On September 1, 2022, new protections for whistleblowers came into force in France that may affect companies operating within its borders. These new whistleblower safeguards were officially passed on March 21, 2022 as "Law 2022-401 to Improve the Protection of Whistleblowers" ("Law 2022-401").1 Law 2022-401 makes a number of modifications to the existing whistleblower protections within France's Sapin II anti-corruption regime2 (among others) to more closely mirror those found in and required by the European Union's Whistleblowing Directive of October 2019 (the "Whistleblowing Directive").3 The Whistleblower Directive set out minimum standards and requirements for the protection of persons across all EU Member States reporting breaches of EU law. Given the enactment of Law 2022-401, businesses operating in France should consider reassessing their whistleblowing policies and procedures and, where necessary, updating them to ensure compliance.4
I. Potential Chilling Effect of Original Sapin II Reporting Requirements
Since its December 2016 enactment, Sapin II has governed French whistleblowing protection for all public or private entities with over 50 employees.5 Under the regime, a whistleblower is defined as "a natural person who discloses or reports, in a disinterested manner and in good faith, a crime or misdemeanor, a serious and manifest breach of an international commitment duly ratified or approved by France, a unilateral act of an international organization taken on the basis of such a commitment, law or regulation, or a serious threat or prejudice to the public interest, of which it has personal knowledge."
As originally drafted, Sapin II set out a three-step protocol for reporting a complaint. Whistleblowers were required to first report any allegations internally within their organization. Only where their organization failed to respond within a "reasonable period of time" could whistleblowers then report any allegations to French authorities, and only where French authorities did not respond to a whistleblower report within three months could whistleblowers then proceed with a public disclosure.
By requiring whistleblowers to first report wrongdoing within their organizations, the original protocol arguably disincentivized reporting, as whistleblowers did not have an option to report directly to the French authorities and were required to first raise concerns internally.
II. Revised French Whistleblower Protections
Law 2022-401 amends Sapin II's definition of a whistleblower, widens the range of concerns for which reporting is protected, liberalizes the reporting process, and increases the financial protections afforded to whistleblowers. As a net result, France's whistleblowing regime now provides broader options and protection to a wider population of potential whistleblowers. Public disclosure remains subject to certain conditions.
Companies operating in France may therefore see an uptick in whistleblower reports generally, including in reports submitted directly to the authorities. The threat of such external reporting should incentivize companies to reassess their internal whistleblowing mechanisms—strengthening protections where necessary—and to educate employees about the controls and protections provided by the company's controls.
A. Amended Definition of "Whistleblower"
In line with the EU's 2019 Whistleblowing Directive, a whistleblower is still defined in France as a "natural person." However, Law 2022-401 narrows the phrase "in a disinterested manner" to specify that a complaint must arise "without any direct financial compensation."6 In line with the Whistleblowing Directive, Law 2022-401 also expands the population of natural persons who can blow the whistle, which now includes former employees, job applicants, shareholders and officers of the company, business partners, subcontractors, and suppliers (including their staff, shareholders, and officers, as appropriate).
In addition, Law 2022-401 protects facilitators and third parties who assist a whistleblower in reporting, including natural persons (e.g., colleagues or family members) and non-profit entities (e.g., unions or associations) related to the whistleblower, as well as legal entities owned or controlled by a whistleblower. These protections will allow non-profits and other good governance groups familiar with French law and best practices to assist and advise whistleblowers without fear of liability
As a consequence of Law 2022-401's broad expansion of its "whistleblower" definition, companies should prepare for a possible increase in whistleblower reports from new and previously unseen parties
B. Expanded Universe of Reportable Concerns and Circumstances
Law 2022-401 expands the universe of concerns and circumstances that may give rise to a report or disclosure.7 Whistleblowers will be now be protected when reporting or disclosing in good faith and without direct financial compensation facts or information about:
- A crime or offence;
- A threat or prejudice/harm to the general interest; or
- A violation, or an attempt to conceal a violation, of:
- An international commitment duly ratified or approved by France,
- A unilateral act of an international organization adopted on the basis of such commitment, or
- EU or French legislation and regulation.
To effect this broadening in scope of whistleblower protections, Law 2022-401 removed requirements that may have cabined prior reporting. Protections are no longer limited to reports of breaches that are "serious and manifest" or for which the threat or harm to the general interest is "serious." In addition, whistleblowers are no longer required to have "personal knowledge" of the facts reported; such first-hand or personal knowledge is now only required for matters that occur outside of the workplace or come to the person's knowledge other than "in the course of their professional activities."8 Law 2022-401's addition of potential breaches of EU law within the scope of whistleblower protections was also specifically required by the Whistleblowing Directive. This enlarged scope may similarly impact the number and types of reports companies face on a go-forward basis.
