[Publication] Employment Ramifications of Whistleblowing: a French Perspective

August 2nd, 2024 – Employment Ramifications of Whistleblowing: a French Perspective

Published by Joëlle Hannelais (partner) and Marine Segura (associate)

Read the pdf version here.

This article is an extract from Lexology In-House view: Whistleblowing 2024.

Upstream of the report: The internal procedures that employers must establish to process whistleblowers’ reports

Obligation to implement a whistleblowing system under European and French law

On 23 October 2019, European Directive 2019/1937 on the protection of persons who report breaches of Union law was adopted by the European Parliament and the Council of European Union. This directive substantially strengthened the legal protection of whistleblowers at EU level, which until then had been fragmented and dependent on national law. The directive required member states to adopt an effective system of protection, preventing all forms of sanctions (direct or indirect) and prohibiting reprisals against whistleblowers.

The directive defines a whistleblower as a person who reports to an internal or external authority or publicly discloses information about breaches of European laws that have occurred in the course of their professional activities. Breaches that may be reported are those relating to acts of the Union,¹ breaches relating to the internal market and breaches affecting the financial interests of the Union.²

As these provisions relate to breaches of EU laws, they do not protect whistleblowers when reporting on human resources issues, particularly in the areas of discrimination, harassment and employee health and safety. Fortunately, member states have provided protection that goes beyond the scope of the EU directive.

The European whistleblower protection regime defines three reporting channels: internal (within the company), external (to the appropriate authorities) and public (disclosure of information in the public sphere). Member states have the responsibility to take the necessary measures to require private and public companies to set up internal reporting channels and to follow up on reports.³ The directive sets out the deadlines for acknowledging receipt of and providing feedback to the whistleblower.⁴ Member states retain the option of whether or not to accept anonymous whistleblowing, but EU Directive 2019/1937 provides for the protection of whistleblowers (employees, shareholders or third parties⁵ to the company, and facilitators⁶), including the anonymous ones.

In 2016, France adopted a law (known as the Sapin 2 law)⁷ that required companies with more than 500 employees and a turnover of more than €100 million to put in place a series of measures to guarantee their compliance with the rules of probity (known as ‘compliance plans’ – see below). This law also introduced a protective status for whistleblowers and required companies with at least 50 employees to set up an internal whistleblowing system. Its scope included crimes and offences, breaches of probity and breaches of international law. However, for companies with at least 50 employees, who were not required to set up a compliance plan, the Sapin 2 law contained no real requirements as to the content of the procedure to be put in place or the guarantees granted in this context. Nor did it lay down any specific obligation to ensure proper handling of the reports received by the company.

The law of 21 March 2022 (known as the ‘Waserman law’), which transposed the EU Directive 2019/1937, significantly improved the protection of whistleblowers. This law and its implementing decree of 3 October 2022⁸ requires companies with at least 50 employees⁹ to implement an internal procedure for collecting and handling whistleblowers’ reports, with obligations to handle a report and response times. The person making the report is protected. The reporting channels have been simplified and protection against reprisals has been extended to the whistleblower’s relatives and to facilitators.

Above all, the scope of the law is now more comprehensive, covering crimes, misdemeanours, threats or harm to the public interest, breaches or attempts to conceal a breach of an international commitment by France, a unilateral act of an international organisation taken on the basis of such a commitment, European Union law, French law or regulations. The Sapin 2 law continues to cover all breaches of probity.

In France, all reports relating to these facts are therefore admissible, provided that they concern the company and are sufficiently detailed to enable checks to be carried out.

The right to report is no longer limited to people working for the company. It is now formally open to former employees, job applicants, shareholders or partners, external or occasional collaborators, co-contractors, subcontractors of the company, its managers and employees. Many companies that introduced a whistleblowing system before the Waserman law had already included these people in the scope of their system.

