As part of Ropes & Gray’s Enforcement Express series, Tina Yu interviews Stéphane de Navacelle on key regulatory and compliance considerations in France, especially about risks in compliance for health care and life sciences companies.
Tina Yu: Hello, and welcome to Ropes & Gray’s virtual trip around the world podcast. My name is Tina Yu, and I am an associate in our London office. I’m a member of the LEPG (Litigation & Enforcement practice group) team. A little bit about our background and why we’re doing this podcast: Ropes & Gray’s Global Health Care Compliance Initiative showcases our leading Health Care compliance practice around the globe based on internal practice group collaboration and our strong relationships with local counsel. We’re very excited to announce the launch of our Local Law Comparison Guide, comparing requirements and standards for typical activities across 19 key international jurisdictions. We partnered with law firms on six continents to develop this comparison guide, which we hope will be a valuable resource to refer to in implementing and maintaining a global compliance program. The co-leaders of this initiative span across our global offices, with Amanda Raad, partner in our Litigation & Enforcement practice group, based in London; Alison Fethke, counsel in our Health Care practice, based in Chicago; and Andy Dale, partner in our Litigation & Enforcement practice, based in Hong Kong. And today, I have with me Stéphane de Navacelle, our partner for France. Stéphane, would you mind introducing yourself quickly to our listeners?
Stéphane de Navacelle: Sure. Thanks so much, Tina, for having me. I am a Paris-based partner of a boutique (Navacelle) which deals with all sorts of enforcement and defense work in France, mostly in a cross-border context. And I’m delighted to be here.
Three hot topics in compliance
TY: Thank you very much. We’re delighted to have you. So now let’s just dive into our discussion today, and I think the first topic should be key regulatory and compliance considerations in France. So I think it would be interesting if you could give us a brief overview of what you think are the three hot topics or top risks in compliance for health care and life sciences companies.
SN: The first topic I’d like to address is maybe not so novel because it’s a 2016 law, but it’s quite important in terms of its reach, because it involves a compulsory compliance program for companies having over 500 employees and a turnover in excess of 100 million (euros), so it would obviously involve many participants in the health care industry. And what it does, is creates an obligation to have a very comprehensive compliance program, which includes a code of conduct, whistleblowing, corruption risk mapping, third-party due diligence of course, and so on and so forth. To those compliance requirements, you have repeated additions due to the evolution of expectations of the law and of case law. The control of the compliance systems is carried out by a new administration called the French Anti-Corruption Agency—L’Agence Française Anticorruption—and it’s specifically tasked through one of its audit and sanctions branches to make injunctions so that companies would amend their compliance program, and they can issue sanctions up to one million Euros. In their very first decisions, they have been both very lenient, as they put it themselves, but also very clearly told the French companies subject to the Sapin II law that change was coming and that they would take these issues into their hands.
Another maybe more recent but very relevant change in the law in France comes from case law, and that is a Supreme Court decision from late November last year, which decided that when there was a merger of a company into another, the criminal liability would follow suit. So up until the end of last year, if you were to dissolve an acquired target into your own corporate, you were safe from a criminal liability point of view. Now, it may not be the case.
The two other issues I was hoping to touch upon were the new French anti-gift law, as it calls itself, on one hand, and the very, very slight changes to the French Public Health Code when it comes to rules for access to health care products. So in a nutshell, the French anti-gift law will set a clear rule prohibiting the health care companies, health care professionals, along with medical students, medical professionals, associations, government officials, and so on and so forth, so it really regulates a large portion of the health care industry. And so these October 2020 updates to the gift rules—which segues into my previous point of having the right up-to-date compliance program—now applies in a way that is much more broad, whether the health products are reimbursed by the French Social Security or not. So it’s very, very, very wide.
It requires, for instance, companies manufacturing or marketing health care and cosmetic products who are providing services in connection to those products are required to disclose on a single public website all the relevant information, which includes the subject matter, the date, the direct and ultimate beneficiaries, and so on and so forth. So you see that there is clear enhanced regulation. There was a ministerial order which came, as is often the case after a law is passed, which specifically limits the benefits that you can distribute to professionals. For instance, a business meal has to be occasional. “Occasional” means up to two a year—so you see it’s very limited—and you cannot provide a lunch for more than 30 Euros. For books and so on, also limited to 30 euros. And together, all the gifts that you provide have to be under 150 euros, office supplies only 20 euros, and so on and so forth. So you see it goes into a huge amount of detail.
There are certain exceptions that you can be made aware of, and that example is for scientific evaluation or scientific research, consulting, and so on and so forth. And then they have a cap on the hourly rates, on the amount per day, and the amount for the entire engagement—and the amount for the entire engagement is a maximum of 2,000 euros. So you see it’s quite considerable in terms of limitation. There are other examples, but I’m not going to go into the full detail of those rules. So that’s really something you want to look into.
It also gives specific powers to professional orders—so the order of doctors, the order of pharmacists, and so on—to give them an opportunity to evaluate and to modify some of the thresholds. I’m not going to go into further detail, but there’s a fair amount that you want to be aware of when it comes to controlling and putting in place the controls within your company.
One last point on the market rules to access for health care products, which were changed due to the pandemic. The French Public Health Code was amended, and it was given emergency powers—maybe that’s a good summary of the issue—to the French government in cases of a sanitary disaster. And I just want to mention there are a couple of agencies in France. The key one is the ANSM—the French National Agency for Medicines and Health Products—which is the key regulator here. And of course, the European regulator has taken the lead, especially in the COVID-19-related crisis.
Enforcement and regulatory framework and landscape in France
TY: That was really interesting to hear, and I’m really fascinated by the evolution of how regulators are looking at compliance programs and the various impact that is going to be on corporations operating in France. While we’re on that topic—and I know you touched on this to a certain extent already, having discussed the various French regulators—I’m curious to hear your thoughts on the regulatory framework within France. How much of a role are state regulators playing versus industry groups and other third parties?
SN: Very relevant question. Of course, as always, it’s a mix of both. So, let me here again address two main issues. One is, of course, which government health authority leads the way, and at the end of our previous discussion on the last point we were making, it is shifting to some extent to the European level. That being said, we have very serious enforcements, and we’ve had several very recent cases where the prosecution has involved both the corporate, but also the individual pharmacists and doctors, and employees of the corporates. So, one must never forget that this is something that will target individuals, a little bit like lawyers, you know? It’s a strictly regulated profession, and so there is a very direct risk here. And the consequences are dire, of course, because if you can’t continue to work as a doctor or pharmacist, then it has considerable consequences on your personal life. So there’s strict control by government health agencies. The French Public Health Code has—I love codes in France—full detail of what can or can’t be investigated by the ANSM inspectors and sometimes supported by the prosecutors. We also have the ARS—Agencé Régionale de Santé—the regional health authority, and they have their own inspectors. And we have, as I mentioned, the ANSM, which can impose administrative injunctions and financial penalties, following what we call a “procédure contradictoire.” So it’s not really a trial, but following an exchange, a conversation between the entity and the regulator.
One other key regulator is the DGCCRF, which is the Directorate of the Ministry for the Economy, and the DGCCRF is responsible for compliance with consumer rules, and rules applicable to some health products. It is very often the case that the DGCCRF will work hand in hand with the ANSM because the inspectors of the DGCCRF are very much trained—they have very tough financial prosecutors. The current head of enforcement of the DGCCRF was the lead prosecutor in Nanterre. Nanterre is the prosecutor’s office for the La Défense district, which is a business district by Paris, just by Paris. So they know what they’re doing—they know how a corporate works, and they are not out of a fairy tale. It’s very similar to enforcements that you would have otherwise by a prosecutor and police officers. One thing that’s changed, as I mentioned, in the law of October 2020, is that they have also delegated a lot of power to the professional orders, especially when it comes to the thresholds that are authorized for spending and of course because they are in charge of discipline.
Obviously, all this needs to be built back into the compliance program. Just to talk about one specific law which is, again, not a very recent one—it dates back to March 2017, but we are having the first enforcements relating to that law come out in the first court decisions. And that is the law on the Duty of Vigilance, which is basically a law that addresses the food chain (supply chain) of the products of your suppliers. That law applies to companies established in France, but with global employees above 10,000, or 5,000 employees in France. And what it does, it creates a legally binding obligation for a parent company to identify, prevent, address human rights events, protection of health and the environment. They have to do so over companies they control, and subcontractors and suppliers.
So you see it creates, again, a very strong compliance requirement, third-party due diligence, risk mapping, and so on and so forth. And what is key here, because France unfortunately lags very much when it comes to enforcement—not so much due to the quality of the enforcement, of the prosecutors and so on, but really the lack of resources—but what this law does, it gives individual NGOs an ability to seek remedy in court in those areas. So literally, an NGO can go and knock at your door, and say, “Listen, your supplier X is in violation, or is polluting, or is employing people that are underage, or is abusing this or that situation,” and literally take you to court for that. So it’s really a private prosecution that has been shaped here. Quite frankly, it’s a defiance of the justice system in France, but it works, and we’ve seen the first cases.
Data protection
TY: Really, really interesting summary of the recent enforcement and regulatory framework and landscape in France. Is there anything else that you want to add just in terms of any trends or enforcement areas that we should be considering?
SN: Maybe just one situation. There have been growing developments of what we call “telemedicine” or “teleconsultation,” which is basically going to see your doctor through a video link. And that has obviously been creating considerable data, which is obviously very private. There has been one recent decision by the French Supreme Court for administrative disputes—the Conseil d’État—the Council of State, and that’s an October 2020 decision which addresses the situation of a French company which had health data with Microsoft in Ireland, and Microsoft being the sub of a U.S. parent company, obviously. The Council of State said that there was no immediate order for the suspension of the use of Microsoft as it was sought by the claimants, but that it suggests very strongly that organizations in the future should use French-based cloud solutions. So you see there is a push there to a better control on the data, and we can very logically imagine that the French Data Protection agency will keep an eye on this.
French anti-gift law
TY: Thank you for flagging that to us. And finally, just coming back to the Local Law Comparison Guide, you were definitely a key contributor here. And as you know, the guide provides detailed information on the rules applying to company-sponsored and third-party-sponsored events attended by health care practitioners. We ultimately encourage our listeners to review the full guide for more detail, but is there anything you would like to flag right now to our listeners that life sciences and health care companies should be paying particular attention to?
SN: One of the key issues is the new update on the French anti-gift law, and try to make sure to monitor the requirements or the suggestions of the professional orders when it comes to the amounts, because that’s an objective way a company can make sure it’s in line.
TY: Got it—thank you. We’ll definitely keep that on our radar. Thank you again, Stéphane, for taking the time to speak to us today. To close, again, really appreciate your partnership in developing the Local Law Comparison Guide and also you taking the time to speak with us.
