France - Whistleblowing Laws in Europe: An international guide

1) Local Laws

a) Has the country implemented any laws / regulations on whistleblowing (Local Law)?  

Law no. 2016-1691 of 9 December 2016 on transparency, fighting corruption and modernizing economic life, known as the Sapin II Law, which followed specific laws focused on the disclosure of wrongdoings in a limited number of sectors, created a new legal framework and added legal protections to the reporting of any crime or misdemeanour, serious and clear violation of an international commitment which has been ratified or approved by France or of a unilateral act of an international organisation adopted on the basis of such commitment, a serious breach of a law or regulation, or a serious threat or serious harm to the public interest, excluding national defence secrets, medical secrets and attorney-client privilege.

In this regard, the answers provided in this questionnaire will focus on describing the general legal framework introduced by the Sapin II law. Please note, however, that other legal frameworks also grant protection to whistleblowers in specific areas, for example:

• Article L. 4122-4 of the Defence Code (members of the military)
• Articles L. 1152-2 and L. 1152-3 of the French Labour Code (mental harassment)
• Articles L. 1153-2 and L. 1153-3 of the French Labour Code (sexual harassment)
• Articles L. 1132-3-3 and L. 1132-4 of the French Labour Code (discrimination)
• Law No. 2013-316 of 16 April 2013 on the independence of expertise in health and environmental matters and the protection of whistleblowers (health and environment)

2) Scope of application

a) What types of wrongdoings are covered by the Local Law? Does it cover breaches of EU law?  

Article 6 of the Sapin II Law defines the whistleblower as “a natural person who discloses or reports, in a disinterested manner and in good faith, a crime or an offence, a serious and manifest violation of an international commitment duly ratified or approved by France, of a unilateral act of an international organisation taken on the basis of such a commitment, of the law or of regulations, or a serious threat or prejudice to the general interest, of which he or she has personal knowledge.”

Thereby, the material scope of application of whistleblowers’ protection is not limited to certain areas of activity, areas of law or sectors. Any type of wrongdoing is covered by the Sapin II Law, as long as it falls within the following categories:

• a crime or an offence;
• a serious and manifest violation of an international commitment duly ratified or approved by France or of a unilateral act of an international organisation taken on the basis of such a commitment;
• a serious and manifest violation of the law or of regulations; or
• a serious threat or prejudice to the general interest.

The only exception is that facts, information or documents, whatever their form or medium, covered by national defence secrets, medical secrets and attorney-client privilege are excluded from the whistleblowing regime set out by the Sapin II Law.

Therefore, breaches of EU law fall within the material scope of application of the Sapin II Law.

b) Personal scope

1. Does the Local Law apply to reporting persons working in both the private and public sectors?



The Sapin II Law grants protection to all whistleblowers, regardless of the existence of a work-related relationship or context, as long as they meet the conditions set out in its Article 6.

Regarding disclosures made in a work-related context, the Sapin II Law protects both private and public sector employees without distinction. The scope of protection is broad and includes every employee regardless of the type of employment contract (internship, fixed or indefinite term contract, temporary work), their position or their status. It also protects job applicants.

It should be noted that legal entities required to implement internal reporting procedures pursuant to Article 8 of the Sapin II Law are required to open their whistleblowing system to staff members as well as occasional and external collaborators (collaborateurs). On the contrary, internal reporting procedures mentioned in Article 17 of the Sapin II only concern “employees.” Please refer to question 4.a for details on these procedures.

2. Does the Local Law apply only to breaches that the reporting person became aware of in a work-related context?



The whistleblower status and resulting protection in the general definition of the whistleblower provided for in Article 6 of the Sapin II Law is not conditional on an existing work-related context or relationship between the reporting person and the entity concerned by the report.

However, the graduated reporting procedure governing when and to whom a disclosure can be made, set out in Article 8 of the Sapin II Law, only applies in a work-related context.

3. Does the Local Law also protect: facilitators; people connected to the whistleblower and who could suffer retaliation in a work-related context; and legal entities the whistleblower owns, works for, or is otherwise connected with?



The concept of facilitator is not defined nor mentioned by Article 6 of the Sapin II Law which sets out the definition of the whistleblower under French law. According to this definition, the whistleblower must have had personal knowledge of the information reported.

c) Does the Local Law require specific conditions to protect reporting persons? 

To benefit from the protection granted by the Sapin II Law, several conditions must be met.

