Whistleblowers: what does the law say?

You've certainly heard of Edward Snowden, Irène Frachon, Chelsea Manning, Julian Assange or Antoine Deltour.

These people all have one thing in common: they were alone and decided to take on a company or administration to expose its excesses. For example, Edward Snowden didn't hesitate to leak thousands of confidential NSA (National Security Agency in the United States) documents revealing mass surveillance programs.

In France, this phenomenon is rarer, but the legislator wanted to address this issue to protect them.

A ministerial circular of July 20, 2018 (following the Sapin II law on ethics in 2017) now specifies the procedure for collecting reports, their management and the guarantees offered to whistleblowers.

Here are the new procedures for the supervision of reports and their processing by the legislator.

What is a whistleblower?

A whistleblower is a "natural person who disinterestedly and in good faith discloses or reports a crime or offense, a serious and manifest violation of an international agreement regularly ratified or approved by France, a unilateral act of an international organization taken on the basis of such an agreement, the law or regulations, or a serious threat or prejudice to the general interest, of which he or she has personal knowledge."

In other words, it is a person who decides to appeal to public authorities and the media to report a danger, raise awareness of a criminal or unlawful act that they have discovered.

This could be behavior related to a company, a state, or an international organization.

There are whistleblowers in all fields: health, internal security, tax evasion, public finances, international relations, etc.

On July 20, 2018, a new circular further defined the status of whistleblowers.

The previous one, dating from 2016, only provided very vague details, implying some insecurity for them.

This leads some of them to live in secrecy for years, like Edward Snowden, who faces up to 30 years in prison in the United States and has been a refugee in Russia since 2013.

How is each case handled?

The new circular specifies that all companies with more than 50 employees must implement a procedure for collecting reports from staff. However, it remains quite vague on the specific provisions to be applied.

It takes place in four phases:

• The author addresses their report to their hierarchical superior, direct or indirect, to the employer or to any other referent within the company. Theoretically, an official alert recipient must be appointed.
• He must support his allegations with specific facts, and provide sufficiently tangible evidence.
• The company is required to handle each case within a « reasonable » timeframe, while maintaining the anonymity of the employee who made the report.
• Once the case is deemed admissible, the company must destroy any documents that could reveal the identity of the person who reported the issue. This must be done within 2 months of the start of the reporting procedure.

Also, the company is obligated to clearly communicate the existing procedure to all its employees.

In the public sector, there are three different procedures: internal reporting, external reporting, or public disclosure. Public disclosure should only be used as a last resort if the authorities haven't dealt with the report within 3 months.

Finally, in the event of serious and imminent danger, or in the presence of risks of irreversible damage, it is possible to contact the judicial authorities directly. This is also a viable option if the company does not comply with the processing procedure.

Almost 9 out of 10 employees say they are "likely" or "definitely" ready to report serious incidents in their company, according to a BVA/Cercle d'éthique des affaires/La Poste barometer in 2017.

What protections does the law offer whistleblowers?

The law now offers new guarantees to whistleblowers.

First of all, it benefits from a guarantee of total confidentiality.

The company is strictly prohibited from disclosing its name and must destroy all documents that could allow its identification within 2 months after the procedure is closed.

Secondly, you won't be held legally responsible if an alert violating professional secrecy is deemed admissible.

The judge has some discretion and can decide based on protecting the company's interests.

Finally, the whistleblower does not bear the burden of proof.

In other words, they just need to provide factual evidence to support the reported facts. However, it is up to the accused party to prove their innocence.

Thanks to these new rules, whistleblowers are better protected, and their emergence will certainly put an end to many additional abuses within society.

The European Union has also taken up this issue, with the European Commission drafting a new directive at the beginning of 2018.