Whistleblower Policy Malik Taiar

Phase 4: Verification and Processing

→ Detailed reference: DECRET_PROCEDURE.md - Section 2

VERIFICATION:

• Admissibility criteria defined (Art. 6 and Art. 8 I.A.)
• Reporter notification in case of inadmissibility provided
• Follow-up for non-compliant reports specified
• Follow-up for anonymous reports specified

PROCESSING:

• Written feedback within 3 months maximum provided
• Feedback content compliant (measures considered/taken + reasons)
• Reasoned closure provided (unfounded or moot allegations)
• Written closure notification to reporter provided

Phase 5: Confidentiality

→ Detailed reference: DECRET_PROCEDURE.md - Section 4

• Information integrity and confidentiality guaranteed
• Identity protection: reporter, persons concerned, third parties mentioned
• Access prohibited to unauthorized persons
• Prompt transmission to designated persons provided
• If oral: recording procedures defined
• Retention period limited to strict necessity

Phase 6: Dissemination and Information

→ Detailed reference: DECRET_PROCEDURE.md - Section 6

• Procedure disseminated with sufficient publicity
• Permanently accessible to eligible persons
• Complete information content (see Section 7 of decree)
• Information on external channels available

Phase 7: GDPR Compliance (CNIL Framework 06/07/2023)

→ Detailed reference: RGPD_CNIL.md

• Legal basis identified (legal obligation or legitimate interest)
• Purposes defined, no incompatible reuse
• Data minimization by phase (collection, investigation, post-decision)
• Anonymous reports possible, no re-identification
• Authorized users documented, access logged
• Disclosure rules followed (reporter: consent / subject: after substantiation)
• Retention periods defined by phase and communicated
• Data subject notification compliant (reporter at acknowledgment, subject within 1 month)
• Data subject rights guaranteed (access, objection, rectification, restriction)
• Security measures compliant (17 CNIL categories)
• Processing register updated
• DPIA completed (recommended)

Phase 8: Sector-Specific Requirements

→ Public sector → FONCTION_PUBLIQUE.md

• Coordination with Art. 40 CPP documented
• Designated officer informed of Art. 40 obligations

→ Duty of vigilance → VIGILANCE.md

• Mechanism established in consultation with representative unions
• Extended scope (subsidiaries, subcontractors, suppliers)
• External stakeholders eligible

→ Regulated sectors (financial, healthcare, etc.)

• Coordination with sector-specific obligations documented

The Three Reporting Channels (Art. 8 Sapin II Law)

┌──────────────────────────────────────────────────────────────────────────────┐
│  CHANNEL 1: INTERNAL REPORTING (Art. 8 I)                                    │
│  ────────────────────────────────────────                                    │
│  WHEN: Can be used directly, without prior condition                         │
│                                                                              │
│  ELIGIBLE PERSONS (Art. 8 I.A. 1° to 5°):                                    │
│  → Staff members (current or former)                                         │
│  → Job applicants                                                            │
│  → Shareholders, partners, voting rights holders                             │
│  → Members of administrative, management, supervisory bodies                 │
│  → External and occasional collaborators                                     │
│  → Contractors, subcontractors and their bodies/staff                        │
├──────────────────────────────────────────────────────────────────────────────┤
│  CHANNEL 2: EXTERNAL REPORTING (Art. 8 II)                                   │
│  ─────────────────────────────────────────                                   │
│  WHEN: Can be used in two ways                                               │
│    ✓ EITHER after making an internal report                                  │
│    ✓ OR directly (without going through internal)                            │
│                                                                              │
│  POSSIBLE RECIPIENTS:                                                        │
│  1° Competent authority (list in annex to Decree No. 2022-1284)              │
│  2° Defender of Rights                                                       │
│  3° Judicial authority (Public Prosecutor)                                   │
│  4° Competent EU institution, body or agency                                 │
├──────────────────────────────────────────────────────────────────────────────┤
│  CHANNEL 3: PUBLIC DISCLOSURE (Art. 8 III)                                   │
│  ─────────────────────────────────────────                                   │
│  WHEN: Protection granted only in the following cases                        │
│                                                                              │
│  CASE 1 (Art. 8 III 1°) - Ineffective reports:                               │
│    → After external report (preceded or not by internal)                     │
│    → AND no appropriate measure taken at deadline expiry                     │
│                                                                              │
│  CASE 2 (Art. 8 III 2°) - Serious and imminent danger                        │
│                                                                              │
│  CASE 3 (Art. 8 III 3°) - Risks related to external reporting:               │
│    → Risk of retaliation                                                     │
│    → OR impossibility of effective remedy                                    │
│                                                                              │
│  DEROGATORY CASE (Art. 8 III penultimate paragraph):                         │
│    → IMMINENT or MANIFEST danger to the public interest                      │
│                                                                              │
│  ⚠️ EXCLUSION: Cases 2°, 3° and derogatory do NOT apply if                   │
│     disclosure harms national defense/security                               │
└──────────────────────────────────────────────────────────────────────────────┘

NOTE: Since the Waserman Law (2022), whistleblowers can freely choose between internal and external channels. They are no longer required to go through internal channels first.

Whistleblower Definition (Art. 6 Sapin II Law)

WHISTLEBLOWER = Natural person who:

• Reports or discloses WITHOUT DIRECT FINANCIAL CONSIDERATION
• In GOOD FAITH
• Information concerning:
  • A crime or offense
  • A threat or harm to the public interest
  • A violation OR an attempt to conceal a violation of:
    • an international commitment
    • European Union law
    • a law or regulation

Exclusions (Art. 6 II): National defense secrets, medical confidentiality, judicial deliberation secrecy, investigation/inquiry secrecy, attorney-client privilege.

Facilitators (Art. 6-1): Natural or legal person under private non-profit law who assists the whistleblower.

Whistleblower Protections

→ Detailed reference: TEXTES_LEGAUX.md - Article 10-1

Civil and criminal immunity (Art. 10-1 I) if reasonable grounds to believe the report was necessary.

Prohibited retaliation measures (Art. 10-1 II): suspension, dismissal, demotion, transfer of duties, discrimination, harassment, blacklisting, etc.

Reversal of burden of proof (Art. 10-1 III): the employer must prove their decision was justified.

Automatic nullity of any act taken in breach of these protections.

Common Errors

Penalties and Risks

Reference Texts

Policy Drafting (Mode B)

Provided Template

IMPORTANT: The template must be used EXACTLY as provided. Only variable elements should be adapted to the client's situation. Do not rephrase, delete, or reorganize template clauses.

Drafting Workflow

STEP 1 — Collect Client Information

• Legal form and headcount
• Channels chosen (written, oral, both)
• Identity of designated officer(s)
• Reporting channel contact details
• Scope of eligible persons
• Coordination with other systems (duty of vigilance)

STEP 2 — Adapt the Template

• Open Template_Politique_Lanceur_Alerte.docx
• Complete ONLY the variable elements
• Do NOT rephrase existing clauses
• Do NOT delete sections
• Add the mandatory clause on external channels

Example wording to insert in the policy:

Independently of this system, any person may submit an external report
directly to the Defender of Rights, the judicial authority, or the
competent authority according to the relevant domain. The list of
external authorities is set by the annex to Decree No. 2022-1284 of
October 3, 2022, available at:
https://www.legifrance.gouv.fr/loda/id/JORFTEXT000046357368

STEP 3 — Verify Compliance → Use DECRET_PROCEDURE.md and TEXTES_LEGAUX.md to verify mandatory elements → Use RGPD_CNIL.md to verify GDPR compliance

STEP 4 — Add External Channel Information (Legal obligation - Art. 8 para. 3 of Decree No. 2022-1284)

Finalization

STEP 5 — Validation

• Have management review
• Consult the works council if applicable (≥ 50 employees)
• If duty of vigilance: consultation with representative unions

STEP 6 — Dissemination

• Choose dissemination channels (see Section 6 - Phase 6)
• Ensure permanent accessibility
• Train designated officers