Unlike the Sapin 2 law, which required whistleblowers to report first via the internal channel, the Waserman law of March 2022 does not establish a hierarchy between internal reporting and external reporting to the authorities listed in the decree of 3 October 2022. Whistleblowers may now report directly to an external authority, such as the Direction Générale du Travail (DGT)¹⁰ if the report concerns working conditions and to the French Human Rights Ombudsman in the case of discrimination.¹¹ The whistleblower may also make a public disclosure in certain, more limited cases.¹²

The conditions for whistleblower protection have been relaxed. Previously, whistleblowers had to act in a ‘disinterested manner’. Now, French law stipulates that they must act without financial consideration.¹³

The reporting procedure may be set up by means of a charter,¹⁴ a simple memorandum or a collective agreement. In practice, the company will choose the method best suited to its situation, depending on its workforce and organisation. The procedure for collecting and processing reports can be outsourced.

Employees must be made aware of the existence of the whistleblowing system. They should be regularly reminded of its existence to ensure that it is effective – for example, through professional training sessions. It is recommended that employees are informed individually, that the report system is accessible from the company’s website and that information about the system is displayed.

Before the whistleblowing system is introduced, employee representatives (ie, the social and economic committee¹⁵ (SEC)) must be consulted. The SEC must give its opinion on the draft scheme. The SEC’s opinion is merely consultative and not binding on the company.

In addition, the company’s internal rules¹⁶ must mention the existence of the reporting system. Compliance with and implementation of all these rules and processes underline the essential role played by a company’s legal, compliance and human resources departments when it comes to whistleblowing.

The employer determines whether the report can be verbal or written and defines who should receive it and by what means. The employer must ensure that the people appointed internally to receive and handle reports have the appropriate position, skills and authority to carry out their duties.

If the whistleblower chooses to make a verbal report (ie, during a telephone conversation, videoconference or physical meeting), the report must be recorded in writing so that the whistleblower can check its accuracy and correct it if necessary.

Good practices outside of what is mandatory

None of the EU or French rules require that a whistleblowing system must deal with every complaint anyone has within a company.

In practice, however, reports relating to labour and employment issues account for a large proportion of the reports issued. They often reflect situations of tension that the employer cannot ignore in view of its health and safety obligations or because they may, in the long term, affect the company’s social climate.

Having a procedure for handling internal reports is essential. It enables all the departments of the company involved to anticipate their coordination and to work in the best possible way. It also makes the whistleblowing system more effective by providing clear and accessible guarantees for those likely to report a problem. When dealing with a report as a matter of urgency, the relevant procedure, when well drafted, saves time and ensures that clear guidelines are followed.

In addition to the legal obligations that the procedure must reflect, the list of admissible topics for whistleblowing reports must include breaches of internal rules of conduct.

However, the legal status of ‘whistleblower’ cannot be granted to every person using the system without a case-by-case analysis. If, following a preliminary check of the facts reported, the report is deemed inadmissible because it does not meet the required conditions (the facts reported do not concern a crime, an offence or a breach of the law), then a channel must be provided to direct the person making the report to a person who is able to take charge of the issue (e.g., for a report about a harsh management, by regular monitoring or training of the responsible manager).

Indeed, employers have no interest in allowing disagreements between employees to continue. On the one hand, such situations damage company cohesion and work efficiency. On the other hand, even though these difficulties may not clearly constitute moral harassment, for example, their repetition and duration may, in the absence of any reaction from the employer, constitute a breach of the employer’s safety obligations.

Mediation measures may be offered to the employees concerned, as well as management training and regular monitoring of the situation by someone from human resources.

Informal reports, namely those made via a channel other than the existing prescribed reporting system in place, must also be addressed by the handling procedure; for example, by requiring that a report made to a person’s supervisor, or a member of management must be redirected to the appropriate department.

The whistleblowing procedure may provide for an ad hoc committee to be set up when the persons implicated are part of the team usually responsible for dealing with whistleblowing or when the whistleblowing allegation concerns the company’s senior executives. It should also provide for outsourced handling of the report, which may then be entrusted to an external legal adviser. This may be necessary when the report involves, for example, members of the company’s management committee or employee representatives on the SEC.

