Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 18 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

01. Which body of rules govern the status of whistleblowers?

01. Which body of rules govern the status of whistleblowers?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

In France, whistleblowing was governed by Law No, 2016-1691 on transparency, the fight against corruption and the modernisation of economic life, also known as Sapin II.

A few years later, the European Parliament adopted Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law.

The main objective of the EU Directive is to harmonise EU member states’ legislation about whistleblowing.

In France, the transposition laws of the EU Directive were definitively adopted and came into force on 21 March 2022:

  • an “ordinary” law aimed at improving the protection of whistleblowers; and
  • an “organic” law aimed at strengthening the role of the French Human Rights Defender in terms of whistleblowing.

These new local Laws comply perfectly with European standards and make numerous amendments to Sapin II.

Last updated on 29/07/2022

02. Which companies must implement a whistleblowing procedure?

02. Which companies must implement a whistleblowing procedure?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The scope of the whistleblowing procedure is very broad. Companies with more than 50 employees, public-sector institutions, authorities and municipalities with 10,000 or more inhabitants must set up internal reporting channels for whistleblowers. 

Last updated on 29/07/2022

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The procedure for collecting and processing alerts may be common to several or all of the companies in a group, under the terms set by an application Decree to be published.

Last updated on 29/07/2022

04. Is there a specific sanction if whistleblowing procedures are absent within the Company?

04. Is there a specific sanction if whistleblowing procedures are absent within the Company?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

There is no specific legal sanction for failing to create a whistleblowing procedure.

However, the absence of an internal reporting channel increases the risk for the company’s reputation as whistleblowers could use external reporting such as public disclosure in the press or social media.

Besides, any person who obstructs the transmission of a report may be exposed to criminal suit and a penalty of up to one year’s imprisonment and a fine of 15,000 EUR.

Last updated on 29/07/2022

05. Are the employee representative bodies involved in the implementation of this system? 

05. Are the employee representative bodies involved in the implementation of this system? 

Flag / Icon

France

  • at Proskauer
  • at Proskauer

A company’s work council must be informed and consulted before the implementation of a whistleblowing procedure.

Indeed, work councils are informed and consulted “on all questions which are linked to the organisation, management and general running of the company and in particular on conditions of employment, professional training, working conditions and on the introduction of new technologies or any significant change in health and safety conditions or working conditions” (article L. 2312-8 of the Labor Code).

Last updated on 29/07/2022

06. What are the publicity measures of the whistleblowing procedure within the company?

06. What are the publicity measures of the whistleblowing procedure within the company?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

From 1 September 2022, the internal regulation applicable within the company must mention the whistleblowing process and protection.  The internal regulations will be brought to the attention of all persons having access to the workplace.

Moreover, if there is implementation or modification of the whistleblowing process, we recommend informing employees by all means.

Last updated on 29/07/2022

07. Should employers manage the reporting channel itself or can it be outsourced?

07. Should employers manage the reporting channel itself or can it be outsourced?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

Employers can subcontract the management of the whistleblowing procedure to an external supplier, which will be in charge of:

  • setting up the reporting channel available;
  • receiving complaints; and
  • investigating the reported facts.

In practice and as an example, the external supplier can set up a telephone hotline or an email address for the collection of reports. These are then transmitted to the employer to decide on any action to be taken.

Last updated on 29/07/2022

09. What precautions should be taken when setting up a whistleblowing procedure?

09. What precautions should be taken when setting up a whistleblowing procedure?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

During the processing of the report, the procedure implemented must guarantee the confidentiality of the identity of its authors, the persons concerned and any third party mentioned within.

Moreover, the company must respect guarantees of independence and impartiality in the treatment of reports. These guarantees must be specified in a published application decree.

Companies are also required to comply with GDPR obligations. In this regard, the French Data Protection Authority (CNIL) has published a frame of reference to help public and private organisations implement whistleblowing procedures in compliance with data protection regulations (CNIL deliberation dated 18 July 2019).

Last updated on 29/07/2022

10. What types of breaches/violations are subject to whistleblowing?

10. What types of breaches/violations are subject to whistleblowing?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The list of breaches and violations provided by the law is very wide. It covers:

  • crime and offences;
  • threat or harm to the public interest;
  • violation of an international commitment duly ratified or approved by France, or of a unilateral act of an international organisation taken based on such a commitment; and
  • a violation of the law of the European Union, or its regulations. 

However, facts, information or documents, covered either by national defence, medical or lawyer/client confidentiality are excluded from the whistleblower rules. This means that it is not possible to divulge that kind of information. If the whistleblower does it anyway, he or she will not benefit from whistleblower protection.

Last updated on 29/07/2022

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

There are special whistleblowing procedures for some areas, including banking and insurance; these industries which may offer additional advantages, such as a simplified reporting procedure.

For instance, the Financial Market Authority (FMA) has deployed a whistleblowing system reserved for persons looking to provide the FMA with strictly confidential information concerning infringements of European legislation, the Monetary and Financial Code or the FMA General Regulation. 

