The law of 9 December 2016, known as “Sapin II”, led to the consecration of the status of whistleblowers and the development of legal protection for them.[1] However, as this status was insufficiently defined, it remained uncertain and the related procedure was the subject of much criticism[2], often considered incomplete or unclear on some aspects.[3] The law of 21 March 2022 aimed at improving the protection of whistleblowers, has attempted to clarify this status and strengthen the guarantees offered to whistleblowers. In this context, it has given the Defender of Rights a leading role in supporting, guiding and protecting whistleblowers[4].

Against this backdrop, the independent administrative authority updated and published its new whistleblower guide on 30 March 2023. Through eight general questions, the Defender of Rights outlines the status and protection of whistleblowers. These questions are structured around reminders of the applicable texts and practical answers adapted to each individual’s situation. Readers, whether experts or laymen, are also provided with contact details for useful interlocutors, depending on the issue at stake.[5]

The guide published by the Defender of Rights summarizes the applicable legislation to whistleblowers

The new definition of whistleblower set out in the law of 21 March 2022 now requires several cumulative conditions to be met before an individual can claim the protective status of whistleblower. The guide published by the Defender of Rights takes care to detail them.

First of all, as it was previously the case, this status is only available to natural persons. In addition, they must not receive any direct or indirect financial compensation for their reporting. This condition replaces the former uncertain notion of “disinterestedness”[6]. Secondly, the whistleblower must have personal knowledge of the information to which the alert relates if it was obtained outside any professional context. Finally, the whistleblower must act in good faith.[7]

In addition, the information reported must also meet certain conditions, i.e., it must concern (i) facts constituting an offence, whether the offence be of a delictual or criminal nature, or (ii) a violation or attempted dissimulation of a violation of a text or commitment.[8]

The law of 21 March 2022 also broadened the scope of information excluded from the whistleblower regime. Any disclosure of information or document relating to a secret protected by specific legal provisions (i.e., national security, professional secrecy, secrecy of deliberations etc.) is prohibited.[9]

Lastly, the role of whistleblowers’ third parties and facilitators was enshrined in the law of 21 March 2022.[10] In his guide, the Defender of Rights recalls that facilitators, whether private not-for-profit legal entities or individuals, as well as third parties in contact with the whistleblower, can also benefit from the protection regime. While the facilitator must demonstrate that he has helped the whistleblower to comply with the reporting rules, the third party must prove that he is at risk of reprisals.[11]

In addition of these clarifications regarding the definition, the 21 March 2022 law also strengthens the protection of whistleblowers. This is evidenced, for example, by the extension to the civil sphere of the criminal liability provisions of article 122-9 of the French Criminal Code, through the addition of an article 10-1 to the Sapin II law.[12]

The guide published by the Defender or Rights also points out that whistleblowers can choose between two reporting procedures, which have coexisted since decree 2022-1284 of 3 October 2022.[13] The first is an internal reporting procedure, while the second is an external reporting procedure.[14]

The internal whistleblowing procedure enables the whistleblower to act within the professional structure in which he obtained the information subject of the alert. This information must have been obtained during the whistleblower’s professional activities. Then, he must ensure that his professional organization has set up a procedure for collecting and handling reports. If necessary, he should contact his direct or indirect superior, his employer or a representative designated by the latter.[15]

However, a distinction must be made according to the size of the organization. For those with fewer than fifty employees, there is no specific procedure, and the alert can be addressed to the hierarchical superior, the employer or a referent. For larger structures, the decree requires the implementation of a specific procedure.[16]

The whistleblower may also make an external report. Decree 2022-1284 of 3 October 2022 sets out a list of authorities who may receive whistleblowers’ reports, in accordance with their respective powers. (i) The Defender of Rights, the judicial authority, and in particular the public prosecutor in the event of a report of a crime or offence, as well as (ii) an institution, body or organization of the European Union, may also be the addressee of an alert.[17]

The guide goes on to explain how the whistleblower’s alert will be handled, and the deadlines for the recipients of the alert to respond. Thus, for example, the authorities mentioned in the decree of 3 October 2022 (i.e., French Anti-Corruption Agency, French Competition Authority, French Financial Markets Authority[18]) are required to provide an initial response within three months. The guide specifies that the authority is not obliged to deal with the alert within this timeframe, but only to inform the whistleblower of the actions planned or already taken to assess the reality of the alert and remedy the situation reported. This three-month period may be extended to six months in view of the complexity of the case. In this case, the authority is required to inform the whistleblower of the extension, providing reasons for it.[19]