Lastly, the procedure for handling reports should stipulate that an imprecise alert may be considered inadmissible if the author fails to respond to the company’s request for further information.

Companies that are required to set up a compliance programme

In addition to setting up a whistleblowing system, some companies have to implement an entire compliance programme, the aim of which is to combat breaches of probity in France and abroad. Such a system, which aims to control the risks associated with illegal practices, cannot be adopted without the full involvement of the legal, compliance and human resources departments.

In France, the Sapin 2 law requires companies with turnover of more than €100 million and more than 500 employees, as well as certain public entities, particularly those employing employees under private law, to implement a compliance programme, which is monitored by the French Anti-Corruption Authority (AFA), who can then impose sanctions on these companies.¹⁷

In this context, eight measures and procedures must be implemented, in particular the introduction of:

• a code of conduct to avoid behaviours amounting to a breach of probity;
• a whistleblowing system to ensure the report of such breaches;
• a disciplinary regime that allows the company to properly sanction any breach; and
• a training system to ensure that those responsible for handling reports are able to do so correctly.

At European level, the Duty of Vigilance Directive¹⁸ aims to encourage responsible corporate behaviour. To this end, it extends reporting obligations at European level to companies with more than 1,000 employees and global sales in excess of €450 million. It will come into force gradually and must be transposed into French law within two years.

Processing the report: rules and good practices

Obligations under European and French law

European law stipulates that the internal system for collecting reports must be secure, that an acknowledgement of receipt must be sent within seven days of receipt and that an impartial person must be responsible for following up the report. It requires feedback to the originator within three months and the provision of clear information on the system and the processing of reports.¹⁹

French law largely follows the European rules. In whatever form a report is made, it must be acknowledged in writing within seven working days. The decree of 3 October 2022 provides for the possibility of requesting additional information to verify the accuracy of the report, to obtain more information or to ensure that the report complies with the conditions relating to the protection of whistleblowers.

The author of the report must be informed in writing of the action taken within three months of acknowledgement of receipt of the report, or failing this, within three months of the expiry of the seven-day period for acknowledging receipt. This information shall cover the measures planned or taken to assess the accuracy of the report, to remedy the situation reported if applicable and the reasons for these measures.

The handling of reports and the resources deployed to this end are undoubtedly the most sensitive issues, particularly for smaller companies. While not all reports are worthy of in-depth investigation, all should be taken into consideration by the employer. If initial checks reveal that they are unfounded rumours, the author of the report should be informed that the file is closed.

A recurring question is what should be done with anonymous whistleblowers. The EU Directive 2019/1937 stipulates that member states are free to determine whether such reports are admissible and that anonymous whistleblowers whose identity is subsequently revealed should benefit from the same protections as named whistleblowers. It states that the confidentiality of the whistleblower must be preserved and that the company is liable to sanctions in the event of failure to comply.

In France, the French Data Protection Authority (CNIL) initially took a cautious approach to anonymity, stating that companies should not encourage it and making the processing of anonymous reports subject to certain conditions. However, in its guide updated to 6 July 2023,²⁰ the CNIL states that report systems ‘should allow authors to make their reports anonymously’ and that the system ‘should, in this case, allow exchanges to continue with the author of the report while preserving the benefit of anonymity’, for example, by providing an email address that does not allow the author to be identified.

In France, employers are free to decide whether or not to allow reports to be treated anonymously, which must be specified in their procedures for handling reports.²¹

Fear of reprisals can be an inhibiting factor and explains why employees who blow the whistle often prefer to remain anonymous. Allowing anonymity is therefore a message from the company to its employees that dealing with an abnormal or illegal situation is more important to them than identifying the person making the disclosure. It is not uncommon for the person who decided to remain anonymous when making the report to finally agree to reveal their identity in the course of the investigation. The employer should try to persuade them to do so, in particular by reminding them of the employer’s legal obligation of confidentiality relating to the identity of the whistleblower.²² The credibility and probative value of the investigation and its conclusions are also at stake. Disciplinary measures may be taken if the facts reported are proven. These sanctions may be challenged in court by the person implicated. Experience has shown that French courts are very reluctant to accept anonymous testimonies, unless they are supported by other material evidence.

