France established protective legislation for whistleblowers similar to nine other European countries [1]. Whistleblower protection in France was reinforced in December 2016 with the enactment of the Sapin II Law.

The Sapin II law defines the whistleblower, establishes channels by which information is to be reported and introduces measures to ensure whistleblower protection {2].

Recent cases – Panama Papers, Luxleaks, Dieselgate or Cambridge Analytica – demonstrate the need to define and protect whistleblowers non only at a national level, but also at a European level.

On March 14, 2019, a new whistleblower directive on the protection of persons reporting on breaches of European Union law was approved in Strasbourg [3]. EU Member States will have two years after the finalization of this text to implement the rules into each country’s legal system.

I. The definition of a whistleblower

French law defines a whistleblower as “a physical person who reports, selflessly and in good faith, a crime or an offence, a serious and obvious breach of an international commitment duly ratified or approved by France, of a unilateral act from an international organization issued on the basis of such commitment, of law or regulation, or a serious threat or harm to the public interest, of which he has personal knowledge”[4]. Moreover, the reporting mechanism set out by Article 8 of Sapin II provides that whistleblowers can only report on facts related to their employer or the entity for which they work for.

The European Directive applies to reporting persons working in the private or public sector who have acquired information on breaches in a current, former or future work-related context[5].

The European understanding of the whistleblower is wider than that of France however, in that the European Directive includes shareholders, former employees, employees of subcontractors, suppliers, colleagues and parents of the whistleblower.

Furthermore, European law does not impose the pre-requisites on whistleblowers that they have personal knowledge or report selflessly.

II. The reporting mechanisms

Drawing from the recommendations of the French Administrative High Court, Conseil d’État [6]. Sapin II sets out a three-step procedure [7]:

• – Internal reporting channel: the whistleblower must bring the facts “to the knowledge of his direct or indirect superior, his employer or somebody” (a type of Whistleblowing Officer) “designated by his employer to that effect” [8].
• – Communication to the competent authorities: “[i]n the event that the person who received the reported information fails to diligently […]verify the admissibility of said report within a reasonable time”, its issuer may address the judicial authority, the administrative authority or the professional bodies [9].
• – Disclosure to the public: “[a]s a last resort, [if the authority referred to] fails to address the issue within three months, the reported information may be made public” [10], e.g. communicated to the media, associations, NGO, or unions.

Derogation from the application of this procedure is possible in the event of serious and imminent danger or if there is a risk of irreversible damage. In both cases, the whistleblower can address the competent authorities or make his/her report public directly [11]. Sapin II also enables whistleblowers to address their report to the Défenseur des droits, the French Rights Defender [12], in order to be directed to the appropriate authority [13].

In a similar way, the European Directive allows for various reporting mechanisms – internal, external and in case of imminent danger. Mirroring the French provisions, the European Directive provides that in cases where no appropriate action was taken in response to the whistleblower’s initial report, or if the whistleblower believes that there is an imminent danger to the public interest or a risk of retaliation, he/her will still be protected if he/her chooses to disclose the information publicly.

Adversely to French law however, with the purpose of ensuring whistleblower protection and confidentiality of the information, the European provisions allow the whistleblowers to choose between disclosing the information internally to the legal entity concerned or externally, to the competent national authorities, or to the relevant EU institutions, bodies, offices and agencies. This alternative had also been put to debate in the French National Assembly but was rejected by the Senate.

III.  The protection of the whistleblower

French law protects whistleblowers during the entire process, by preserving the confidentiality of the whistleblower’s identity, the identity of the person concerned by the report, and the information received within the report.

Revealing information that could lead to the identification of a whistleblower is punishable by up to two years’ imprisonment and a criminal fine of up to 30,000 euros. A legal authority may face a criminal fine of up to five times this amount, i.e. 150,000 euros [14].

Moreover, the whistleblower benefits from disciplinary immunity. The whistleblower is therefore protected against any disciplinary measure or sanction, discrimination or unfavorable measure.

European law goes even further to ensure protection of whistleblowers. Additionally, to protecting the whistleblower from retaliation, civil, criminal, administrative or employment related liability, the Directive prohibits any form of direct or indirect retaliation, including threats and attempted threats and lists many detrimental measures. The Member States have also committed to supporting the whistleblower by providing free independent advice on the remedies available for protection against retaliation, effective assistance of authorities and access to legal aid.

In light of these differences between the French and European provisions on the whistleblower mechanism, it remains to be seen how the French legislator adapts to the widened scope of the whistleblower status and reinforced protection of the whistleblower.