Is there room for improvement in the French law on whistleblowers in the wake of the transposition of the European Directive of October 23, 2019 on whistleblowers protection?

Whistleblowers legal protection being widely fragmented from one Member State to another, the European Union adopted on October 23, 2019 a new Directive (the “Directive”)1 offering a European level protection to persons who report breaches of EU law.

France which needs to transpose this Directive within two years, did not wait long to acknowledge the changes introduced by the Directive. Indeed, a first Bill on the adaptation of French law to European provisions has already been presented to the French Parliament and is currently in the hands of the Commission for Constitutional Laws, Legislation and General Administration of the Republic of France2.

However, this text is not final, and amendments are likely to be made in the future. In fact, in a press release dated June 4, 2020, the French Defender of Rights (“Défenseur des Droits”)3 has called for an “ambitious transposal” of the Directive4.

I. A possible extension of the French scope of reporting

While French law on whistleblowing mentions report of “”, the Directive covers all violations related to Union acts in ten areas (i.e. public procurement, environmental protection, public health, consumer protection, protection of privacy and personal data5) and breaches affecting the financial interests of the Union. Each Member State will be able to extend the material scope defined by the Directive6 giving leeway to France to extend the scope of areas or acts that can be reported.

In that vein, the Defender of Rights suggests that the French government takes the opportunity of the transposition to introduce a specific whistleblowing mechanism for national security and defence issues7.

In addition, while French law limits whistleblowers protection to workers, the Directive extends the scope of the protection to a wider public. Article 4 of the Directive indeed provides that whistleblowers can be any persons who work or worked in the public or private sector and who have obtained information on violations in a professional context, whether they are employees, self-employed workers, shareholders or members of management or management bodies, monitoring of companies, volunteers or trainees8.

The Directive also grants protection to facilitators and third parties who are close to the authors of reports and who incur, by extension, risks of reprisals9. The Defender of Rights press release has called for a clarification of the role legal entities (such as NGOs and unions) may play in the whistleblowing procedure.

II. A possible reinforcement of the French whistleblowers protection framework

Unlike French law, the Directive does not require the whistleblower to act in a disinterested manner10. Hence, in order to benefit from the protective regime, the author of the report must have had “reasonable grounds to believe that the information reported was true at the time of the report” and be sure that, “this information fell within the scope of the Directive”11. Those conditions tend to ensure that the whistleblower makes a “responsible denunciation, driven by the sincere intention to preserve the public interest12” and aims to avoid “malicious, fanciful or abusive” reports. The European system also provides protection for persons in good faith who report an inaccurate violation13.

The Directive provides for internal and external reporting channels and encourages the primary use of internal channels “where the breach can be addressed effectively internally and where the reporting person considers that there is no risk of retaliation14.” The implementation of such internal whistleblowing systems is mandatory for companies over fifty employees and for cities of more than ten thousands inhabitants15.The Directive does not, however, prioritize internal reporting channels16.

According to the Defender of Rights, the transposal of the Directive should enable the consolidation of French reporting channels by strengthening the monitoring of the effective implementation of procedures for collecting alerts as well as designating external competent bodies to handle the processing of reports.

Whistleblowers’ anonymity must be guaranteed17. The principle arises from the duty of confidentiality binding entities and authorities collecting the alerts. Hence, the whistleblower’s identity or the information that could make it possible to identify her or him cannot, except within strictly limited exceptions, be disclosed without her or his consent. The Directive leaves the choice to the Member States to accept or not anonymous alerts18. This is not a major change in France since article 9 of the law Sapin II already requires “strict confidentiality on the identity of the reporting parties19”. The Directive requires that whistleblower’s protection measures explicitly prohibit reprisals and threats. Supporting measures to assist those who may be persecuted20, such as information and advice on remedies or even legal assistance, must also be implemented21. Each Member State is free to provide for financial assistance and psychological support measures for whistleblowers who face legal action22. Such provision was similarly discussed before the adoption of the law Sapin II, but was finally rejected by the Constitutional Council (Conseil Constitutionnel)23.

The European Directive on the protection of persons who report breaches of Union law clearly shows that the Sapin II law whistleblower protective framework is well advanced. The transposition is still an opportunity to go further by extending the scope of areas and acts that may be reported and by reinforcing the protective measures for whistleblowers.