Dedicated digital platforms make it possible to protect the identity of whistleblowers and enable ongoing exchanges with anonymous whistleblowers, as well as sending supporting documents in complete security if the person handling the report needs further information.

Protection of the whistleblower under labour law in Europe and in France

EU Directive 2019/1937 aims to provide whistleblowers with a high level of protection against dismissal, demotion or any other form of reprisal. The directive applies to all persons who disclose information in the course of their work, whether or not they are employees (including trainees and subcontractors).

The French Waserman law, like other legislation in the EU aimed at improving the protection of whistleblowers, goes further than the European provisions. To make it easier for whistleblowers to come forward, the law strengthens the confidentiality guarantees that apply to whistleblowing and adds to the list of prohibited reprisals, circumstances such as intimidation, damage to reputation (particularly on social networks), improper referral for medical treatment, inclusion on a blacklist, etc.

This is also the case with the Belgian law on whistleblowers, which came into force on 15 February 2023, in which the provision that the whistleblower’s motives must be positive, disinterested and in good faith, has not been included in order to promote broader protection. The Luxembourg law of 16 May 2023 extended the right to protection of whistleblowers to all breaches of national law, thus going beyond the specific areas covered by the EU Directive 2019/1937. Denmark, the first country to adopt its transposition law on whistleblowers on 24 June 2021, has also extended the material scope of the directive to all breaches of Danish law.

French law also provides for an extension of the principle that whistleblowers are not liable for their reporting. This means that whistleblowers cannot be sued under civil law for damages caused to the accused person by a report, provided it was made in good faith. Nor can they be criminally prosecuted for having intercepted and taken confidential documents relating to the whistleblowing, containing information to which they had lawful access. The law seeks to limit the financial cost of legal proceedings in which whistleblowers become involved in defending themselves from retaliatory measures, or when their financial situation is seriously impaired as a result of their report. Whistleblowers may also receive psychological and financial support from external authorities, either directly or via the Human Rights Ombudsman.

Moreover, the EU Directive 2019/1937 extends certain protections offered to whistleblowers, in particular, protection against reprisals, to other people: natural persons or non-profit-making legal entities (trade unions or associations) qualified as facilitators in that they help to make the report or disclosure as well as whistleblower’s colleagues and relatives. In this way, whistleblowers are no longer isolated.

An employee must not be the subject of unfavourable measures following a report made (eg, dismissal, demotion, modification of the employment contract such as a reduction in pay or change of workplace, or disciplinary action).²³

In the event of proceedings being brought against them²⁴ (eg, for defamation), the employee will be able to avail themselves of whistleblower status.

If the employee considers that they have been the victim of reprisals on the part of their employer, they may apply to the courts to have the dismissal annulled. They may also claim compensation for the loss suffered if they have been dismissed (eg, loss of pay as a result of losing their job). The employee benefits from a reduced burden of proof. All they have to do is present evidence ‘from which it may be presumed’ that the report was made in compliance with the legal rules. It is up to the employer to prove that the measure is justified by considerations unrelated to the report (eg, the dismissal is based on misconduct and not on the report). The employer will not be able to claim compensation for any loss resulting from the whistleblowing (eg, loss of turnover), provided that the whistleblowing was done in compliance with the rules and that the employee had reasonable grounds for believing that the whistleblowing was necessary to safeguard the interests in question.

An employee who has been dismissed as a result of filing a report may bring the matter before the industrial tribunal under the summary procedure, which requires judges to rule within a short time frame on the legality of the dismissal. The employee may also ask the industrial tribunal to order the employer to pay into their personal training account.

