Decree Implementing French Law on Whistleblower Protections Published
The long-awaited decree of October 3, 2022, specifies the procedures for collecting and processing whistleblower alerts and determines the list of agencies competent to receive external alerts.
French Decree No. 2022-1284 of October 3, 2022, which implements French Law No. 2022-401 of March 21, 2022, on whistleblower protections (also known as the "Waserman Law"), came into effect on October 4, 2022 (the "New Decree"). In particular, the New Decree relates to the procedures for collecting and processing alerts by whistleblowers and lists the external authorities competent to receive such alerts, as referred to by the Waserman Law.
For background, the Waserman Law transposed Directive (EU) 2019/1937 of October 23, 2019, on the protection of persons who report breaches of Union law (the "Directive"), exceeding the Directive's minimum requirements. It also amended the provisions relating to the protection of whistleblowers provided for by Law No. 2016-1691 of December 9, 2016 (the "Sapin II Law").
The New Decree specifies the method for calculating the 50-employee threshold, which triggers an obligation to set up an internal mechanism for collecting and processing alerts under the Sapin II Law. For private law-governed entities, and for public law-governed entities employing staff under private contracts, this threshold will be assessed at the end of two consecutive fiscal years and determined in accordance with the provisions of Article L. 130-1 of the French Social Security Code.
Further, each entity subject to the obligation to set up an internal alert mechanism must "determine the legal instrument best suited to meet this obligation, following consultation of the relevant employee representative bodies." Therefore, the New Decree expressly refers to the requirement, for companies subject to the obligation to set up an internal alert mechanism, to consult with their employee representative bodies (Economic and Social Committees, or CSE) for that purpose.
The New Decree has also clarified the applicable deadlines for acknowledging receipt of an alert and providing feedback to whistleblowers.
Entities on the receiving end of a whistleblower alert will have to acknowledge receipt of the alert to the reporting person within seven working days of that receipt, as initially provided for in the Directive. The New Decree also offers whistleblowers the possibility to request a video conference or an in-person meeting, which must then be held no later than 20 working days after receipt of such request.
In addition, in the event that an alert is deemed inadmissible by the receiving entity (due to the legal status of the reporting person or the nature of the alert), such entity will now have to inform the reporting person of the reasons justifying the denial of their submission.
Otherwise, where the allegations "appear to be true" to the receiving entity, the alert will be dealt with and feedback provided to the whistleblower "within a reasonable timeframe not exceeding three months from the acknowledgment of receipt of the alert or, if no acknowledgement was sent to the whistleblower, three months from the expiry of the seven-day period after the alert was made."
Lastly, the New Decree also sets out the list of agencies competent to receive, provide feedback, and follow up on external alerts (as a reminder, whistleblowers may submit external reports to these agencies either after having reported the matter internally, or directly). These agencies, competent in 23 substantive areas, are listed in an annex attached to the New Decree. Among them are the French Anticorruption Agency ("AFA"), the French Competition Authority, the French Data Protection Authority ("CNIL"), the French National Authority for Health ("HAS"), and the French General Inspectorate for Social Affairs ("IGAS").