  1. Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019L1937&rid=4
  2. Bill for an effective protection of whistleblowers n°2600, http://www.assemblee-nationale.fr/dyn/15/textes/l15b2600_proposition-loi.
  3. The French Defender of Rights is a constitutional independent institution created in 2011. It has been entrusted with two missions: to defend people whose rights are not respected and to ensure equal access to rights for all.
  4. Press release of the French Defender of Rights, June 4 2020, https://www.defenseurdesdroits.fr/sites/default/files/atoms/files/ddd_cp_transposition-directive-lanceurs-d-alerte_04-06-2020.pdf.
  5. Article 2 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law (“1. This Directive lays down common minimum standards for the protection of persons reporting the following breaches of Union law: (a) breaches falling within the scope of the Union acts set out in the Annex that concern the following areas: (i) public procurement; (ii) financial services, products and markets, and prevention of money laundering and terrorist financing; (iii) product safety and compliance; (iv) transport safety; (v) protection of the environment; (vi) radiation protection and nuclear safety; (vii) food and feed safety, animal health and welfare; (viii) public health; (ix) consumer protection; (x) protection of privacy and personal data, and security of network and information systems; L 305/34 EN Official Journal of the European Union 26.11.2019 (b) breaches affecting the financial interests of the Union as referred to in Article 325 TFEU and as further specified in relevant Union measures; (c) breaches relating to the internal market, as referred to in Article 26(2) TFEU, including breaches of Union competition and State aid rules, as well as breaches relating to the internal market in relation to acts which breach the rules of corporate tax or to arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law”).
  6. Article 2 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law (“This Directive is without prejudice to the power of Member States to extend protection under national law as regards areas or acts not covered by paragraph 1”).
  7. https://www.defenseurdesdroits.fr/sites/default/files/atoms/files/ddd_cp_transposition-directive-lanceurs-d-alerte_04-06-2020.pdf.
  8. Article 4 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law (“1. This Directive shall apply to reporting persons working in the private or public sector who acquired information on breaches in a work-related context including, at least, the following: (a) persons having the status of worker, within the meaning of Article 45(1) TFEU, including civil servants; (b) persons having self-employed status, within the meaning of Article 49 TFEU; (c) shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members, as well as volunteers and paid or unpaid trainees; (d) any persons working under the supervision and direction of contractors, subcontractors and suppliers. 2. This Directive shall also apply to reporting persons where they report or publicly disclose information on breaches acquired in a work-based relationship which has since ended. 26.11.2019 EN Official Journal of the European Union L 305/35 3. This Directive shall also apply to reporting persons whose work-based relationship is yet to begin in cases where information on breaches has been acquired during the recruitment process or other pre-contractual negotiations. 4. The measures for the protection of reporting persons set out in Chapter VI shall also apply, where relevant, to: (a) facilitators; (b) third persons who are connected with the reporting persons and who could suffer retaliation in a work-related context, such as colleagues or relatives of the reporting persons; and (c) legal entities that the reporting persons own, work for or are otherwise connected with in a work-related context”).
  9. Article 4 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  10. Article 6 of the Law n° 2016-1691 of December 9, 2016,
  11. Article 6 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  12. Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee, Strengthening whistleblower protection at EU level, p. 9, https://ec.europa.eu/info/sites/info/files/placeholder_10.pdf.
  13. Communication from the Commission to the European Parliament, the Council and the European Economic and Social Committee, Strengthening whistleblower protection at EU level.
  14. Article 7 2. of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  15. Article 8 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law
  16. Article 10 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  17. Article 2.2 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  18. §34 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law (“Without prejudice to existing obligations to provide for anonymous reporting by virtue of Union law, it should be possible for Member States to decide whether legal entities in the private and public sector and competent authorities are required to accept and follow up on anonymous reports of breaches which fall within the scope of this Directive. However, persons who anonymously reported or who made anonymous public disclosures falling within the scope of this Directive and meet its conditions should enjoy protection under this Directive if they are subsequently identified and suffer retaliation”).
  19. Article 9 of the Law n° 2016-1691 of December 9, 2016 (“The procedures for collecting alerts, under the conditions mentioned in Article 8, shall ensure strict confidentiality on the identity of the reporting parties, of the persons on whom the alert is based and of the information collected by all the recipients of the alert. Information likely to identify the person issuing the alert shall not be disclosed, except to the judicial authority, and with the consent of that person”).
  20. Article 21.1 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  21. Article 20.1 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  22. Article 20.1 of the European Directive 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report breaches of Union law.
  23. Loi Sapin 2 : un contrôle exigeant du Conseil constitutionnel” Cons. const., 8 déc. 2016, n° 2016-740 DC, M-C de Montecler, December 13, 2016 Dalloz actualités.