Firstly, according to the definition of whistleblower stated in Article 6 of the Sapin II Law, the reporting person must be:

• a natural person;
• who discloses or reports;
• in a disinterested manner: the report must be raised in the general interest and not for personal gain, especially financial interest;
• and in good faith: an employee will be considered to have acted in bad faith when it is established that they knew that their allegations were false;
• a crime or an offence, a serious and manifest violation of an international commitment duly ratified or approved by France, of a unilateral act of an international organisation taken on the basis of such a commitment, of the law or of regulations, or a serious threat or prejudice to the general interest;
• of which they have personal knowledge.

Secondly, in a work-related context, the reporting person must have complied with the graduated reporting procedure governing when and to whom a disclosure can be made. In this regard, Article 8 of the Sapin II Law requires that the alert first be made internally to the employee’s direct or indirect superior, employer or to a named point of contact (referent). It is only in the absence of action by the person to whom the alert is addressed internally within a reasonable timeframe that the alert can be brought to the judicial authority, the administrative authority or a professional body. Finally, in the absence of action from the aforementioned authorities within a period of three months, the whistleblower can reveal information publicly. However, in the event of serious and imminent danger or in the presence of a risk of irreversible damage, the reporting person can omit internal reporting and directly address their report to authorities or reveal information publicly.

3) Reporting channels

a) Does the Local Law allow anonymous reports? How are companies/agencies meant to handle them? 

The Sapin II Law does not expressly address the issue of anonymous alerts and thus does not authorise nor forbid them. It should be noted that the French Anticorruption Agency’s Guidelines to help public and private sector entities to prevent and detect bribery, influence peddling, extorsion by public officials, illegal taking of interest, misappropriation of public funds and favouritism (updated January 2021) recommend opening internal reporting procedures implemented pursuant to Article 17 of the Sapin II law to anonymous whistleblowers.

Articles L. 634-1 and L. 634-2 of the Monetary and Financial Code specifically require that reporting procedures implemented by bound organisations and authorities guarantee the anonymity of people reporting information.

As for the French Data Protection Authority (the CNIL), it considers that anonymous reports shall be exceptional and shall be handled with specific guarantees (establishment of the seriousness of the reported violation, existence of detailed factual elements and prior exam by the first recipient of the report before the initiation of further investigations).

b) Is there a duty of confidentiality and any derogation from this duty? 

According to Article 9 of the Sapin II Law, internal reporting procedures implemented by organisations must guarantee the strict confidentiality of the identity of the authors of the alert, of the people named in the alert and of the information collected by all the recipients of the alert.

Disclosing the confidential information mentioned above is punishable by two years’ imprisonment and a fine of EUR30,000.

Information identifying the reporting person can only be disclosed with their consent. Information identifying the people named in an alert can only be disclosed once the validity of the alert has been established.

In any case, elements covered by confidentiality can be disclosed to the judicial authority regardless of the whistleblower’s consent.

c) Public disclosures: does the Local Law provide for this possibility?

According to the graduated reporting procedure of Article 8 of the Sapin II Law, public disclosure is possible in two sets of circumstances.

Firstly, the reporting person can make information public in the absence of action within three months by the judicial authority, the administrative authority of the professional body to whom the alert is addressed.

Moreover, in the event of serious and imminent danger or in the presence of a risk of irreversible damage, the reporting person can directly reveal the information publicly; for example, via social networks or to the press.

4) Reporting channels: internal

a) Is there an obligation for private and/or public legal entities to establish channels and procedures for internal reporting and follow-ups? 

The Sapin II Law requires two different categories of organisations to implement internal reporting channels.

Firstly, pursuant to Article 8, legal persons governed by public or private law with at least 50 employees, state administrations, municipalities with more than 10,000 inhabitants as well as public establishments for inter-municipal cooperation with their own tax status of which they are members, departments and regions, must implement appropriate procedures for the collection of alerts issued by members of their staff or by external and occasional collaborators (collaborateurs). These internal reporting procedures cover all breaches that fall within the scope of application of the Sapin II Law (Article 6).

Moreover, pursuant to Article 17, companies employing at least 500 employees, or belonging to a group of companies whose parent company has its registered office in France and whose workforce comprises at least 500 employees, and whose turnover or consolidated turnover exceeds EUR100 million, are required, as part of their mandatory anticorruption compliance program whose content is set out by Article 17, to implement an internal alert system designed to enable the collection of reports from employees concerning the existence of conduct or situations contrary to the company’s code of conduct. The same obligation is required from public industrial and commercial establishments employing at least 500 employees, or belonging to a public group with a workforce of at least 500 employees, and whose turnover or consolidated turnover exceeds EUR100 million. These internal reporting procedures cover corruption and influence peddling disclosures.