In line with the Whistleblowing Directive, Law 2022-401 also clarifies and expands the type of information that falls outside the scope of reportable concerns, to include information protected by the secrecy of judicial deliberations and judicial investigations, information protected by national defense secrecy, medical secrecy, and lawyers' professional secrecy.
C. Increased Flexibility in Reporting Process
In line with the Whistleblowing Directive,9 Law 2022-401 also eliminates the hierarchical reporting process previously required under Sapin II. Specifically, whistleblowers are no longer required to first report allegations internally within their organization, and may now elect to initiate their complaint either internally or externally—i.e., directly to the relevant French authorities.10 Law 2022-401 also permits anonymous reporting, and where a report (be it internal, external, or public) is made anonymously and the identity of the whistleblower is subsequently revealed, the whistleblower is entitled to the same legal and statutory protections as all other whistleblowers in France.
This new reporting process places the onus on companies to ensure that employees are aware of and have confidence in internal reporting processes. Absent such knowledge, whistleblowers may elect to bring their complaints directly to relevant French authorities, denying companies the opportunity to conduct their own internal investigations first, gather relevant facts, and address potential compliance issues internally before self-reporting or engaging with authorities, as necessary or appropriate. Accordingly, companies operating in France should consider updating and strengthening their whistleblowing policies and procedures by providing an anonymous reporting system (e.g., telephone hotline, anonymized online reporting option, or a third-party external reporting service) that is insulated from management and provides employees with assurance that they are protected against any form of retaliation.
However, because whistleblowing reports inevitably involve personal data, companies updating their whistleblowing programs should be mindful that significant alterations may require the consultation (or opinion) of the company's comité social et économique ("CSE," or works council) and give particular consideration to the requirements of the EU's General Data Protection Regulation ("GDPR") and the Commission nationale de l'informatique et des libertés ("CNIL," France's independent data privacy authority).
D. Enhanced Financial Protections
The new French law also affords whistleblowers enhanced financial protections to insulate them from possible retaliation. Specifically, Law 2022-401 permits whistleblowers to seek damages in labor courts, where it also shifts the burden to employers to prove that any potential retaliatory measure was not linked to the whistleblowing complaint.11 Moreover, if a private sector employee is found to have been wrongfully terminated in retaliation for a whistleblower complaint, Law 2022-401 also allows labor courts to compel an employer to make contributions to the whistleblower's compte personnel de formation ("personal training account," an individualized financial account for workers in France dedicated to expenses related to professional training).
III. Comparison to UK and US Law
With the enactment of Law 2022-401, France now joins the United States and the United Kingdom in establishing broad whistleblower protections. The United States has several federal laws governing whistleblowing in corporate settings, including for potential violations of the Foreign Corrupt Practices Act ("FCPA"), with two of the most prominent laws being the Sarbanes-Oxley Act ("SOX") and the Dodd-Frank Act ("Dodd-Frank"). In the United Kingdom, the Public Interest Disclosure Act ("PIDA"), as incorporated into its Employment Rights Act ("ERA"), provides substantial whistleblower protections, including for potential violations of the U.K. Bribery Act 2010. These laws, and now Law 2022-401, provide increased protections and incentives for individuals to blow the whistle on corruption and related misconduct, which, in turn, provide companies doing business in these jurisdictions greater incentive to understand their import and maintain active compliance. A high-level comparison of these three regimes is below:12
FRENCH REGIME |
UK REGIME |
US REGIME |
|
Who is protected as a whistleblower? |
Law 2022-401 protects a broad population of "natural persons" (i.e., beyond employees, including former and prospective employees, shareholders, business partners, subcontractors, and suppliers), as well as facilitators (including entities, natural persons, and non-profits) who help whistleblowers. See Loi 2022-401, Title I, Art. 1. |
PIDA protects not only employees, but also other workers, including employee shareholders, homeworkers, trainees, police officers, and agency workers, among others. See ERA, § 43K. |
SOX protects present workers, former workers (if the protected activity occurred during the course of their employment), applicants for employment, individuals whose employment may be affected by a covered person (such as supervisors, managers, and officers), and, under some circumstances, independent contractors. See 29 C.F.R. § 1980.101(g). Dodd-Frank protects "any individual" who provides information relating to a violation of the securities laws to the SEC or CFTC. See 15 U.S.C. § 78u-6(a)(6); 7 U.S.C. § 26(a)(7). |
Must the whistleblower have personal knowledge of the reported misconduct? |
