2024 WLG Whistleblower Guide: France
Is there a law to protect whistleblowers? If so, which law?
Yes, whistleblowers in France are protected under:
-Law No. 2016-1691 of December 9, 2016, on transparency, the fight against corruption, and the modernization of economic life, known as the Sapin II Law, and
-Law No. 2022-401 of March 21, 2022 (which transposed the EU Whistleblowing Directive) was designed to improve the protection of whistleblowers, and it is known as the Waserman Law.
Are companies legally obliged to introduce a whistleblowing system?
Yes, some companies are legally required to implement a whistleblowing system under these Laws.
If so, which companies must introduce a whistleblowing system (number of employees, turnover, sector)?
The obligation to set up a whistleblowing system applies to companies with at least 50 employees, regardless of the business sector.
What forms can a whistleblowing system take (written, verbal, email, electronic tool)?
The internal whistleblowing system can allow for confidential reporting through multiple channels, including:
-Written communication (e.g., letters),
-Verbal communication (e.g., hotlines),
-Secure digital platforms or email systems,
-If requested by the whistleblower, a face-to-face meeting within a reasonable timeframe.
Whistleblowers can elect to use an external reporting channel and submit their report directly to external authorities (e.g., designated French administrative authorities, French judicial authorities, competent EU institutions, bodies, or organizations, etc.) or, in certain specific cases, make a public disclosure.
Which reports must be permitted?
Reports must cover a crime, an offense, a threat or actual harm to the public interest (e.g., actions that may endanger or harm public safety with respect to the health or the environment), a breach, or an attempt to cover up a breach, of French laws and regulations, EU law, international commitments that have been duly ratified or approved by France (e.g., the European Convention for the Protection of Human Rights and Fundamental Freedoms, the International Convention on the Rights of the Child), unilateral acts by an international organization undertaken on the basis of such commitments.
In companies subject to the obligation to set up a comprehensive anti-corruption program that includes eight mandatory devices, including an internal whistleblowing system, under the Sapin 2 Law (i.e., companies with at least 500 employees – or companies belonging to a corporate group, the parent company of which is based in France, that employs at least 500 employees – and that generates a turnover or a consolidated turnover in excess of 100 million euros, the "Sapin II companies"), reports can also cover conducts or situations that violate the company's code of conduct.
Facts, information, or documents whose disclosure is prohibited by provisions relating to national defense secrets, medical confidentiality, confidential judicial deliberations, inquiries or investigations, or lawyer-client privilege are excluded from the scope of the whistleblowing regime.
Must anonymous reporting be guaranteed?
Under French law, anonymous reporting is not explicitly required but is permitted. However, companies must ensure confidentiality and protection of the whistleblower's identity throughout the process.
Failure to comply with this obligation is punishable by two years imprisonment and a fine of 30,000 euros.
Who must be able to provide information (only employees or also external third parties)?
The whistleblowing system must be accessible to:
-Employees, occasional workers, trainees, former employees (if the relevant information was obtained during the course of employment), job applicants (if the relevant information was obtained during the course of application), shareholders, members of the Board of Directors, Executive Committee or supervisory Board of the relevant entity, and
-External third parties, such as suppliers, contractors, and other stakeholders.
Can companies rely on one centralized hotline or is it necessary to have one hotline for each subsidiary?
Collecting and processing reports through a centralized whistleblowing system is generally acceptable, provided it is accessible to all subsidiaries. It ensures compliance with applicable legal requirements (including, as the case may be, local legal requirements in each relevant jurisdiction).
Can a whistleblowing system also be operated by an external body (e.g. consultant)?
Yes, companies can delegate the operation of their whistleblowing systems to an external body, such as a consultant or specialized provider, as long as confidentiality and legal requirements, in particular with respect to data protection, are met.
Are sanctions imposed for failure to introduce a whistleblowing system?
There is no specific legal sanction for failure to establish a whistleblowing system.
Yet, Sapin II companies could theoretically face fines of up to 200,000 euros for individuals (directors, officers, etc.) and 1,000,000 euros for the legal entity itself for broader non-compliance with their obligation to establish a comprehensive anti-corruption program.
In addition, any person who obstructs the transmission of a report may face up to one year's imprisonment and a fine of 15,000 EUR.
Breach of the obligation to maintain the confidentiality of a whistleblower's identity is also punishable (see Section 6 above).