It should also be mentioned that Article L. 225-102-4 of the Commercial Code requires French companies of a certain size, as part of their duty of vigilance, to implement an alert mechanism for the existence or materialisation of risks related to human rights and fundamental freedoms, health and safety of individuals and the environment.

 

In the same vein, pursuant to Article L. 634-2 of the Monetary and Financial Code, organisations under the supervision of the French Financial Markets Authority (Autorité des Marchés Financiers) and the French Prudential Supervision and Resolution Authority (Autorité de Controle Prudentiel et de Résolution) are required to set up appropriate internal reporting procedures enabling their staff to report failures to comply with a certain number of regulations.

 

b) Do internal reporting channels need to allow reporting in writing, orally or both? 

The Sapin II Law does not specifically address this issue.

c) Procedures for internal reporting and follow-up: does the Local Law require legal entities to adopt internal reporting systems with the following elements?

1. Channels able to ensure the confidentiality of the identity of the reporting person and the protection of third parties mentioned in the report:



According to Article 9 of the Sapin II Law, internal reporting procedures implemented by organisations must guarantee the strict confidentiality of the identity of the authors of the alert, of the persons named in the alert and of the information collected by all the recipients of the alert.

The fact of disclosing the confidential abovementioned elements is punishable by two years’ imprisonment and a fine of EUR30,000.

Information identifying the reporting person can only be disclosed with their consent. Information identifying the person named in an alert can only be disclosed once the validity of the alert has been established.

In any case, elements covered by confidentiality can be disclosed to the judicial authority regardless of the whistleblower’s consent.

2. Acknowledgement of receipt of the report to the whistleblower within seven days of receipt:



No specific timeframe for acknowledgement of receipt of alerts is provided for by the Sapin II Law. Article 5, II, 1 of Decree No. 2017-564 of 19 April 2017 on the procedures for collecting reports issued by whistleblowers within private or public legal persons or state administrations states that "The procedure shall specify the measures taken by the organisation (…) To inform the author of the alert without delay of the receipt of the alert, as well as of the reasonable and foreseeable period of time required to examine its admissibility and of the methods used to inform the author of the action taken on the alert."

3. The designation of an impartial function/team to manage follow-ups on reports and maintain communication with the whistleblower:



As for the procedures of Article 8 of the Sapin II Law, Article 4, I of Decree No. 2017-564 of 19 April 2017 provides for specific requirements regarding the persons in charge of investigating alerts.

Firstly, the point of contact designated must have, by virtue of their position, the competence, authority and resources to carry out their duties. They may be a natural person or any entity governed by public or private law, with or without legal personality. The point of contact (referent) as well as all the people called upon to handle alerts are subject to the confidentiality duty provided for in Article 9 of the Sapin II Law.

As regards the procedures of Article 17 of the Sapin II Law, the French Anticorruption Agency’s Guidelines recommend that the people responsible for conducting the investigation be bound by very strict confidentiality obligations, which need to be formalized. They also indicate that the people responsible for processing whistleblower reports must be trained to respect the confidentiality of the reports they process and to manage any conflicts of interest. The management of the whistleblowing system can be contracted out to a third party provided the latter has the necessary competence for proper processing of whistleblower reports and the means to ensure confidentiality.

4. Any other follow-up requirements including those for anonymous complaints:



As previously mentioned, the Sapin II Law does not expressly address the issue of anonymous alerts and thus does not authorise nor forbid them. However, the French Anticorruption Agency’s Guidelines, which concern reporting channels implemented pursuant to Article 17, recommend that reports may be submitted anonymously and that the system in place makes it possible to continue communication with the whistleblower while maintaining anonymity.

5. A reasonable timeframe to provide feedback, not exceeding three months from acknowledgment of receipt or if no acknowledgement was sent, three months from the expiry of the seven-day period after a report is made:



As previously explained, Article 8 of the Sapin II Law provides for a graduated reporting procedure governing when and to whom a disclosure can be made. Reports must be first made internally. It is only in the absence of action within a reasonable period of time that the whistleblower can report information to the judicial authority, the administrative authority or a professional body. If the authority or body to whom the report is addressed fails to reply within three months, the whistleblower can make the information public.

