Introduction

Scope of application

Compliance program

Protection of whistleblowers

Audit and sanctions

Rules arising from the Sapin II Law

EU law

French law

Rules derived from competition law

Sapin II Law/Competition

Scope ratione personae

Scope ratione materiae

Scope

Development of plan

Measures included in plan

Inclusion in management report

Vigilance plan

Injunctions

Civil liability

Sanctions

Duty of vigilance (devoir de vigilance)

CSR programs

Reporting

Communication

Reporting and communication

Judicial sanctions

Risk to reputation, strategy and stability

Corporate Social Responsability (CSR)

Middlenext Code

IFA Corpus

AFEP - MEDEF Code

Types

Principles of governance

Principles incorporating CSR values

Principles

Comply or explain

Binding force

Private codes of conduct

Compliance

The whistleblowing system may stipulate that the person making the report must first refer the matter to his or her line manager. The latter must be able to provide guidance and advice where necessary, unless he or she is the perpetrator of the behavior in question . The undertaking specifies the role of the line manager and ensures that the people in charge of handling the alert are trained to re …

Handling of alert

The whistleblowing system may stipulate that the person making the report must first refer the matter to his or her line manager. The latter must be able to provide guidance and advice where necessary, unless he or she is the perpetrator of the behavior in question . The undertaking specifies the role of the line manager and ensures that the people in charge of handling the alert are trained to respect confidentiality and avoid any conflict of interest. It also provides training for line managers.

The internal whistleblowing procedure must specify the various steps to be followed when making a report, how it is to be handled by the person to whom it is addressed, the rights of the persons concerned, and in particular their protection, as well as security and personal data retention measures . In particular, it designates the contact person functionally designated to receive alerts within the undertaking and, if different, the contact person in charge of processing them. Mention must also be made of the measures taken to guarantee the confidentiality of the identity of the author of the alert, of the facts that are the subject of the alert and of the persons targeted by the alert, including when verifications or the processing of the alert require communication with third parties. Any breach of confidentiality must be liable to disciplinary action . However, whistle-blowing must also be able to be addressed anonymously, and to this end, the system must enable exchanges with the author of the alert that preserve his or her anonymity .

The internal alert system must also specify how the recipient of the alert is to deal with it. In this respect, the procedures for accessing and exchanging information with the author of the alert must be specified, i.e., the channels for making the alert, as well as the conditions for transmitting information or documents. The alert may be filed via a dedicated e-mail address, management software, or even a specific ethical platform. It can also be submitted via the hierarchy. Whatever channel is chosen, it must be easily accessible to users. It must also specify the measures taken to inform the author of the alert, without delay, of the receipt of the alert, the time required to examine its admissibility, and the closure of the procedure.

When an alert reveals a potential breach of probity, an internal investigation must be carried out. The internal investigation procedure must be defined and formalized before it is launched, with due attention paid to both the choice of those involved in the investigation and the way it is carried out. In particular, this procedure must set out the criteria required to launch an investigation, and how it is to be carried out. In French Anti-corruption Agency (Agence française anticorruption - AFA)'s view, the people in charge of carrying out the investigation must be subject to strict confidentiality obligations. If this function is outsourced, regular checks must be carried out to ensure that the services provided by the selected service provider comply with confidentiality and data protection rules. In addition, the whistleblowing system must specify the conditions for the transmission of professional information and documents communicated by the whistleblower and likely to be exploited. The AFA urges the undertaking to be vigilant when it comes to gathering evidence or documents, particularly when the persons implicated by the alert may destroy incriminating data or documents .

Internal investigations are carried out by one or more qualified persons appointed by the undertaking's management. The latter must be kept informed of investigations into the most sensitive situations, with the exception of those in which it is itself implicated. Following the investigation, a report is drawn up setting out all the facts and evidence gathered, both incriminating and exculpatory, to establish or dispel the suspicion, as well as the method used, and deciding on the action to be taken on the report. If the suspicions appear to be sufficiently substantiated, the report must be forwarded to the governing body, or to the supervisory body if the latter is involved, so that it can decide what action to take. Where there is evidence of behavior contrary to the anti-corruption code of conduct, the disciplinary sanctions provided for in such cases must be applied by the governing body or its delegate, without prejudice to any legal action that may be taken.

The reports received must be used to update the risk map, while respecting the confidentiality guaranteed by the system, and to draw conclusions regarding improvements to be made to the elements of the anti-corruption prevention and detection system (training plan, code of conduct, assessment of the integrity of third parties).

As soon as the system for the internal collection and management of professional alerts provided for in Article 17 of the Sapin II Law involves the processing of personal data relating to an identified or identifiable natural person, in particular the author of the alert and the persons targeted by the alert, it is necessary for the undertaking to ensure its compliance with the provisions of the General Data Protection Regulation (GDPR)  and the French Data Protection Law of 6 January 1978  and for the procedure to indicate the measures taken to this end . To help undertakings adapt their systems to the rules on personal data protection, the French Data Protection Authority (Commission nationale de l'informatique et des libertés - CNIL), adopted a non-binding reference framework in 2019, which it updated in 2023 , containing recommendations relating, in particular, to the purposes of processing, the conditions for receiving alerts, informing data subjects, the length of time personal data is kept, or the security measures to be provided.

AFA recommendations designed to help public and private legal entities prevent and detect corruption, influence peddling, misappropriation of public funds and favoritism of 4 December 2020, JORF of 12 January 2021, pts 57 and 257.

Regulation No 2016/679 of 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJEU L 119 of 4 May 2016.

Law No 78-17 of 6 January 1978 on data processing, data files and individual liberties, JORF of 7 January 1978.

AFA recommendations, pt 267. See also, for illustrations of CNIL control of devices implemented by certain companies, CNIL, 8 February 2018, LawLex202200001716JBJ and 5 April 2018, LawLex202400003029JBJ.

Deliberation 2023-064 of 6 July 2023, repealing Deliberation 2019-139 of 18 July 2019, adopting a reference framework for the processing of personal data intended for the implementation of a professional alert system and adopting a reference framework for the processing of personal data intended for the implementation of a professional alert system, JORF of 21 July 2023.

Compliance

50. Handling of alert

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

50. Handling of alert

Demandez un accès gratuit au contenu exclusif Livv – juristes d’entreprise

Les décisions de justice citées dans ce paragraphe :

Les notions juridiques connexes

Demandez un accès gratuit
au contenu exclusif Livv – juristes d’entreprise