A whistleblower who has learned of such events in his or her working life or business relationships can report them in writing (in electronic format or on paper), verbally by phone, or by meeting in person with specialist members of the staff in the offices of the AMF.

An acknowledgement of receipt is sent within seven days.

Guarantees apply to whistleblowers who report infringements accurately:

  • the originator of the report, the person targeted and the information collected are strictly confidential during receipt and processing; and
  • the whistleblower would also not be subject to dismissal, punishment or discriminatory measures, whether direct or indirect, notably concerning compensation or career development, or any other unfavourable measure, for having in good faith reported an infringement to the FMA.

(DOC-2018-13 – Procedures for whistleblowers reporting infringements of the regulations to the FMA; Act 2016-1691 of 9 December 2016 on transparency, anti-corruption and economic modernisation, article L.634-1 of the Monetary and Financial Code)

Last updated on 29/07/2022

13. Who can be a whistleblower?

13. Who can be a whistleblower?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

To benefit from whistleblower protection, the individual can be:

  • an employee;
  • a former employee when the information was obtained in the course of his or her employment;
  • applicants for a job;
  • shareholders or partners of the entity concerned;
  • external and occasional employees of the entity; and
  • contractors and subcontractors.
Last updated on 29/07/2022

14. Are there requirements to fulfil to be considered as a whistleblower?

14. Are there requirements to fulfil to be considered as a whistleblower?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

A whistleblower must fulfil the following requirements:

  • Be a natural person. It excludes legal entities such as Companies, Works Councils or associations.
  • Act in good faith.
  • Do not research any direct financial compensation.
Last updated on 29/07/2022

15. Are anonymous alerts admissible?

15. Are anonymous alerts admissible?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

French law allows anonymous whistleblowing reports.

The processing of anonymous alerts is subject to the same rules as for identifiable alerts. However, provisions requiring feedback from the author of an internal or external alert are not applicable in the case of an anonymous alert.

The CNIL states that anonymous reports are the exception, not the rule, and should be managed with particular guarantees.

It means that when an employer receives an anonymous alert, it is preconized: to establish the seriousness of the reported violation, to establish the existence of detailed factual elements, to subject it to prior examination by the first recipient of the report before the initiation of further investigations and also to make clear, during any transmission relating to this alert, that it is anonymous.

The anonymous whistleblower is covered by the same protections as an identified whistleblower. It means that if an employer refuses to process an anonymous alert, it could be subject to an obstruction:

  • Interfering with the transmission of an alert is a criminal offence punishable by up to one year of imprisonment and a fine of 15,000 EUR.
  • In parallel, according to the law the maximum civil fine for any dilatory or abusive procedures against a whistleblower due to the information reported or disclosed is 60,000 EUR. 
  • In addition to these fines, the author of the obstruction may be ordered to pay damages to the whistleblower.

 

Last updated on 29/07/2022

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The law distinguishes two situations:

  • information obtained in the course of professional activity: in this case, indirect knowledge is sufficient; and
  • Information not obtained in the course of professional activity; in this case the whistleblower must have personal knowledge of these facts.

For example, if a person said to a co-worker that he had witnessed some illegal behaviour within the company, the co-worker could make a report through the intern alert channel even if he had not directly witnessed the facts.

Last updated on 29/07/2022

17. What are the terms and conditions of the whistleblowing procedure?

17. What are the terms and conditions of the whistleblowing procedure?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

French law provides for specific requirements regarding independence, impartiality, confidentiality and data protection.

  • Independence and impartiality: the whistleblowing procedure must be independent and impartial in the treatment of the report and respect time limits in providing feedback to the author of the alert (fixed by decree to be published).
  • Confidentiality: the procedure must protect the identity of the authors, the persons concerned and any third party mentioned in the report.
  • Data protection: data relating to alerts may be kept only for as long as is strictly necessary and proportionate to process the alert and for the protection of the authors, concerned persons and any third parties mentioned in the alerts, taking into account the time required for any further investigations. 

Employers should also be careful regarding any action directed toward the whistleblower, as some behaviour could be considered a form of retaliation (disciplinary sanctions, intimidation and harassment, damage to reputation, financial loss, etc).

Last updated on 29/07/2022

18. Is there a hierarchy between the different reporting channels?

18. Is there a hierarchy between the different reporting channels?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The whistleblower can choose one of the following reporting channels:

  • internal via its hierarchy in the company or the referent designated by the employer according to the applicable whistleblowing procedure; or
  • external, either after having made an internal report, or directly to:
    • the competent authority among those designated by a future decree;
    • the Defender of Rights, who will direct them to the authority or authorities best able to handle it;
    • the judicial or administrative authority; or
    • an institution, body or agency of the European Union competent to collect information on violations falling within the scope of the 2019 Directive. 

A decree to be published will establish the list of authorities competent to collect and process external alerts.