On the contrary, no time limit is set by the texts concerning the Defender of Rights, the judicial authority or the European Union institutions.[20] However, the guide specifies that the Law of 9 December 2016 authorizes the whistleblower to publicly disclose his alert without losing the protection he benefits due to his status as a whistleblower as long as no appropriate action has been taken by one of these authorities, and within a period of six months.[21]

If the whistleblower considers that the response to the alert does not seem appropriate or that no response has been provided, he may “consider making public” the alert.[22] However, he must respect the obligation of confidentiality protecting the person implicated. Failure to comply with this obligation constitutes a criminal offence punishable by two years’ imprisonment and a fine of 30,000 euros.[23]

The guide published by the Defender of Rights strengthens his role in protecting whistleblowers

The guide published by the Defender of Rights also recalls that it is his duty to inform whistleblowers of the rules and protection applicable to them, while dealing with the reports for which he is responsible.[24]

Throughout the guide, the Defender of Rights explains his role in providing guidance and support to whistleblowers and people close to them. He also clarifies the scope of protection to which those concerned are entitled. He also uses his guide to provide several practical tips for whistleblowers, to help them report allegations appropriately.[25]

On this last point, he indicates the need for the whistleblower to gather concrete evidence before making his report. It also specifies that when sending a paper report, it should be sent by registered letter with acknowledgment of receipt, using the double envelope system. This means that the envelope contained in the first envelope must be marked as “report of an alert”[26].

The Defender of Rights also sets out the specific rules applicable to certain professions, such as civil servants or employees or social and medico-social establishments or services. Distinctions are also made according to the subject of the alert. For example, the Defender of Rights distinguishes between alerts concerning financial matters and alerts concerning an employer’s products or manufacturing processes that present health or environmental risks. The aim is to provide the whistleblower with the best possible guidance and to inform him of the specific rules that may apply to his situation.[27]

In addition, the Defender of Rights has a key role in protecting whistleblowers, in that he can certify a person as a whistleblower. However, this certification can only be granted after the report has been filed. In this context, the whistleblower requests that the authority issue an opinion stating that he meets the conditions laid down by law for protection as a whistleblower.[28] However, this certification does not constitute a blank check for the judicial authority, which is not bound by the opinion of the Defender of Rights.[29]

In addition, at the whistleblower’s request, the Defender of Rights can protect him. He examines the request and may interview the persons involved. The institution’s investigators are bound by “strict professional secrecy”.[30]

The protection granted to whistleblowers by the Defender of Rights can take two different forms.[31]

First of all, the Defender of Rights can recommend that the perpetrator of the reprisals take measures, within a time limit set by the Defender, to restore the whistleblower’s rights, such as reinstatement or financial compensation.[32]

Although the Defender of Rights has no direct power of sanction, he does have a “right of follow-up” on the recommendations he makes. This means that the person concerned is obliged to inform him of the action taken on his recommendations. In the event of shortcomings, the Defender of Rights has the power to issue injunctions, enabling him to demand that the recommendation be implemented within a new timeframe that he sets.[33].

If no further action is taken by the respondent, the Defender of Rights may publish a special report revealing the identity of the respondent[34].

Lastly, this independent administrative authority can take the whistleblower’s case to court, i.e., present its observations and analysis of the case before the court to which the whistleblower has appealed to contest retaliatory measures (i.e., labor court, administrative court).[35]

Since the publication of the decree of 3 October 2022, the Defender of Rights has been “the external authority responsible for dealing directly with alerts in certain specific areas”.[36]

These areas concern (i) rights and freedoms in relations with State administrations, local authorities, public establishments and bodies entrusted with a public service mission; (ii) the best interests and rights of the child; (iii) discrimination; (iv) the ethics of persons engaged in security activities.[37]

The Defender of Rights can be contacted by post, by electronic form or by telephone.[38]

Once the matter has been referred to him, he must, as with other authorities, acknowledge receipt within seven days, and guarantee the integrity and confidentiality of the data collected from both the whistleblower and the person implicated. In addition, the whistleblower will be informed of the measures planned or taken to verify his or her allegations.[39]