This protection only applies to whistleblowers who meet the conditions set out in the EU Directive 2019/1937 and the applicable national legislation.²⁵

Role of the workers’ representatives: obligations and good practices

The role of employee representatives is a major issue in Europe. The EU has regulated on the provision of information to and consultation with employees, focusing on social dialogue. In companies with at least 50 employees, employees must be informed about issues that have a widespread impact on the company.²⁶ Health and safety are among the subjects on which employees must be informed and consulted.²⁷ However, there is no provision in European law requiring employee representatives to be informed or consulted about the handling of whistleblowing reports.

Similarly, in France, there is no legal obligation for the employer to involve employee representatives in the handling of a whistleblower’s report, unless the report comes from an employee representative. In particular, members of the SEC have a right to inform the employer in the event of an infringement of individual rights, physical or mental health or personal freedoms.²⁸ In practical terms, when a member of the SEC becomes aware of such an infringement within the company, they must immediately inform the employer. The employer must then immediately carry out an investigation, which will be conducted jointly with the member of the SEC, the results of which will be communicated to the SEC. Failing this, the complainant employee, or the employee representatives (if the employee does not object), may refer the matter to the industrial tribunal.

Members of the SEC also have the right to issue a report if the products or manufacturing processes used or implemented by the company pose a serious risk to public health or the environment. In such cases, the report is recorded in writing, in a special register to be opened by the employer. It must be dated and signed and provide information enabling the employer to carry out the necessary checks together with the member of the SEC who made the report. In the absence of agreement between the two parties, the member of the SEC may refer the matter directly to the public authorities, in the person of the Prefect²⁹ of the department.³⁰

Other than these cases, there is no legal obligation for the employer to involve employee representatives in the follow-up of a report. Regarding investigations, the French Supreme Court has held that an investigation report cannot be rejected on the grounds that the investigation was entrusted to the company’s human resources department and not to the employee representatives.³¹

In practice, except where required by law, the involvement of employee representatives should be assessed on a case-by-case basis depending on the allegations in the report. If moral harassment is alleged, employee representatives can be involved in the investigation. Indeed, they have an essential role in any issue relating to the health, safety and working conditions of employees. When the investigation is carried out internally, an investigation committee made up of a limited number of members of the SEC and management members can enhance the credibility of the investigation.

Apart from these situations, the involvement of employee representatives may be useful if it appears that they will be able to provide information on the background of the complaint or matters that the employer may not be aware of. Their presence also can, in some cases, reassure the whistleblower or witnesses who may be worried about possible reprisals.

The status of a facilitator (and the associated protection) introduced by the Waserman law may apply to employee representatives (elected members of the SEC or trade unions), who support an employee in their whistleblowing activities.

Employee representatives may act as mediators when, in the context of an allegation of harassment, the person implicated, or the alleged victim asks the employer to set up mediation (see ‘Mediation’ below).³² This presupposes that training has been offered to one or more of these representatives prior to their involvement in a mediation.

Lastly, employee representatives may be informed of the conclusions of investigations into certain reports particularly with regard to the SEC health and safety functions. The SEC could be informed, for example, in the case of a report where the investigation finds that a situation of harassment has occurred.

Why must an employer handle a report, even if the allegations are imprecise?

Under European legislation, employers are responsible for the health and safety of their employees.³³ In French labour law, this means that employers are obliged to anticipate risks by introducing preventive measures, particularly in relation to psycho social risks. They must also take swift action when alerted to a dangerous situation involving an employee. These obligations are widely reiterated in European law.³⁴

In France, employers are obliged to react when alerted to the possible existence of a situation of moral harassment in which an employee may be a victim. This immediate reaction will consist, in particular, of carrying out an internal investigation to establish the factual context and to take, if necessary, appropriate disciplinary action against the alleged perpetrator or perpetrators and take protective measures, including precautionary measures, necessary to protect the employee who is the alleged victim. In the absence of concrete and sufficient action, the employer is liable to pay damages for breach of its safety obligation and for moral harassment, and the employee victim may decide to terminate their employment contract to the detriment of the employer, by resigning which in these circumstances is considered in law to be a dismissal without cause.