Eventually, public disclosure of the alert is possible in the following situations:

  • no appropriate action has been taken in response to an alert made by an external channel at the end of a certain time set by decree;
  • imminent or obvious danger to the public; or
  • when an external notification would run the risk of retaliation or would not allow an effective remedy for the subject of the disclosure (for example, suspicion of conflict of interest, risk of concealment or destruction of evidence and collusion).
Last updated on 29/07/2022

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

French law does not require an employer to inform external authorities about the reports.

However, this obligation does exist in certain situations. For example:

  • in the public sector, a constituted authority, public official or civil servant who, in the performance of his or her duties, becomes aware of a crime or misdemeanour must report it without delay to the General Prosecutor and must provide all relevant information, minutes and documents relating to the offence (article 40, paragraph 2 of the Criminal Procedure Code); and
  • regarding money laundering, insurers, mutual health insurance companies or credit institutions are required under certain conditions to report to the Tracfin Agency the amounts entered in their books or transactions involving money that they know, suspect or have good reason to suspect come from an offence or are linked with terrorist financing (article L. 561-15 of the Monetary and Financial Code).

In any case, it is highly recommended for the employer, when appropriate, to inform competent authorities if they about punishable facts through the whistleblowing channel. Indeed, silence from the employer would increase the risk of collusion or damages to the image and reputation of the Company.

Last updated on 29/07/2022

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The whistleblower must report the facts in good faith. Thus, reports of unproven facts in good faith are not condemnable.

However, a whistleblower guilty of false accusation is liable for criminal penalties of up to five years’ imprisonment and a fine of 45,000 EUR.

If the whistleblower does not respect the whistleblowing procedure, he or she will not benefit from the regime provided by the law.

Last updated on 29/07/2022

21. What are the sanctions if there is obstruction of the whistleblower?

21. What are the sanctions if there is obstruction of the whistleblower?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

Interfering with the communication of a report is a criminal offence punishable by up to one year of imprisonment and a fine of 15,000 EUR.

According to French law, the maximum civil fine for any retaliatory or abusive procedures against a whistleblower due to information they have reported or disclosed is 60,000 EUR. 

In addition to these fines, the obstructor may be ordered to pay damages to the whistleblower.

Last updated on 29/07/2022

22. What procedure must the whistleblower follow to receive protection?

22. What procedure must the whistleblower follow to receive protection?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The whistleblower has the choice between the following reporting procedures:

  • Internal reporting procedure: the employee notifies his or her hierarchy or goes through the applicable internal procedure.
  • External reporting procedure: the employee reports to:
    • the competent authority among those designated by a future decree;
    • the Defender of Rights, who will direct them to the authority or authorities best able to handle it;
    • the judicial or administrative authority; or
    • an institution, body or agency of the European Union competent to collect information on violations falling within the scope of the 2019 Directive. 

A decree will establish the list of authorities competent to collect and process external alerts.

Public disclosure of information may also take place in the following situations :

  • no appropriate action has been taken in response to an alert made by an external channel at the end of a certain time set by decree;
  • imminent or obvious danger to the public; or
  • when an external notification would run the risk of retaliation or would not allow an effective remedy for the subject of the disclosure (for example, suspicion of conflict of interest, risk of concealment or destruction of evidence and collusion).
Last updated on 29/07/2022

23. What is the scope of the protection? 

23. What is the scope of the protection? 

Flag / Icon

France

  • at Proskauer
  • at Proskauer

Whistleblowers benefit from protection in several areas:

  • The whistleblower benefits from a criminal immunity for breaching a secret protected by law if the disclosure is necessary, proportionate to safeguard interests at stake and done in compliance with the applicable process.
  • Retaliation against whistleblowers is prohibited. This includes: discrimination at work, disciplinary sanctions, intimidation and harassment, damage to reputation, financial loss, inclusion on a blacklist at the business or industry sector that would prevent the whistleblower finding a job, early termination of business relations, cancellation of licence, and improper referral to psychiatric or medical treatment.

The author of a detrimental measure against a whistleblower must prove that their action was not related to the whistleblower’s reporting or public disclosure, and would have been taken anyway.

The Law also provides for a specific legal action for whistleblowers who can bring a claim in summary proceedings in the event of dismissal that occurs after the whistleblower raised a concern or an alert.

Last updated on 29/07/2022

24. What are the support measures attached to the status of whistleblower?

24. What are the support measures attached to the status of whistleblower?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

Many support measures are set up by the law:

  • Courts can allocate provisions for legal expenses to whistleblowers.
  • Moreover, courts can grant temporary financial assistance, at the expense of the opposing party, if the whistleblower's financial situation has seriously deteriorated as a result of the report.
  • French law can attempt to ensure psychological support for whistleblowers.
  • Finally, a labour court could order the company to contribute to the whistleblower’s personal training account (up to 8,000 EUR for low-skilled employees and 5,000 EUR for other employees).
Last updated on 29/07/2022

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

Flag / Icon

France

  • at Proskauer
  • at Proskauer

A whistleblower who is guilty of false accusation is liable to criminal penalties of up to five years’ imprisonment and a fine of 45,000 EUR.

If the whistleblower does not respect the whistleblowing procedure, he or she will not benefit from the regime provided by the law.

Last updated on 29/07/2022