Obligation for French companies with at least 50 employees to put in place a whistleblowing system as of 1 January 2018

The Law provides that whistleblowers are protected against any retaliatory measures from their employers provided that they follow a procedure comprised of three stages (except in case of serious and imminent danger):

• Stage 1 – internal reporting: the first report must be made by the whistleblower internally i.e. through his direct or indirect line-manager or through a whistleblower hotline;
• Stage 2 – notification of the competent authorities: if such report is not followed up internally within a “reasonable period”, the whistleblower may report the facts to the judicial or administrative authorities or professional associations;
• Stage 3 – public disclosure: such a disclosure may only take place as a last resort, if the matter reported is not dealt with within three months by the above authorities.

The Sapin II Law requires the relevant companies to put in place appropriate reporting procedures (i.e whistleblowing systems). A Decree of 19 April 2017 clarified the manner in which the reporting procedure is to be implemented, in particular with regards to the information to be provided to the whistleblower.

It provides that the whistleblower must be informed (i) of the indicative period of time required to analyse the alert, (ii) of the measures taken to guarantee his confidentiality as well as that of the reported facts and (iii) of the period of retention applicable to the relevant data.

Companies must also ensure that their whistleblowing system complies with the requirements of the French Data Protection Agency set out in its recently updated decision on whistleblowing and file a declaration with such Agency.

The Law does not provide for any sanctions in case of failure to put in place a whistleblowing system. It is however in the interest of the relevant companies to put such a system in place in order to channel alerts more effectively and in order to limit the risk of whistleblowers disclosing matters directly to the public or to the authorities.

In addition, the Law provides that:

• Anyone who attempts to block an alert may be sanctioned by a 1-year imprisonment and a fine of up to € 15,000;
• Disclosing the identity of the whistleblower by the recipient of the alert may be sanctioned by up to a 2-year imprisonment and a fine of up to € 30,000. 

Companies should therefore structure and formalize their reporting procedure to avoid being exposed to such risk of sanction. If you need any assistance in reviewing or implementing a whistleblowing system compliant with French law please do not hesitate to contact us.