Introduction

Scope of application

Compliance program

Protection of whistleblowers

Audit and sanctions

Rules arising from the Sapin II Law

EU law

French law

Rules derived from competition law

Sapin II Law/Competition

Scope ratione personae

Scope ratione materiae

Scope

Development of plan

Measures included in plan

Inclusion in management report

Vigilance plan

Injunctions

Civil liability

Sanctions

Duty of vigilance (devoir de vigilance)

CSR programs

Reporting

Communication

Reporting and communication

Judicial sanctions

Risk to reputation, strategy and stability

Corporate Social Responsability (CSR)

Middlenext Code

IFA Corpus

AFEP - MEDEF Code

Types

Principles of governance

Principles incorporating CSR values

Principles

Comply or explain

Binding force

Private codes of conduct

Compliance

Article 9, III of the Sapin II Law stipulates that disclosures may only be kept for as long as is strictly necessary and proportionate for their processing and for the protection of their authors, the persons they concern, and the third parties they mention, taking into account the time required for any further investigations. Data relating to disclosures may, however, be retained beyond this peri …

Duration of storage

Article 9, III of the Sapin II Law stipulates that disclosures may only be kept for as long as is strictly necessary and proportionate for their processing and for the protection of their authors, the persons they concern, and the third parties they mention, taking into account the time required for any further investigations. Data relating to disclosures may, however, be retained beyond this period, provided that the individuals concerned are neither identified nor identifiable.

When processed, personal data relating to disclosures is stored in compliance with the General Data Protection Regulation . To this end, the National Commission for Information Technology and Civil Liberties (Commission nationale de l'informatique et des libertés - CNIL) has updated its guidelines for the processing of personal data intended for the implementation of the whistle-blowing system , following the transposition of the European directive on the protection of whistleblowers , to which it is advisable to refer.

Regulation No 2016/679 of 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJEU L 119 of 4 May 2016, 1.

CNIL, 6 July 2023, Referential relating to the processing of personal data intended for the implementation of the alert system.

Directive No 2019/1937 of 23 October 2019 on the protection of persons who report violations of EU law, OJ L 305 of 26 November 2019, 17.

Compliance

79. Duration of storage

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les notions juridiques connexes

79. Duration of storage

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise