Whistleblowing in France

In November 2018, the Legal Affairs Committee of the European Parliament approved the draft legislation to strengthen whistleblower protection across the European Union. This remains subject to review and approval by the European Council. Please see our article for a high level overview.

Introduction

• From 09 December 2016, “Loi Sapin 2” came into force to assist the fight against corruption, increase transparency and modernise business. This created common rules for whistleblowing across the sectors.
• Previous whistleblowing’s rules created for specific areas such as (banking, insurance and the environment etc) remain in force partially.
• From 01 January 2018, all companies having 50 or more employees must introduce whistleblowing rules.

Who is protected?

To be protected, the individual must:

• be an employee or agent of the company (this includes interns, temporary employees or employees of a temping agency provisioned for the company) but cannot be a supplier
• respect the whistleblowing rules (ie scope, act in good faith, have personal knowledge of the facts, not seeking for personal interest or financial advantage)

Which disclosures are covered?

The whistleblowing disclosures must be limited to the reporting of: (1) a crime or illegal act, (2) a serious and clear breach of an international engagement ratified or approved by France, or of a unilateral act of an international organisation based on such an engagement, (3) a serious and clear breach of the law or regulation, (4) a threat or serious prejudice for general public interest.

However, facts, information or documents covered by national defence, medical or lawyer/client confidentiality are excluded from the whistleblowing rules.

Procedure for making a disclosure

• The whistleblower must respect a procedure for making disclosures, provided by the whistleblowing policy applicable.
• The whistleblowing procedure must respect the three stages of reporting:
  • The upper hierarchy of the whistleblower (employer, referent), who must deal with the admissibility of the reporting within a reasonable time.
  • Judicial or administrative authorities, in case no action has been taken within a reasonable time.
  • Reporting made public in case of inaction forover a period of more than three months.
• In cases of serious and imminent danger, or risk of irreversible damage, the whistleblower may skip the first level and directly go to judicial/administrative authorities or go public.

Payment

Disclosures are always optional and should not give rise to any payment (either from the employer or from a third party).

Protection available

• Protected disclosures: protection against retaliation or reprisals (disciplinary action, dismissal and discrimination). 
• Other disclosures: protection only against disproportionate sanction and unfair dismissal.

When a whistleblowing hotline has been introduced, additional protection applies: 

• Whistleblower: prohibition of retaliation and reprisal, protection of their identity.
• Subject of the report: right to be informed of the nature of the report, right to access and rectify the data as appropriate, right to oppose the processing of their personal data.

Contracting out

It is not possible to agree with individuals that they will not make a protected disclosure.

Remedies

• Protected disclosures: Any measure taken against the whistleblower is null and void (in case of dismissal this can lead to the reinstatement of the employee and the payment of damages).
• Other disclosures: Employer must comply with the rules on disciplinary action and fair dismissals. 
• Unjustified report / slanderous reports: whistleblower can be liable to disciplinary or criminal sanctions.

Whistleblowing policies/arrangements

• Anonymous reporting is tolerated but companies should not actively encourage it (as the CNIL considers that this may likely increase the risk of misuse).
• Consent of employees is not required for introducing a whistleblowing program, but employees must be informed collectively and individually of the implementation through internal policy.
• Consultation (opinion) of the Works Council (new Social and Economic Committee, “SEC”) is required.  

Practical implications

Caution should be applied when processing any personal data in context of HR management (including handling whistleblowing). Such processing is a hot topic in France in light of the General Data Protection Regulation (GDPR) in force since 25 May 2018.

Further details on whistleblowing in France are available here.

Our International Employment Issues summary provides a high level overview of key employment issues including whistleblowing, across multiple jurisdictions.