This is not the only risk to which the employer is exposed in the event of failure to deal with a report. The employer may be held liable on other grounds:

• under criminal law for ‘deliberately endangering the person of another’;³⁵
• in the event of the occurrence of an occupational disease and in cases involving the employer’s inexcusable fault;
• the proper exercise of the employee’s right to withdraw their labour;
• the SEC’s decision to implement the procedure dealing with situations involving serious and imminent danger or to seek expert appraisal on the initiative of the SEC in the event of serious risk;
• deterioration in the social climate within the company; and
• reputational risk.

In addition, in France, the Court of Cassation has ruled that the fact that the whistleblowing employee may have minimised the risk incurred or may not have been fully aware of this risk can in no way justify the absence of measures taken by the employer.³⁶

Reputational risk must be a primary concern for the company when managing whistleblowing because if the whistleblower feels that they have not been heard, they can then report the matter to external authorities, such as the French Human Rights Ombudsman or the DGT or even directly to the public authorities, as provided for in the EU Directive 2019/1937, for example, if there is no reaction to an internal alert.³⁷

First steps to be taken by the person receiving a whistleblower’s report

While it is clear that employers must act as soon as they receive a report and acknowledge receipt, the details of what to do and when needs to be defined on a case-by-case basis.

The first step is to ensure that the report received is admissible (see above). If the report is clearly inadmissible (eg, a report concerning another company, salary-related complaints, etc), the whistleblower must be informed.

If there is any doubt about admissibility, it may be necessary to ask the whistleblower for further information.

If the report is considered admissible, then before considering more active measures, it may be necessary to carry out certain internal checks, for which human resources departments are often the preferred contacts, as they have access to payslips, employment contracts and amendments and disciplinary files of the employees involved.

Similarly, it may be necessary to contact the legal and human resources departments before any documents (such as emails, mobile phone and text records, etc) are seized, to ensure that it is legal to do so and to limit the risk of disputes.

This initial phase should enable the company to check the status of the people allegedly involved (including the victim, any witnesses and the alleged perpetrator), the existence of a connection between the complaint and the company and the seriousness of the allegations based on an initial assessment of the available information. Lastly, it allows the ring fencing of evidence needed to process the report and to take action to avoid its destruction.

These initial checks will then help to guide the handling of the report, depending on the degree of credibility of the facts, their seriousness and the hierarchical position of the people involved.

What should be done to ensure labour law compliance: follow-up of a whistleblower’s report

The employer must initiate the appropriate internal procedures for dealing with the whistleblower – in particular, by offering a mediation process to the whistleblower or by carrying out an internal investigation.

Mediation

In France, employers have a duty to organise mediation if an employee who has alerted them to a situation of psychological harassment or who has been implicated in such a situation asks them to do so.³⁸

Mediation is quick and easy to set up. It provides a confidential framework for exchanges and discussions. Although it is not compulsory, the use of an external mediator is a guarantee of independence. The mediator is trained to support the parties concerned in their decision-making, by endeavouring to defuse conflicts, re-establish dialogue between them and bring them to an agreement containing a mutually satisfactory solution.

Mediation can also be organised internally. In this respect, it is strongly recommended that the person appointed is not related to any of the employees involved (neither working together nor being friends) and that they have had training in mediation techniques. Senior managers of the employer’s human resources functions are key contacts in this respect who may be interested in receiving such training and thus giving visibility, within the company, to this method of resolving and calming conflicts.

Professional or not, the mediator attempts to reconcile the parties by submitting written proposals to put an end to the harassment.

Investigation

As far as internal investigations are concerned, neither European law nor French law says anything about the way in which investigations should be conducted. The principles governing internal investigations have therefore been established in France by case law and bodies such as the French National Bar Council and the Paris Bar Association as regards investigations carried out by lawyer-investigators.³⁹

The French courts have accepted that an investigation report, including one drawn up by the employer, is a piece of evidence like any other, and can therefore be produced in court proceedings. Courts have also progressively defined the rules by which an investigation must be conducted to ensure impartiality.

