By 17 December 2021, EU Member States were required to transpose the EU Whistleblower Protection Directive into their national law. The Directive’s purpose is to provide more robust protection across all EU countries for people who report breaches of EU law or ethical misconduct. Employees who decide to file a report must now be provided with clear reporting channels and be protected from retaliation.
This round-up summary covers the pressing questions directed at our experts before our September EU Whistleblower Protection Directive webinar session. Speakers included Jan Stappers, EU Whistleblowing Specialist at NAVEX, and Lauriane Morette, Senior Associate at Fromont Briens | Littler. The webinar focused mainly on challenges and developments in French whistleblowing legislation.
Why did the EC start an infringement procedure against France?
After a delay in the transposition of the EU Whistleblower Protection Directive in France, the European Commission (EC) delivered a Letter of Formal Notice on 27 January 2022. France delivered quickly; on 21 March 2022, it presented the transposition, though with the caveat of being effective from 1 September 2022. This is the New French Whistleblower Protection Law, or Loi Waserman / Loi n° 2022-401.
On 15 July, the EC responded with a request for an explanation in writing as to why France still had not transposed the Directive. The law is now effective in France, but a few elements of the EU Directive were still missing in the French legal framework around whistleblowing. France has been considered “in delay” by the EC, and in March, it transposed some of the key elements of the Directive – but this wasn’t considered a complete transposition. The procedure seems to be still ongoing from the EC side, although France only recently included enforcement decrees that come with local laws. These decrees were still pending during our September whistleblowing updates webinar, but are now public, coming into effect on 4 October 2022.
Clarified elements of the transposition include the time limits for written acknowledgment of a raised concern and a list of the competent authorities responsible for processing external alerts. This made it difficult for French organisations to modify internal regulations and procedures as outstanding transposition points were still pending.
What are the critical changes in French law presented by Loi Waserman?
Loi Waserman expands on France’s existing law around whistleblowing, Loi Sapin II, in several ways. Firstly, it broadens how a “whistleblower” and a “whistleblower report” are defined. This change has already impacted the number of reports received by French companies, indicating a positive development in reporting culture.
Secondly, the obligatory reporting sequence under Sapin II has been abandoned. Previously, this meant a strict escalation procedure for whistleblowing, where a report first had to be raised internally and taken to a regulatory body (or bodies) second before being permitted to go to public disclosure.
Finally, Loi Waserman outlines stricter penalties than existing French Law, outlining three years’ imprisonment and a fine of up to EUR 60,000 for persons found retaliating or discriminating against whistleblowers.
How long should whistleblowing reports remain in company records?
There are two scenarios to consider when discussing how long reporting data is kept.
When the alert is not followed by any action or investigation – effectively when the case is considered closed – all information about the report and the whistleblower must be destroyed within two months of the data being anonymised.
In the case of an action or investigation underway after submitting a whistleblowing report, the French transposition law and the EU Directive have not provided a specific period for data to be stored, which presents some challenges.
The Law states that “the elements of the report may only be stored for the time strictly necessary and proportionate to their processing and for the protection of their authors, the persons concerned, and third parties mentioned in these alerts (taking into account any further investigations needed).”
Therefore, the appropriate length of time to store data depends on the nature of the report. At the time of writing, this legal provision does not refer to the five years maximum conservation period laid out in GRPD rules, meaning that regulations around the storage of whistleblowing data exist outside GRDP legislation. Each case should be assessed individually to gauge the “strictly necessary and proportionate” amount of time data should be stored, with a focus on businesses being able to justify why they needed to keep that data based on each unique circumstance.
Do whistleblowing procedures need to be provided in the local language?
Under French law, all legal documents, from basic informative information to employment or mutual agreements, must be drafted in the local language to be enforceable. In line with legal requirements around this more broadly, whistleblowing procedures should also be made available in French.
Which EU countries offer the most significant protections for whistleblowers?
A difficult question to answer, this is often complicated by measures and protections in practice turning out differently from how they sound in theory. In France, protection is less about the value of penalties as protections, but rather the extended daily protection. This includes the whistleblower’s exemption from civil and criminal liability; from any reprisals such as disciplinary procedures and exclusion from recruitment procedures; and protection from discriminatory practice and intimidation. Employers must carefully apply reprisals prohibited by law in practice. In this way, any employee or contractor reporting a concern is considered a protected employee subject to this wide range of protective measures.
None of our subsidiaries reaches the 50-employee threshold outlined in the EU Directive; however, altogether, these reach the employee threshold of 250. Should we comply with the Directive or not?
In principle, if your organisation is not active in one of the outlined sectors in the Directive (such as Financial Services), you do not have to comply as it would not apply to your business. The Directive’s stipulations must be looked at on an entity level as a 250-employee threshold per entity. It is also important to note that each entity within the threshold must have its own reporting channel. This does mean less work for those organisations with fewer than 50 employees but does mean more work for those with over 50 employees, even if the group entity has a group reporting channel.
What is considered a whistleblowing report in the French transposition of the Directive? Do you have to follow up on all reports, or are there specific topics that whistleblowing includes or does not include?
The new law removes some elements of the previous definition outlined in Loi Sapin II. One point it removes is that a “serious and manifest breach of the law” is no longer required. This means disclosure of a simple breach or violation (as opposed to a serious one) is now required to be considered a report or alert. This will increase the scope of what comes under a whistleblowing issue in French legal terms – and therefore what protections are required for the whistleblower.
The second point is that the whistleblower definition is broader, so the definition of a report has become more expansive as well. The qualification of a report is also broader; the whistleblower is no longer required to be “disinterested” and can act according to personal interest as long as they do not receive financial compensation for submitting a report.
Lastly, the whistleblower is no longer required to have personal knowledge of the fact reported. Any information known directly or indirectly by an employee or contractor can qualify as a report. Many disclosures can now qualify as whistleblower reports, putting them under the protection of new laws. Promisingly, France has already seen an increase in the number of whistleblowing reports submitted since this development.
For more information about the EU Whistleblowing Directive and developments in French whistleblowing legislation, check out our special webinar session focused on France:
