EU Whistleblower Protection Directive Versus Loi Sapin II

Jan Tadeusz Stappers and Jean-Jacques Quang, respective senior manager at WhistleB (NAVEX Global) and director at Ethicaline, analyse the EU’s new whistleblower protection directive and how well it maps onto existing French regulations.

EU Whistleblower Protection Directive

Starting in 2021, all 28 EU member states will have to meet minimum standards as provided by the EU Whistleblower Protection Directive.

By 17 December 2021, companies with 250 or more employees, private legal entities operating in the area of financial services and private legal entities vulnerable to money laundering or terrorist financing will be required to set up internal procedures to handle whistleblower reports. Entities governed by public law, with possible exceptions for municipalities with fewer than 10,000 residents or 50 employees, will also be covered by the new law. Legal entities with at least 50 but fewer than 250 employees have another two years after transposition to comply, which means they will have to be compliant by the end of 2023.

There is much work to do, with less than half of all EU member states currently having whistleblower protection legislation in place. Tens of thousands of organisations will need to set up new or revise their existing whistleblowing policies and systems.

The new directive also provides comprehensive guidance and provisions on how an effective whistleblowing channel should be implemented, pertaining to material scope, procedures for processing reports made, reporting sequence and penalties for non-compliance. Although the directive requires the EU member states to achieve a certain result, it leaves them free to choose how to do so. During the transposition period, each EU country must adopt measures to incorporate the minimum standards into national law in order to achieve the objectives set by the directive.

Although the directive requires the EU member states to achieve a certain result, it leaves them free to choose how to do so.

Comparison with current French Whistleblower Protection law

While most EU member states will have to start from scratch incorporating the new directive’s provisions into their national legislation, some countries, such as France, will need to adapt their existing whistleblowing law; known in France as Loi SAPIN 2.

The French Loi SAPIN 2, which was enacted in 2018, has been quite well integrated into the compliance landscape during the last couple of years, with a rather satisfying implementation rate amongst the top-tier private and public organisations. Mid-size and smaller organisations are also slowly but steadily deploying whistleblowing systems.

However, the new EU directive dictates that existing national laws are to be revised to ensure full compatibility with the directive’s provisions. In substance, the EU directive and the current French SAPIN 2 law are quite similar, broadly aiming at uncovering and reporting wrongdoings while protecting the whistleblower. However, some major aspects diverge.

Reporting sequence: 2-step approach vs 3-step approach

The current French regulation provides a much stricter control with regard to the gradual escalation sequence a whistleblower must follow when reporting a concern or making an allegation. SAPIN 2 requires following a 3-step approach when reporting suspected misconduct: 1) Internal organisation; 2) Regulatory bodies; 3) Public disclosure. Escalation is permitted when the internal organisation fails to properly address a whistleblowing report received within a reasonable period of time, and successive escalation. If the whistleblower fails to uphold the reporting sequence, they will not be granted legal protection.

The EU directive abandons the procedural hierarchy between internal and external reporting, having adopted a soft 2-step approach. In this approach, the whistleblower is encouraged to report internally first, but can also directly report to external bodies if the whistleblower:

• • has not received any response from the internal and/or external reporting channels within the set time frame;
  • has reasonable grounds to believe the breach constitutes an imminent danger to the public;
  • fears a risk of retaliation; or
  • believes it is unlikely that the wrongdoing would be effectively addressed due to the particular circumstances of the case.

In these situations, the information can be disclosed directly to the public while maintaining whistleblower protection.

Persons eligible for whistleblower protection

SAPIN 2 provisions grant protection status only to employees (and to a certain extent, external interim staff); while the new EU directive substantially enlarges the eligible population, encompassing individuals who assist the whistleblowers, as well as individuals and legal entities connected with the whistleblowers.

Source of knowledge

Currently, protection granted to whistleblowers under SAPIN 2 is limited to facts to which the whistleblower has personal knowledge. Under the new directive, protection may further be granted where a whistleblower reports infringements observed by a third party.

Penalties

France already provides for criminal sanctions for hindrance of and retaliation against whistleblowers; individuals involved may face up to two years’ imprisonment and fines of up to €30,000. Similarly, the new directive requires EU countries to establish effective, proportionate and dissuasive penalties as a deterrent against infringement of whistleblower rights and hindrance of the whistleblowing process.

The transposition phase ahead

Ever since the inception of the SAPIN 2 regulation on whistleblowing, there has been a continuous debate between NGOs pushing for less opacity and more corporate citizenship, and the corporate world advocating a rather “controlled” transparency. In funnelling the whistleblowing process with a stricter escalation sequence, SAPIN 2 tends to favour the latter; although it provides the opportunity to streamline and to qualify a report/an alert, rather than facing numerous unfounded allegations, with the subsequent reputational damage.

With the new EU directive transposition phase ahead, it is anticipated that the 2-step approach vs 3-step approach in the reporting sequence, and its impacts described above, will be intensively lobbied for and debated upon by both sides.

More generally, there currently seems to be a consensus on adapting the SAPIN 2 regulations, aiming at encouraging more and more whistleblowers to contribute and to report on a broad scope of wrongdoings. Research and debates, under the patronage of the “Defender of Rights” (an independent French national agency), have summarised the position and recommendations on the necessary evolution of the current regulations as follows:

• enlarging the population eligible for legal whistleblower protection (individuals, NGOs, trade unions…);
• deisolating whistleblowers during the process of coming forward and reporting;
• identifying national independent institutions (including subsequent funding) to support the whistleblowers in their reporting processes; and
• fostering communication and training to all bodies that are able to promote the use of a whistleblowing channel.

There is no doubt that the forthcoming EU directive transposition provides an appropriate and providential occasion to put a next-iteration and more mature phase of the whistleblowing principles into motion. The time is now for organisations to have their existing whistleblowing facilities assessed and extended where necessary, in order to comply with the new legal framework.