The French bill (act n° 2022-401) has been passed on 21 March 2022 and has been applicable since 1st September 2022. In addition, the decree of 3 October 2022 on the procedures for collecting and processing whistleblower alerts and establishing the list of external authorities set up by the law of 21 March 2022 was promulgated.
Legislation passed / Directive implemented.
The facts reported may concern "information" on a crime, offence or violations of the law, but also "attempts to conceal" these violations.
The violation of the rule will no longer have to be "serious and manifest".
A whistleblower is now defined as follows:
"the physical person who reports or discloses, without direct financial compensation and in good faith, information concerning a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of international or European Union law, the law or the regulations."
Certain protections offered to whistleblowers are extended to :
I: Companies required to set up an internal procedure
Legal entities employing at least 50 employees, must set up an internal procedure for collecting and processing alerts. The French decree of 3 October 2022 specifies that this threshold is to be assessed:
- at the end of 2 consecutive financial years ;
- in accordance with the procedures set out in I of article L. 130-1 of the Social Security Code.
II: The whistleblowing procedure may be implemented by any means
The company must communicate its internal whistleblowing procedure to potential whistleblowers (employees, for example), by any means that ensures sufficient publicity and under conditions that make it permanently accessible.
II: The internal procedure must provide a channel for receiving whistleblowers
The internal procedure is required to set up a reception channel enabling any whistleblower to send a written or oral report, as provided for in the procedure. The reception channel may be managed externally by a third party.
III: The company ensures that the report is admissible...
Once the alert has been received, its processing begins with an analysis of its admissibility in the light of the legal conditions. To this end, the company may request any additional information from the whistleblower.
When the legal conditions are met, the company processes the alert. If the report appears to be well-founded, the entity will use the means at its disposal to remedy the matter.
IV: One or more departments/entities are responsible for the internal procedure
The internal alert procedure must indicate the person(s) or department(s) designated to receive and process alerts. By virtue of their position or status, these persons or departments must have sufficient competence, authority and resources to carry out their duties.
V: The internal procedure guarantees confidentiality and integrity
The internal procedure must guarantee the integrity and confidentiality of the information collected, in particular the identity of the author of the alert, the persons concerned by the alert and any third party mentioned in the alert. In particular, members of staff who are not authorised to know the information must be denied access to it.
VI: The external authorities responsible for issuing alerts are designated as follows
Yes.
No.
Yes.
The CNIL (French data protection agency) recommends that companies do not encourage anonymous reports (which are defined as a report whose author is neither identified nor identifiable) but states that if anonymous reports are allowed:
No.
Many retaliatory actions (e.g. dismissal, exclusion from bonus etc.) can be annulled by labour courts. An employee may in particular seek an urgent order for reinstatement from the labour court.
Remedial measures against retaliation extend to non workers (e.g. by prohibiting blacklisting at sector or industry level).
Whistleblowers expressly benefit from a protection against moral and sexual harassment.
The implementing law further provides for criminal sanctions against the perpetrator of retaliation against a whistleblower, including imprisonment of 3 years and a fine of 45 000 euros.
The decree provides for the possibility of setting up a joint procedure between entities employing fewer than 250 employees, subject to a concordant decision by the competent bodies of each of them. On the other hand, entities with more than 250 employees in the same group seem only to be able to set up identical procedures, which is not the same thing as a single procedure, despite what was provided for in the law.
