Law No.2016-1691 of 9 December 2016, known as "Sapin II", as well as its implementing decree, provide for a general whistleblowing regime, setting forth new obligations for companies, and designing specific protections for whistleblowers.

Sapin II also updates the French anti-corruption framework to reach the highest international standards in terms of fight against corruption.


What are the main obligations in relation to whistleblowing?

Obligations imposed on companies. The targeted companies are required to implement a general whistleblowing system in order to report situations or behaviors which are contrary to specific rules (see below the definition of "whistleblower" for the list of violations that may be reported).

Obligations imposed on the alert recipient. Specific confidentiality obligations are imposed by Sapin II on the alert recipient, who is required to keep the alert, the communicated information, the identity of the whistleblowers, as well as the identity of the targeted individuals confidential, failing which the recipient may face severe sanctions - up to two years of imprisonment and a criminal fine of up to €30,000 for individuals and €150,000  for legal entities.

Who is targeted?

According to Sapin II, general whistleblowing systems shall be implemented by entities governed by public or private law with at least 50 employees, state administrations, municipalities with more than 10,000 inhabitants, as well as some public institutions, departments and regions.

Sapin II also introduces the obligation to implement an internal whistleblowing system  in relation to corruption for companies with at least 500 employees, or belonging to a group of companies whose parent company has its registered office in France and which hires at least 500 employees (i), and whose turnover or consolidated turnover exceeds €100.000.000 (ii).

A single technical system for receiving the alerts can be implemented as long as rights and strict confidentiality concerning the identity of the whistleblower are protected as well as the communicated information and the identity of the targeted individuals.

What does Sapin II change?

A harmonized definition. Clearly inspired by the recommendations made by the Council of State in its press release of 13 April 2016, the new legal framework proposes a uniform definition of "whistleblowers", regardless of its scope. Sapin II defines whistleblowers as individuals - excluding legal entities - revealing or reporting, in a disinterested manner and in good faith, a crime, an offence, a violation of an international commitment, a law or regulation infringement, a serious threat or damage  to the general interest of which the individual has had personal knowledge.

Supervision and prioritization of reporting channels. Sapin II determines the alert recipients, by way of implementation of several reporting channels, on a step-by-step basis.

First, the alert shall be brought to the attention of the whistleblower’s direct or indirect supervisor, to its employer, or to the company's designated referent.

Second, if the recipient of the alert fails to take any steps to verify, within a reasonable period of time, its admissibility, it can be sent to a judicial authority, an administrative authority or to professional orders.

As a last resort, if the alert is not processed by the abovementioned bodies within three months, it may be made public.

In any case, in the event of serious and imminent danger or in the presence of a risk of irreversible damage, the alert may be brought directly to the attention of the judicial or administrative authorities or professional orders.

A multifaceted protection. The provisions of Sapin II allow for a wide whistleblower protection in two respects:

First, it provides protection against criminal liability for the whistleblower by stating that a person who violates a secret protected by law (e.g. secrecy of correspondence, etc.)  is not criminally liable if the disclosure is necessary and proportionate to the protection of the interests at stake, and intervenes in compliance with the reporting procedures set forth in Sapin II. However, it should be noted that whistleblowers acting in bad faith could be held liable under tort law and face disciplinary or criminal sanctions for malicious denunciation (up to five years of imprisonment as well as a criminal fine of up to €45.000).

However, these provisions are not applicable to matters, information or documents covered by national defence secrecy, medical confidentiality or attorney-client privilege.

Second, the Labour Code as amended now provides that a whistleblower who has reported an event in compliance with Sapin II cannot be excluded from a recruitment procedure, an internship application or a professional training period. Moreover, if the whistleblower is an employee, the Labour Code also provides that s/he may not be sanctioned, dismissed or subjected to a direct or indirect discriminatory measure.

Compliance with data protection law. Before the entry into force of the GDPR, the implementation of any whistleblowing scheme required an authorization from the French Data Protection Authority (the “CNIL”). Since the entry into force of the GDPR, authorizations are no longer required.

The CNIL has been working on the adoption of a new "Referential", setting up a set of rules to be complied with by any data controller wishing to implement a whistleblowing scheme. Any deviation from those rules shall be justified, and adequate measures to ensure the compliance of the processing shall be implemented.

Pending the Referential's definitive adoption, the former single authorization "AU-004" is still used by the CNIL as a guideline for the implementation of whistleblowing schemes.

Anti-corruption. In addition to provisions relating to whistleblowing, Sapin II also creates a new set of rules in relation to the fight against corruption.

In particular, it creates the French Anti-Corruption Agency ("AFA"), a new anti-corruption regulator which replaces the Central Corruption Prevention Department (Service central de prevention de la corruption).

Further, Sapin II strengthens the anti-corruption program to prevent and detect corruption with enhanced penalties, while expanding the reach of France’s anti-corruption laws in international corruption matters.

Finally, Sapin II allows corporate entities only -and not individuals- to enter into a judicial settlement of public interest (Convention judiciaire d’intérêt public) which would result in the dismissal of the charges notably for alleged acts of corruption in exchange for the legal entity to comply with certain obligations (payment of a fine, implementation of an anticorruption program and indemnification of the victim).