Whistleblowing: Revised French Procedures: The French Data Protection Authority recently issued revised procedures concerning the implementation of whistleblowing policies

Sullivan & Cromwell LLP - December 23, 2010

On December 8, 2010, the French Journal Officiel published a revised expedited approval procedure for whistleblowing policies, as adopted by the French Data Protection Authority (“Commission nationale de l’informatique et des libertés” or “CNIL”). Under both the original and the revised expedited approval procedure, companies do not need to individually obtain the French Data Protection Authority’s pre-approval of their whistleblowing procedures provided that they file a statement with the CNIL to the effect that their procedures comply with the terms of the expedited approval procedure.

This revised expedited approval procedure takes into account the decision of the French Cour de cassation of December 8, 2009 and restricts the scope of the complaints covered by the French Data Protection Authority’s expedited approval procedure.

The scope of the revised procedure is limited to:

  • complaints relating to the areas of finance, accounting, banking and anti-corruption pursuant to (i) internal control procedures mandated by French legislative or regulatory requirements, or (ii) the whistleblowing requirements under Section 301(4) of the Sarbanes-Oxley Act of July 31, 2002 (these were areas covered by the previous procedure);
  • whistleblowing procedures relating to (i) the finance, accounting, banking and anti-corruption areas implemented pursuant to the whistleblowing requirements of the Japanese Financial Instrument and Exchange Act of June 6, 2006, or (ii) policies against anti-competitive practices within the relevant entity (these are new areas that may benefit from the revised expedited approval procedure).

Complaints relating to actions which could harm the vital interests of the company or the physical or moral integrity of an individual employee are no longer mentioned in the revised expedited approval procedure, and should be suppressed from the scope of existing whistleblowing policies applicable in France in order for such policies to continue to benefit from the expedited approval procedure.

Companies having drafted their whistleblowing policies under the French Data Protection Authority’s former expedited approval procedure should review such policies to ensure compliance with the revised procedure.