A March 2022 law, supplemented by an October 2022 decree, has reinforced the statutory protection of whistleblowers in France. By transposing the European Union whistleblowing directive, the legislator aimed to integrate whistleblowers into the social responsibility of employers.
The whistleblower is now defined as: ‘a natural person who reports or discloses, without direct financial compensation and in good faith, information relating to a crime, an offense, a threat or a prejudice to the general interest, a violation or an attempt to conceal a violation of an international commitment ratified or approved by France, a unilateral act of an international organisation taken on the basis of such a commitment, European Union law, or other law or regulation.’
This definition expands the types of facts that may give rise to a whistleblowing report; the whistleblower may report facts that he or she has not personally observed, if they have been brought to his or her attention in a professional context.
Only the following are automatically excluded from the scope of a whistleblowing report:
Moreover, the notion of good faith that should characterise the whistleblower is not easy to assess from an objective point of view.
Whistleblowers can also be former staff members, job applicants, managers, shareholders or partners of the company, or even from outside the organisation (e.g. from co-contractors and subcontractors).
The whistleblower benefits from criminal and civil immunity and a ban on retaliation, provided that the legal definition is met (the status of whistleblower and the nature of the facts reported) and that the reporting procedure provided for by law is followed.
Would-be whistleblowers can also apply to the Human Rights Defender, who can certify their status as a whistleblower by issuing an opinion (the scope of which remains to be determined) in the event of a dispute. They can also benefit from provisions for legal costs and subsidies in an appeal against a retaliatory measure or in defending themselves against legal action aimed at hindering their reporting or public disclosure.
This protection also applies to facilitators, i.e. any person who has helped the whistleblower to report the matter, and to natural persons ‘connected’ to the whistleblower (e.g. colleagues), which may result in a wide circle of persons who may seek to benefit from the whistleblower’s protection.
More generally, like all employees, whistleblowers benefit from freedom of expression except in the case of abuse (i.e. defamatory or insulting statements) and restrictions justified by the nature of the task to be performed and proportionate to the aim pursued. The Court of Cassation recently ruled that a dismissal linked to the non-abusive exercise of an employee’s freedom of expression was null and void.
Since 1 September 2022, the employer can no longer require the whistleblower to report internally before being able to report externally to one of the competent authorities listed by decree.
The law requires companies with more than 50 employees to set up an internal whistleblowing procedure to collect and process alerts. The decree does not specify the exact terms of this procedure, which remains to be defined by each organisation. On the other hand, the decree specifies that the procedure must be submitted for consultation to the social dialogue bodies, and that it must be disseminated by a method that will ensure sufficient publicity. The aim is to enable better detection of malfeasance within an organisation.
To this end, the internal rules must mention the existence of a whistleblower protection mechanism. The procedure must mention the persons in charge of collecting and processing reports (which can be an external person or company). Many platforms offer this service.
The decree specifies that the procedure may collect reports orally, so long as the information is recorded on durable media. The procedure must also provide for follow-up given to reports that do not comply with the legal conditions and to anonymous reports.
In any event, the company must ensure that the reports are processed and that a real investigation is carried out within three months of the acknowledgement of receipt of the report, in compliance with confidentiality, impartiality and the rules on the protection of personal data, in particular the GDPR retention periods proportionate to the situation.
The obligation to set up this internal procedure does not carry a penalty, but its absence could be considered as harm generating the awarding of damages in the event of a dispute led by a whistleblower.
The practical implementation of this protection raises questions, particularly when the whistleblower is threatened with disciplinary action or dismissal before making his or her report. There is a risk of misuse of whistleblower protection, especially as the Court of Cassation currently has a very strict position: only proof of bad faith can exclude an employee from the application of whistleblower protection and the risk that the disciplinary measure will be voided.
Nevertheless, the investigation could make it possible, if necessary, to demonstrate the unjustified nature of the report or even its abusive nature before any disciplinary or termination measures are taken.
For more information about investigations & performance management