6. Providing clear and easily accessible information on internal reporting procedures and external reporting procedures to competent authorities and/or EU institutions/bodies:



With regard to the reporting procedures of Article 8, Article 6 of Decree No. 2017-564 of 19 April 2017 requires that the procedure for collecting alerts be distributed by any means, in particular by notification, posting or publication, if necessary on the organisation’s website, in such a way as to make it accessible to members to its staff or agents, as well as to its external or occasional collaborators.

Concerning the reporting procedures of Article 17, the French Anticorruption Agency’s Guidelines recommend that the whistleblowing procedure be disseminated to all staff by all means (letter from senior management, posters, intranet site, handouts, etc) to ensure that everyone concerned knows about the system and has access to it.

7. Should legal entities take any additional measures in order to comply with the above requirements?



Not applicable.

5) Reporting channels: external

a) Has the country designated a competent authority to receive and investigate whistleblower disclosure and retaliation complaints? 

The Sapin II Law allows external reporting to judicial authorities, administrative authorities or professional bodies (Article 8, I).

It should be noted that any person may address their alert to the French Defender of Rights (Défenseur des Droits) to be directed to the appropriate body competent for receiving the alert (Article 8, IV). However, the Defender or Right is not competent to treat and investigate alerts.

b) Is an independent and autonomous external reporting channel already established in the country? 

Not to our knowledge.

6) Processing of personal data

a) Is personal data concerning the reports processed in compliance with local and EU legislation such as EU Regulation 2018/1725 and local privacy laws? 

Any whistleblowing system must comply with the Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act No. 17-78 of 6 January 1978 (as last revised), the recommendations made by the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés (CNIL)), notably its Deliberation No. 2019-139 dated 18 July 2019 setting standards for processing personal data in the context of whistleblowing systems.

7) Record keeping of reports

a) Is there any obligation regarding record keeping of reports as provided for by the EU Directive? 

The Sapin II does not expressly set out a record-keeping obligation of whistleblowing reports. However, it is in practice highly recommended to document and keep all alerts received, including the steps and results of the resulting internal investigation in order to keep evidence in the event of any future administrative or criminal investigation or proceedings.

From a data protection standpoint, however, the French Data Protection Authority’s Deliberation No. 2019-139 provides for certain retention terms regarding reports depending on (i) the fact that the report falls or not within the scope of the whistleblowing system; and (ii) the existence or absence of actions taken by the organisation following the report.

8) Protection

a) Is there any difference between whistleblower protections in the private and public sectors?  

Article 6 of the Sapin II Law does not differentiate between whistleblowers in the private and the public sectors.

b) Are whistleblowers protected against all forms of retaliation including threats and attempts of retaliation? Which forms of retaliation are expressly indicated? 

The Sapin II Law amended French labour law to offer protection to whistleblowers against retaliation.

Pursuant to Article L. 1132-3-3 of the Labour Code “No person may be excluded from a recruitment procedure or from access to an internship or a period of vocational training, no employee may be sanctioned, dismissed or be the subject of a direct or indirect discriminatory measure, particularly with regard to remuneration, within the meaning of Article L. 3221-3, profit-sharing measures or the distribution of shares, training, redeployment, assignment, qualification, classification, professional promotion, transfer or renewal of contract, for having reported information in compliance with Articles 6 to 8 of the Law N.o 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life.”

Any measure or action taken with regard to an employee in disregard of these provisions is null and void (Article L. 1132-4 of the Labour Code). In case of wrongful dismissal, the whistleblower can seek reinstatement or compensation under French labour law.

Article L. 1132-3-3 of the Labour Code provides for a specific regime of reversal of the burden of proof: "In the event of a dispute relating to the application of the first and second paragraphs, where the person presents factual elements that allow the presumption that he or she has related or testified in good faith to facts constituting an offense or crime, or that he or she has reported an alert in compliance with Articles 6 to 8 of the aforementioned Law No. 2016-1691 of 9 December 2016, it is incumbent upon the defendant, in view of the elements, to prove that his or her decision is justified by objective elements extraneous to the statement or testimony of the person concerned. The judge shall form his or her conviction after ordering, if necessary, any investigative measures he or she deems useful."

Equivalent protection is granted to public servants in Article 6 ter A of Law No. 83-634 of 13 July 1983 on the rights and obligations of civil servants known as the "Le Pors law" and Article L. 911-1-1 of the Administrative Justice Code.

In addition, a specific legal action is granted to whistleblowers who have the possibility to bring a claim in summary proceedings in the event of dismissal notified after the whistleblower raised a concern or an alert (Article 12 of the Sapin II Law).

c) Does the Local Law provide for any other measures of support such as those indicated in the EU Directive?  

