Note that the content of said whistleblowing policy has been expanded by the CNIL following its deliberation of 22 June 2017. If you have not already done so, you must ensure that your company’s policy is in line with these recent changes.

More information regarding this obligation is available in our November 2017 newsletter.

Telework: what are the changes?

Companies in which teleworking is already in place, on an occasional or regular basis, should now set out collective terms and conditions on telework. This can be done by negotiating a collective bargaining agreement or, if this is not possible, by issuing a unilateral decision (telework policy), after consultation of the staff representation bodies, if any.

In the absence of such a collective bargaining agreement or policy, it is still possible to put in place telework via an individual agreement. However, to mitigate the risk of unequal treatment claims, it is recommended that the company at least define general principles applicable to telework in a formal policy.

Reminder: mandatory anti-discrimination training for your recruitment staff

Since January 2017, organisations with at least 300 employees and all recruitment agencies must provide anti-discrimination training to their staff in charge of recruitment.

More means to negotiate company-level agreements

In addition to creating greater flexibility in relation to the annual mandatory negotiations (e.g., on salary, working time, etc.), the law has changed to expand the possibility to negotiate with employee representatives, when there are no labour union delegates (délégués syndicaux).

Except in specific cases, the law now also permits company-level agreements to prevail over higher level (e.g., industry, inter-professional, etc.) collective bargaining agreements, even where the company-level agreement provides for terms that are less favourable for the employees.

This will allow businesses to better adapt their employees' working conditions to the specific characteristics and needs of their activity.