The internal whistleblowing system must be adapted to comply with the Law designed to improve the protection of whistleblowers that will come into force on September 1, 2022

In order to strengthen the protection of whistleblowers and prevent the risks of retaliation measures within their company, Law No. 2016-1691 of December 9, 2016 on transparency, the fight against corruption and the modernization of economic life (known as the “Sapin 2 Law”) requires companies with more than 50 employees to set up an internal whistleblowing system.

Law No. 2022-401 of March 21, 2022 designed to improve the protection of whistleblowers requires companies to update their internal whistleblowing system.

Pursuant to Article 17 II 2° of the Sapin 2 Law, the internal whistleblowing system is “aimed at collecting reports from staff members about conducts or situations that violate the company’s code of conduct” (I).

Law No. 2022-401 of March 21, 2022 designed to improve the protection of whistleblowers by expanding the recognition of the whistleblower status within the company and the reporting scope provided for by law and by removing the hierarchy of reporting channels requires companies to update their internal whistleblowing system (II).

I. Implementation of an internal whistleblowing system

The internal whistleblowing system is the procedure that companies implement to enable their staff to inform a dedicated contact person about conduct or situations that are potentially contrary to the code of conduct.

The French Anti-Corruption Agency recommends setting up a single technical platform for receiving reports not only from company’s permanent staff members but also from external collaborators and casual contractors.[1] It must be presented without delay to new hires.

The system applies to the reporting of a wide range of facts, including breaches of the rules governing public procurement, prevention of money laundering and tax evasion, protection of the environment, protection of privacy and personal data, state aids, etc.

The whistleblowing system must be secure and specify inter alia:

• The type of information that can be reported;
• The person who can make a report;
• The channels for making reports: It could be a dedicated e-mail address, a management software program, or even, for some companies, a specific platform;
• The procedures for whistleblowers to provide information and documents to back up their reports,
• In case of internal investigations, the business information and documents submitted by the whistleblower that may be used for the purpose of such investigations;
• The provisions made to notify without delay the whistleblower of due receipt of the report and of the time needed to determine its admissibility;
• The provisions made to notify the whistleblower, and, where necessary, the persons named in the report, that the procedure is closed.

Compliance by the person making the report with the applicable procedure may enable him/her to benefit from the whistleblower status, and, thereby, to be protected against the risks of dismissal, harassment and/or retaliation by his/her employer.

II. Adapting the internal whistleblowing system to the Law designed to improve the protection of whistleblowers

1. Expansion of the reporting scope

The Law designed to improve the protection of whistleblowers, which transposed EU Directive 2019/1937 of October 23, 2019, reinforces the protection of whistleblowers by increasing the number of persons who can benefit from the whistleblower status and by expanding the scope of the facts that can be reported.

With regard to the facts, while the whistleblower had to have prior personal knowledge of the facts to be reported, the Law designed to improve the protection of whistleblowers now provides that, in the framework of his/her professional activities, the whistleblower may report facts disclosed by a third party. However, the requirement to have personal knowledge of the to-be reported facts remains when the relevant information is obtained outside the framework of the whistleblower’s professional activities.

The requirement concerning a “serious and manifest violation” of an international commitment has been removed and the information that can be reported is that relating to:

“a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of an international commitment properly ratified or approved by France, a unilateral act of an international organization taken on the basis of such a commitment, European Union law, law or regulation”.[2]

In addition, the reported facts may also relate to “facts that may occur” and not only to facts/actions that have occurred, which may in practice pose problems with regard to the presumption of innocence and the absence of materialization of the offense/violation.

In accordance with the provisions of the Sapin 2 law currently in force, the whistleblower must act in a disinterested manner, which excludes for example:

• A person who is in conflict with his/her employer,
• A person who is a victim of the reported violation.

The Law designed to improve the protection of whistleblowers that will come into force on September 1, 2022 merely imposes that the whistleblower must act without direct financial compensation, which makes it possible to extend the protection to the cases mentioned as examples above.

The whistleblowing system must, therefore, be amended to take these changes into account and to guarantee that the person making the report can benefit from the status of whistleblower whenever (i) he/she acts without financial consideration, and (ii) the reported information falls within the reporting scope provided for by law.

2. Removal of the obligation to go through an internal reporting procedure before considering an external reporting procedure

Current Article 8 of the Sapin 2 Law provides that all reports must first be made internally and brought to the attention of the supervisor, the employer or the designated contact person.

It is only if the person to whom the report is addressed fails to take action within a reasonable period of time that the report sent to the judicial authority, the administrative authority or professional bodies is considered admissible.

As a last resort and if the report is not processed by the secondary recipient within a period of three months, the report may be made public.

The Law designed to improve the protection of whistleblowers provides that the whistleblower can make an internal or an external report, and removes the hierarchy between the two reporting channels.

More specifically, whistleblowers may now make an internal report, in particular when they believe that “it is possible to effectively remedy the violation by this means and that they are not exposed to a risk of retaliation”.

However, it remains essential for companies to encourage internal reporting in order to be able to address the reported facts and thus avoid that the investigation of such facts be entrusted in the first place to the judicial and administrative authorities that will necessarily interfere in the company’s affairs.

It is, therefore, necessary to guarantee and to remind whistleblowers in the internal whistleblowing system that their reports will be taken into account and will not give rise to retaliation if they are made in good faith, with the possibility of remaining anonymous.

3. The duration of the processing of reports

The Law designed to improve the protection of whistleblowers introduces a new Article in the Sapin 2 Law that stipulates as follows:

“reports may only be kept for the period of time strictly necessary and proportionate to their processing and to the protection of the whistleblowers, of the persons referred to therein, and of the third parties they mention, taking into account the time required for any further investigations. Data relating to whistleblowing reports may however be kept beyond this period, provided that the natural persons concerned are neither identified nor identifiable. When processed, personal data relating to whistleblowing reports shall be kept in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data”.

The internal whistleblowing system must, therefore, be amended to recall these processing periods and also to adapt the procedure internally so that reports are not kept beyond the period provided for by law.

Companies with at least 50 employees will also have to complement their internal rules and regulations to mention the existence of the whistleblower protection system put in place.[3]

[1] The recommendation of the French Anti-Corruption Agency concerning the internal whistleblowing system are available on its website: https://www.agence-francaise-anticorruption.gouv.fr

[2] Amendement to Article 6-1 of the Sapin 2 Law

[3] Amendment to Article L. 1321-2 of the French Labor Code

Claire Filliatre

Member of the Lyon Bar

All publications by Claire Filliatre

• Share