Such protection exists to some extent under French law but is not specifically granted to whistleblowers by the Sapin II Law.

d) Does the Local Law provide for the necessary measures to prohibit any form of retaliation against whistleblowers?

Yes, please refer to question 8.b.

e) Does the Local Law provide for any remedial measures, including interim relief measures? 

Pursuant to Article 12 of the Sapin II Law, a specific legal action is granted to whistleblowers who have the possibility to bring a claim in summary proceedings in the event of dismissal notified after the whistleblower raised a concern or an alert.

f) Does the Local Law provide for exemptions from liability for whistleblowers?  

Pursuant to Article 122-9 of the Criminal Code, the whistleblower benefits from a criminal immunity for breaching a secret protected by the law if the disclosure is:

• necessary;
• proportionate to safeguard interest at stake; and
• done in compliance with applicable rules: the whistleblower must meet all the requirements set out in the definition of Article 6 of the Sapin II Law and, in a work-related context, have complied with the graduated reporting procedure of Article 8.

Information protected by national defence secrets, medical secrets and attorney-client privilege are out of the scope defined by the Sapin II Law whistleblowing regime (Article 6 of the Sapin II Law).

g) Does the Local Law provide for sanctions against natural and legal persons that violate whistleblowers’ protection or the duty of maintaining the confidentiality of their identity? 

The disclosure of any confidential information, including identities of the whistleblower and the people named in the report as well as the information revealed is sanctioned by a fine of EUR30,000 and up to two years’ imprisonment (Article 9 of the Sapin II Law).

Obstruction to the whistleblower’s disclosure rights is sanctioned by a fine of EUR15,000 and up to one year’s imprisonment (Article 13, I of the Sapin II Law).

If a complaint for defamation against a whistleblower gives rise to the decision to dismiss proceedings, the judge has the possibility, provided specific conditions related to the nature of the complaint are met, to sanction the plaintiff with a civil fine of EUR30,000 (Article 13, II of the Sapin II Law).

h) Does the Local Law provide for sanctions in case of false reports?  

The Sapin II Law does not provide for any specific sanction in case of false reports. However, a whistleblower who reports false information knowingly and wilfully would not be considered as acting in good faith as required by Article 6 of the Sapin II Law and thus would not be granted the protection provided by the law for whistleblowers.

It should be noted that disclosing a professional secret is sanctioned by a prison sentence up to a year and a fine of up to EUR15,000 (Article 226-13 of the Criminal Code). Furthermore, reporting someone to the judicial authority, the administrative authority or a professional body on the basis of information that one knows to be false even partially is subject to a maximum of five years’ imprisonment and a fine up to EUR45,000 (Article 226-10 of the Criminal Code).

9) Other issues

a) Under the Local Law, is adopting a whistleblowing system relevant to assess the adequacy of a compliance program? Does this have any value to mitigate or eliminate criminal liability for legal entities? 

Organisations subject to Article 17 of the Sapin II Law must adopt, among other measures, a whistleblowing system as part of their anticorruption compliance program. Therefore, adopting a whistleblowing system is mandatory for these organisations and failure to implement such system may lead to administrative sanctions by the Sanctions Commission of the French Anticorruption Agency.

b) Does the Local Law or another law in your country provide for whistleblower reward programs? 

No. The definition of the whistleblower set out by Article 6 of the Sapin II Law requires that the whistleblower acted in a disinterested way.

For information purposes, a recent Decree No. 2021-61 of 25 January 2021 authorises the French tax administration, under certain conditions, to reward people who reveal information related to large-scale international tax fraud.

c) Can companies benefit from any incentives in the case of voluntary self-disclosure of violations they became aware of following an internal report?  

The joint guidelines from the French Anticorruption Agency and the Financial Prosecutor on the implementation of the Judicial Convention of Public Interest (Convention Judiciaire d’Intéret Public – CJIP) explain that self-disclosure in a reasonable timeframe is a favourable element for the conclusion of such settlement and the assessment of the amount of the fine.

It does not apply to all kinds of violations given that the CJIP is available only for enumerated offences (corruption, influence peddling, tax fraud, money-laundering of these offences and certain environmental offences).

d) Will implementing the EU Directive create any issues with obligations provided for under other laws / regulations? 

Given that the EU Directive has not been yet incorporated into French law, it is premature to anticipate possible issues that may arise from its incorporation.

---