Under Law 2022-401, the whistleblower must have first-hand or personal knowledge of the reported conduct only where the information has not been obtained in the course of professional activities. See Loi 2022-401, Title I, Art. 1 |
Under PIDA, the whistleblower need only have a "reasonable belief" that serious misconduct occurred. See ERA, § 43B. |
Under SOX, the whistleblower need only "reasonably believe" that corporate wrongdoing has occurred. See 18 U.S.C. § 1514A(a)(1). Under Dodd-Frank, the whistleblower need only "reasonably believe" that the information reported relates to a possible violation of the federal securities laws. 17 C.F.R. § 240.21F-2. |
Must the whistleblower report internally before reporting to government authorities? |
No. Under Law 2022-401, whistleblowers may choose to report a complaint either internally through a reporting mechanism or externally, directly to the French authorities. See Loi 2022- 401, Title II, Art. 3. |
No. Under PIDA, the whistleblower need only report to one of the following: (i) their employer; (ii) another person whom they reasonably believe to be solely or mainly responsible for the relevant misconduct; or (iii) a "prescribed person" identified by the Secretary of State (such as a regulatory body), among others. ERA, §§ 43C-43H. |
No. Under SOX, the whistleblower need only report to one of the following: (i) a federal regulatory or law enforcement agency; (ii) any member of Congress or any committee of Congress; or (iii) a person with supervisory authority over the employee. See 18 U.S.C. § 1514A(a)(1). Under Dodd-Frank, whistleblowers need only report violations of the securities laws to the SEC or the CFTC. See 15 U.S.C. § 78u-6(a)(6); 7 U.S.C. § 26(a)(7). |
Is the whistleblower protected against retaliation? |
Yes. Under Law 2022- 401, persons who have reported or publicly disclosed information may not be subject to a list of prohibited retaliation or reprisals, regardless of their status, including threats or attempts to resort to such reprisals (e.g., disciplinary measures, intimidation). See Loi 2022-401, Title III, Art. 6 . |
Yes. See ERA, § 47B ("A [whistleblower] has the right not to be subjected to any detriment by any act, or any deliberate failure to act, by his employer done on the ground that the worker has made a protected disclosure."). |
Yes. See 18 U.S.C. § 1514A (providing that, under SOX, no covered employer may "discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee in the terms and conditions of employment"); 15 U.S.C. § 78u-6(h)(1)(A) (providing that, under Dodd-Frank, no covered employer may discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against, a whistleblower in the terms and conditions of employment"). |
May whistleblowers seek damages? |
Yes. See Law 2022-401, Title III, Art. 9 (providing that "...the amount of the civil fine that may be pronounced under the conditions provided for...by the civil courts in the event of abusive or dilatory action [against a whistleblower] is increased to 60,000 euros"). |
Yes. See ERA, § 49 (providing that whistleblowers may be awarded "compensation to be paid by the employer to the complainant in respect of the act or failure to act to which the complaint relates"). |
Yes. See 18 U.S.C. § 1514A(c)(2) (providing that, under SOX, whistleblowers are "entitled to all relief necessary to make [them] whole," including "compensatory damages"); 15 U.S.C. § 78u-6(h)(1)(C) (providing that, under Dodd[1]Frank, whistleblowers are entitled to "2 times the amount of back pay otherwise owed to the individual, with interest" and "compensation for litigation costs, expert witness fees, and reasonable attorneys' fees"). |
Footnotes
1 See Loi 2022-401 du 21 mars 2022 visant à améliorer la protection des lanceurs d'alerte [Law 2022-401 of March 21, 2022, to Improve the Protection of Whistleblowers] Journal Officiel de la Republique Francaise [J.O.] [Official Gazette of France], Mar. 22, 2022, No. 0068.
2 See Loi 2016-1691 du 9 décembre 2016 relative à la transparence, à la lutte contre la corruption et à la modernisation de la vie économique [Law 2016-1691 of December 9, 2016, on Transparency, the Fight Against Corruption and the Modernization of Economic Life] Journal Officiel de la Republique Francaise [J.O.] [Official Gazette of France], Dec. 10, 2016, No. 0287.
3 See Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons who report breaches of Union law.
4 On October 4, 2022, the French government issued an implementing and enforcement decree in connection with the changes made by Law 2022-401, which sets out detailed requirements for companies' internal reporting mechanisms and identifies the external competent authorities responsible for processing external alerts. The decree came into effect on October 5, 2022, but is not the focus of this Alert.
5 Some very large companies may also be subject to the French "Corporate Duty of Vigilance Law" of March 2017, which requires the implementation of a specific whistleblowing system for the reporting of serious violations in relation to human rights and fundamental freedoms, health and safety, and the environment. Law 2022-401 does not introduce any changes to the Corporate Duty
of Vigilance Law or its requirements.
6 Loi 2022-401 du 21 mars 2022, supra note 1, at Title I, Art. 1. 7 Id.
8 Id.
9 Whistleblowing Directive, Recital 47.
10 Loi 2022-401 du 21 mars 2022, supra note 1, at Title II, Art. 3.
11 Loi 2022-401 du 21 mars 2022, supra note 1, at Title III, Art. 6.
12 The comparison chart is for illustrative purposes only and assumes a bona fide and protected allegation under each legal regime
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.