• On March 21, 2022, France enacted a new law implementing the EU Whistleblowing Directive of 2019. The law improves whistleblower protections already in place since 2016 and goes beyond the minimum requirements of the Directive. It will apply as of September 1, 2022.
• Whistleblowers will now be able to report various crimes, threats or violations directly to French authorities without having to report internally first. They will now also be better protected against retaliation measures.
• The new law creates a new landscape for whistleblowers but also for businesses that may now have to face an environment of potential booming reporting and public disclosures.

On March 21, 2022, France enacted a multipartisan law on whistleblower protection, just after the French Constitutional Court had cleared some of its provisions. The new law implements the EU Whistleblowing Directive of 2019, going beyond its minimum requirements and improving the whistleblower protection regime already in place in France since the Sapin II Law of December 16, 2016.

Background. Under the Sapin II Law of 2016, whistleblowers were defined as natural persons reporting, in a selfless manner and in good faith, crimes, serious and manifest breaches of international or French laws or serious threats to the general interest, of which they had personal knowledge.

Whistleblowers were offered some level of protection against retaliation measures, provided they did not run afoul of a three-step reporting process: (i) they had to report within their organization first; (ii) in the absence of reaction within a “reasonable period of time,” they could report externally to French authorities; and (iii) in the absence of reaction within three months, only then could they disclose the issue publicly.

That stringent reporting process and the lack of financial assistance were largely seen as dissuading whistleblowers from actually acting. Drawing on the minimum requirements imposed by the EU Whistleblowing Directive, the new law is now giving more teeth to whistleblower protections.

New Definition of Whistleblower. Under the new law, protections apply to whistleblowers defined as follows:

a natural person who reports or discloses, without direct financial compensation and in good faith, information concerning a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France, of a unilateral act of an international organization taken on the basis of such a commitment, or of the laws and regulations of the European Union. When the information was not obtained in the context of professional activities […], the whistleblower must have had personal knowledge of it.

That updated definition still encompasses a wide range of crimes, threats and violations, but it now clarifies that whistleblowers cannot receive “direct financial compensation.” It now also provides that whistleblowers must have had “personal knowledge” of the information not obtained in the context of professional activities.

Importantly, the protection does not apply to information and documents covered by national defense secrets, medical secrets, attorney-client privilege and the secrecy of police/judicial investigations.

Revamped Reporting Process. One of the most salient changes has to do with the way whistleblowers may now report breaches if they want to receive protection: they are no longer compelled to report within their organization first; rather, they can now choose to report directly to French authorities.

Whistleblowers can now also make a public disclosure in three situations:

• when authorities do not react within a certain period of time (still to be decided by the French government);
• when there is a “serious and imminent danger” (even without prior reporting to authorities); or
• when reporting to authorities would create a risk of retaliation, where it would not effectively address the breach at stake or where there are serious reasons to believe that authorities may be in collusion with the perpetrator of the breach or involved in the breach.

While internal reporting now becomes optional for whistleblowers, companies with 50 or more employees in France still have to put in place procedures for internal reporting and for follow-up. Interestingly, the new law now provides for the possibility that such procedures be shared by companies of a group.

Enhanced Protections. The law improves whistleblowers’ protection against a number of retaliation measures such as layoffs, intimidation or damage to reputation on social media. The law now also offers the following protections:

• Whistleblowers challenging retaliation measures in court may now be granted provisional payments for their expected legal costs. If their financial situation has “seriously deteriorated,” they may also be granted a provisional allowance. Such provisional payments are ordered by courts and paid by defendants. Whistleblowers eventually losing their claims may not always have to refund these amounts.
• Whistleblowers facing “abusive or dilatory” court proceedings may now be granted a civil fine of up to 60,000 Euros (in addition to any damages).
• Whistleblowers cannot face civil liability for the harm caused by their reporting if they had reasonable grounds to believe that acting was necessary.
• Whistleblowers cannot face criminal liability for disclosing protected information if doing so was “necessary and proportionate.”
• Whistleblowers cannot face criminal liability for stealing documents (or any other format of information), provided they had a prior lawful knowledge of their content. French MPs provided the following example: “One cannot wiretap their boss’ office to find out whether there is anything to find out and disclose. However, if you are shown a report proving that a factory is dumping mercury into a river, you have the right to steal it to prove the facts of which you have lawful knowledge.”

Protection Extended to Others. These protections will apply not only to whistleblowers but also to natural persons and non-profit legal entities assisting whistleblowers in their reporting process (the so-called “facilitators”). They will also apply to natural persons connected with whistleblowers who may face retaliation measures in a work-related context.

Takeaways. The law creates a new landscape where whistleblowers enjoy better protections and can now report information directly to authorities. These important changes may well increase the number of reports made to authorities without businesses being even aware of it in the first place. That may well in turn impact the French corporate enforcement landscape.

Companies should therefore pursue their efforts to put in place robust reporting channels and follow-up procedures. Addressing reported issues in a timely and effective manner is of course paramount to encourage the use of internal channels.

The new law will enter into force on September 1, 2022. That timeline will give time for the French government to adopt decrees providing more practical details about some aspects of the law. It will hopefully also give enough time for companies to put in place—or update—their internal reporting channels and follow-up procedures.

Beyond France, businesses operating across Europe should monitor the upcoming implementation of the Directive in other EU Member States (so far, only a limited number of them have made meaningful progress). For those operating in the United States, New York State recently amended its labor law to increase whistleblower protections (see our previous update), bringing the state in line with a small number of states granting broad protections for whistleblowers.