The investigator’s role is completely different from that of the mediator as he or she conducts an objective analysis, based on documentation and the interviews conducted with the various parties involved in the situation, in order to establish the veracity of the facts alleged in the report.

The use of an investigator from outside the company, in particular, a lawyer, is a guarantee of independence and impartiality, as the lawyer should preferably not be the company’s usual counsel. An investigation conducted by a lawyer is also covered by professional confidentiality. Outsourcing the investigation is recommended when the alleged facts are particularly serious and when the parties involved are part of the company’s management or SEC which may require enhanced confidentiality. Lastly, the involvement of a third party (such as IT or a forensic expert to process data) may also be necessary to conduct the investigation. In such cases, the expert should be appointed not by the employer, but by the lawyer, so that professional confidentiality is extended to the expert’s reports and testimony.

An investigation or mediation must be carried out within a sufficiently short period of time to respect the employer’s legal deadlines for reporting to the whistleblower on their report and its consequences and to be able to take disciplinary sanctions.

Aftermath of the report

Sanctions in the event of confirmation of the facts

If the investigation establishes the truth of the allegations, the company must promptly decide on the appropriate disciplinary action, having regard to the seriousness of the findings and the immediate measures required to put an end to the situation.

In France, employers have two months to initiate disciplinary proceedings.⁴⁰ Theoretically, this period runs from the time when the employer has full and accurate knowledge of the wrongdoing, in other words, the date on which the employer learns of the conclusions of the investigation,⁴¹ provided that the submission of these conclusions is not delayed and that the facts did not become clear enough to amount to the full knowledge of the wrongdoing before the conclusions of the investigation. It is therefore important for both the employer and those involved in the investigation to act promptly.

Most European legislation also provides for a relatively short disciplinary period. The legal or human resources departments should be involved at this stage to avoid any difficulties.

Company’s reaction if the report is unfounded

If, on the other hand, the conclusion of the investigation is that allegations were not established, it is essential to ensure that the whistleblower cannot be subjected to any reprisals, threats or intimidation, if necessary, with the employer providing or ensuring appropriate support. The same applies, albeit to a lesser extent, to the employee who was alleged to be the perpetrator in the report and to those employees who agreed to testify.

However, in Europe as in France, if an employee has used the whistleblowing system without fulfilling its conditions, the whistleblower protection does not apply and, depending on the consequences of the unsubstantiated whistleblowing, the employer may decide to impose sanctions, up to and including dismissal⁴² of the whistleblower.

The EU Directive 2019/1937 only protects whistleblowers who had reasonable grounds to believe that information on the breach reported was true at the time of reporting and that such information fell within the scope of this Directive.⁴³ If the employer can prove the whistleblower did not have such knowledge, the whistleblower will not be protected under this Directive, except if the national law provides for broader protection.

Under French law, a report made in bad faith, in the knowledge that the facts reported were false, does not protect the whistleblower who can then be dismissed.⁴⁴

Naturally, these sanctions can only be imposed by following the dismissal procedure. It is advisable at this stage to take the advice of an external legal adviser, as the question of proving the bad faith of a whistleblower is often a very difficult exercise.

Communication about the follow-up of a report

Under both European and French law, the whistleblower must be informed of the action taken by the employer and of the closure of the report.⁴⁵ In this respect, French law provides for written communication of the measures taken to verify the veracity of the allegations and to put an end to any relevant breach.⁴⁶

Although there is no provision obliging an employer to inform the accused person of the action taken on the report, once an investigation has been opened, it is good practice to inform them of the conclusions of the investigation. Similarly, if the victim and the whistleblower are not the same person, written communication may also be sent to the victim. None of them have to be given the full conclusions of the report.

In the case of witnesses, a summary of the conclusions is sufficient and can be given orally. Similarly, when it has not been possible to maintain the confidentiality of the investigation, it may be possible to communicate the findings to a wider audience (such as the team or department, in which the whistleblower was employed).

