Internal whistleblowing procedure to be updated in companies with 50 or more employees

This is one of the signs of our times: the media cases triggered by a whistleblower follow one another and go far beyond this framework. Their story is regularly the subject of remarkable film adaptations (Snowden, The Laundromat…), and even successful fiction (such as the resounding Don’t look up).

Enough to arouse vocations? This is the assumption of the legislator, who has recently improved the protection regime for persons who usefully disclose certain sensitive information (e.g. relating to the violation of legal rules or other forms of threat or harm to the interests of society).

The procedure for collecting and processing whistleblower reports, which is mandatory for all companies with at least 50 employees, has thus been redefined by a decree, applicable from 5 October 2022.

• What is a whistleblower?

1. The Act of 21 March 2022 made the definition of a whistleblower more flexible. A whistleblower is a natural person who reports or discloses, without financial consideration and in good faith, information about :

• a crime or misdemeanour,
• or a threat or harm to the public interest,
• or a violation or an attempt to conceal a violation of an international commitment regularly ratified or approved by France, of a unilateral act of an international organisation taken on the basis of such a commitment, of the law of the European Union, of the law or of the regulations

Facts, information or documents, whatever their form or medium, the revelation or disclosure of which is prohibited because they are covered by national defence secrecy, medical secrecy, the secrecy of judicial deliberations, the secrecy of judicial investigations or the professional secrecy of lawyers are excluded from the whistleblower protection regime.

2. As of ¹ September 2022, whistleblower protection will fall on two types of actors:

• facilitators, i.e.: “any natural person or legal entity (colleagues, employee representatives, trade unions, associations)] under private non-profit law who assists a whistleblower in making a report or disclosure”;
• other persons related to the whistleblower himself/herself, who may be subject to any of the retaliatory measures in the course of their professional activities by their employer, client or the recipient of their services.

• What are the three possible alerts?

The whistleblower can :

1. send an external report to a competent authority (Defender of rights, judicial authority, DGCCRF, HAS, CNIL…)
2. send an internal report, according to the procedure set up by the employer, which is compulsory in companies with 50 or more employees.

The content of this internal procedure was clarified by the implementing decree of 3 October 2022 (which repealed decree 2017-564 of 19 April 2017)

3. Finally, the whistleblower may make a public disclosure in certain circumstances, in particular where there is an imminent or obvious danger to the public interest or where a previous external warning has failed.

• Focus on the internal procedure to be implemented/updated since 5 October 2022

A simple procedure that can be adapted to the size of a group

Each company concerned determines the legal instrument best suited to meet this obligation and consults the ETUC prior to its implementation.

For example, it could be a simple memo.

In groups of companies, companies may adopt identical procedures for several of them and even pool the channel for receiving reports (for companies with less than 250 employees).

The internal procedure for collecting and handling internal alerts must be disseminated by any means ensuring sufficient publicity (e.g. notification, posting, publication on the company’s website, etc.)

It should be noted that the channel for receiving alerts can be outsourced as long as guarantees of impartiality and confidentiality are respected.

What the internal procedure should include

– A channel for receiving reports, the form and medium of which are free.

– Guarantees of independence, impartiality and confidentiality, in particular in the choice of the persons and/or service designated to collect and process these alerts.

– Oral reporting may be provided (telephone, video conference, physical meeting, etc.). Arrangements for recording an oral report should be provided for, with the cross-cutting rule that the whistleblower’s consent must be obtained before any recording is made.

– Acknowledgement of receipt of the alert, within 7 working days of receipt.

– A verification of the compliance of the alert with the whistleblower protection framework

– The procedures for handling alerts, in particular the right to request any additional information in order to assess the accuracy of the allegations and the obligation to report to the author of the alert on the follow-up given to the alert (closure, measures taken as a result, etc.)

We are of course at your disposal to assist you in these matters.