France

What stage has the legislature reached in implementing the Whistleblowing Directive? If not already implemented, when is it expected or planned that the required legislation will be passed?

The French bill (act n° 2022-401) has been passed on 21 March 2022 and has been applicable since 1st September 2022. In addition, the decree of 3 October 2022 on the procedures for collecting and processing whistleblower alerts and establishing the list of external authorities set up by the law of 21 March 2022 was promulgated.

Status

Legislation passed / Directive implemented.

Reporting topics covered (in addition to those covered by the Directive)

  • crimes or offences; 
  • violations or an attempt to conceal a violation of: 
    • an international commitment duly ratified or approved by France; 
    • a unilateral act of an international organisation taken on the basis of such a commitment; 
    • the law or regulations; 
    • a serious threat or harm to the public interest; and
    • violations of European law.

The facts reported may concern "information" on a crime, offence or violations of the law, but also "attempts to conceal" these violations. 

The violation of the rule will no longer have to be "serious and manifest"

Categories of person who may report (in addition to those specified in the Directive)

A whistleblower is now defined as follows:  

"the physical person who reports or discloses, without direct financial compensation and in good faith, information concerning a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of international or European Union law, the law or the regulations."   

Certain protections offered to whistleblowers are extended to :  

  • Former staff members (if the information in the report was obtained during the previous employment relationship) 
  • Members of staff and of the administrative management or supervisory body of contractors, subcontractors and suppliers.  
  • Facilitators (individuals and non-profit entities such as trade unions and associations who are in contact with the whistleblower) 

Are there any stipulations as to who may investigate a report?

I: Companies required to set up an internal procedure
Legal entities employing at least 50 employees, must set up an internal procedure for collecting and processing alerts. The French decree of 3 October 2022 specifies that this threshold is to be assessed:

- at the end of 2 consecutive financial years ;
- in accordance with the procedures set out in I of article L. 130-1 of the Social Security Code.

II: The whistleblowing procedure may be implemented by any means
The company must communicate its internal whistleblowing procedure to potential whistleblowers (employees, for example), by any means that ensures sufficient publicity and under conditions that make it permanently accessible.

II: The internal procedure must provide a channel for receiving whistleblowers
The internal procedure is required to set up a reception channel enabling any whistleblower to send a written or oral report, as provided for in the procedure. The reception channel may be managed externally by a third party.

III: The company ensures that the report is admissible...
Once the alert has been received, its processing begins with an analysis of its admissibility in the light of the legal conditions. To this end, the company may request any additional information from the whistleblower.
When the legal conditions are met, the company processes the alert. If the report appears to be well-founded, the entity will use the means at its disposal to remedy the matter.

IV: One or more departments/entities are responsible for the internal procedure
The internal alert procedure must indicate the person(s) or department(s) designated to receive and process alerts. By virtue of their position or status, these persons or departments must have sufficient competence, authority and resources to carry out their duties.

V: The internal procedure guarantees confidentiality and integrity
The internal procedure must guarantee the integrity and confidentiality of the information collected, in particular the identity of the author of the alert, the persons concerned by the alert and any third party mentioned in the alert. In particular, members of staff who are not authorised to know the information must be denied access to it.

VI: The external authorities responsible for issuing alerts are designated as follows

Are entities with fewer than 50 workers exempt?

Yes.

If an exempt organisation implements a whistleblowing scheme will the Directive / implementing law apply?

No.

Are there any specific timescales that apply (e.g. for acknowledgements and responses) (Yes/No)?

Yes.

Can reports be made anonymously?

The CNIL (French data protection agency) recommends that companies do not encourage anonymous reports (which are defined as a report whose author is neither identified nor identifiable) but states that if anonymous reports are allowed:

  • the seriousness of the facts mentioned should be established and the factual elements should be sufficiently detailed; and
  • the processing of this report should be carried out with special precautions, such as a prior examination by the first addressee of the appropriateness of its circulation within the whistleblowing system. 

Are private sector entities required to accept and follow up on anonymous reports?

No.

Remedies for retaliation

Many retaliatory actions (e.g. dismissal, exclusion from bonus etc.) can be annulled by labour courts. An employee may in particular seek an urgent order for reinstatement from the labour court. 

Remedial measures against retaliation extend to non workers (e.g. by prohibiting blacklisting at sector or industry level).  

Whistleblowers expressly benefit from a protection against moral and sexual harassment. 

The implementing law further provides for criminal sanctions against the perpetrator of retaliation against a whistleblower, including imprisonment of 3 years and a fine of 45 000 euros. 

Are group-wide reporting channels permitted?

The decree provides for the possibility of setting up a joint procedure between entities employing fewer than 250 employees, subject to a concordant decision by the competent bodies of each of them. On the other hand, entities with more than 250 employees in the same group seem only to be able to set up identical procedures, which is not the same thing as a single procedure, despite what was provided for in the law.