Unless there are special circumstances (eg, articles in the press), communication outside the company is not recommended.

Time limitation for keeping the report and, if applicable, the conclusions of the investigation 

Data relating to the reports must be stored in compliance with the General Data Protection Regulation.⁴⁷

The CNIL recommends retention of the report:⁴⁸

• on an active basis until a final decision has been taken on how to proceed;
• in the form of intermediate archives after this final decision ‘for the time strictly proportionate to their processing and to the protection of their authors, the persons they concern and the third parties they mention, taking into account the time required for any further investigations’; and
• on an active basis, also when disciplinary or litigation proceedings are initiated against a person implicated or the perpetrator of an abusive report, until the end of the proceedings or the limitation period for appeals against the decision taken.

Data may be kept for a longer period, for intermediate archiving, if the data controller is legally obliged to do so, or for evidentiary purposes with a view to a possible administrative audit or dispute, or for the purposes of carrying out quality audits of the processes for handling reports.⁴⁹

In our view, these rules should be interpreted as allowing a company to keep in intermediate archives reports that are not followed by disciplinary or legal proceedings in order to ensure its right of defence. In the case of harassment, for example, an employee who makes an initial report may make a second report by producing new evidence if the facts, which were not proven following the initial report, persist. Similarly, a person who has been the subject of a harassment report may be the subject of new complaints from other employees. Keeping both whistleblowers’ reports and any subsequent investigation reports, allows the employer to demonstrate that it has indeed acted and therefore complied with its safety obligation, but also gives the company the ability to easily retrieve the information gathered at the time of the first report.

Data subject to intermediate archiving is kept in a separate information system with restricted access, for a period not exceeding the duration of legal proceedings.

Are you ready to properly deal with a report?

The following list of documents and processes should be put in place within French companies of at least 50 employees to ensure that reports are processed efficiently and in compliance with EU and French regulations.

• Establishing the internal reporting channel which will be:
  • submitted to the SEC;
  • visible on the notice board of the company;
  • accessible on the company’s website when applicable;
  • communicated to all employees individually (by email or by hand-delivered letter);
  • mentioned in the internal rules of the company;
  • presented to all employees by the head of the company; and
  • part of the employer’s required internal training for all employees.

• Adopting updated internal rules which will:
  • mention the whistleblowing system and process;
  • inform employees of a whistleblower’s rights of protection from reprisal and harassment; and
  • establish appropriate disciplinary sanctions within the company (in France, other disciplinary sanctions such as temporary suspension or demotion must be provided by the internal rules to be applicable rather than warnings and dismissals ).

• Providing a detailed written process for handling reports with:
  • timelines and deadlines for acknowledgement of receipt of reports, for carrying out an investigation or starting a mediation, the identity and qualifications of investigators, the circumstances requiring external service providers and internal communication policies and procedures during and after the investigation;
  • templates of forms and other documents to be used following receipt of a report and during and after the investigation;
  • a ready-to-use GDPR information note relating to the processing of the personal data collected in the course of an investigation; and
  • the names and contact details of the employees who are in charge of processing reports and their training.

• Adopting a compliance programme, where applicable.

• Adopting an IT charter:
  • which provides for access to each employee’s professional mailbox, professional phone and computer without the employee’s consent or warning, and locking them if necessary to prevent the loss of evidence;
  • formally adopted as an annex to the existing internal rules to ensure it is enforceable; and
  • communicated to all employees.

• Including a clause in the employment contracts providing that workplace phones and computers may not be used for personal purposes.

• Adopting a code of ethics or a code of conduct, where applicable which:
  • provides that disciplinary sanctions can be taken in case of breach of the code;
  • is formally adopted as an annex to the existing internal rules to ensure it is enforceable;
  • is visible on the notice board of the company;
  • is presented to all employees by the head of the company; and
  • is part of the employer’s required internal training for all employees.

Reproduced with permission from Law Business Research Ltd. This article was first published in Lexology In-House View – Whistleblowing. For further information, please visit https://www.lexology.com/inhouseview