France's whistleblower law, the loi Waserman

The loi n° 2022-401 of 21 March 2022, known as the loi Waserman, is the law that protects whistleblowers in France today. It does not create a separate regime. It rewrites the 2016 Sapin II law and brings EU Directive 2019/1937 into French law. The new rules have been in force since 1 September 2022. They set clear duties for companies and public bodies. Below we explain who is covered, what you must prepare, and what the penalties are.

Who must comply with the law?

In the private sector, the duty starts at 50 employees. Every private body that employs 50 or more staff must set up an internal channel to collect and handle reports. Firms in regulated sectors, such as banking and finance, are covered under the EU Directive whatever their size.

In the public sector, the duty is broad. It reaches central government and public bodies with at least 50 staff. Towns under 10,000 people and their bodies are let off. They can still hand the job to the territorial civil service management centre, whatever their headcount.

Mid-sized bodies can pool their work. Firms with fewer than 250 staff can share their reporting procedures. A group can also run one channel across several of its companies. The décret n° 2022-1284 of 3 October 2022 sets out the detail of these rules.

How do you set up the internal reporting channel?

The internal channel is still the first move. The law asks you to use it when the breach can be solved inside the body and there is no risk of payback. You set the procedure up after talking to the staff representative bodies. With no procedure in place, the report goes to the line manager, the employer, or a referent they name.

The 3 October 2022 décret frames the channel. It must, among other things:

• give guarantees of independence and impartiality in how reports are handled;
• take in anonymous reports as well as named ones;
• keep the whistleblower, the people named, and any third parties confidential;
• handle data under the GDPR and keep it only as long as needed;
• be open to being run by a third party, such as a specialist provider.

The law sets clear deadlines. You must acknowledge the report within 7 days. You must then tell the whistleblower what steps are planned or taken within at most 3 months. That deadline is about the feedback, not the end of the inquiry.

The procedure is not the tool. The text describes the process. But the full system has to stay reliable, keep data safe, and control who has access. Wemoral, as a whistleblowing system, meets those needs. It saves you from building a tool from scratch. If you start from zero, we help you with a whistleblowing policy template and a guide to set up the channel.

What can be reported?

The scope of an alert is wide. The whistleblower can report a crime or an offence, a threat or harm to the general interest, and a breach, or an attempt to hide a breach, of:

• an international commitment ratified by France, or an act of an international body based on it;
• European Union law;
• French statute or regulation.

Some secrets stay out of the regime. The law leaves out information covered by national defence secrecy, medical confidentiality, the secrecy of court rulings, the secrecy of an inquiry or investigation, and lawyer-client privilege. For the rest, the alert is protected as long as the whistleblower acts in good faith and gets no direct financial reward.

Who can be a whistleblower?

Not just the worker on the payroll. Under article 6, a whistleblower is a natural person who reports or discloses, in good faith, information they learned about through their work. We explain it in full in our piece on who is a whistleblower. The internal route is open to:

• staff members, former workers, and job candidates;
• shareholders, partners, and holders of voting rights;
• members of the board or of management and supervisory bodies;
• external and occasional contributors;
• the body's contractors and subcontractors, and their staff.

Protection reaches beyond the whistleblower. Article 6-1 extends it to facilitators, who can now be non-profit legal persons such as an association or a trade union, to natural persons linked to the whistleblower, and to legal entities they control. Their close contacts and colleagues who risk payback are covered too.

How is the whistleblower protected?

Protection against retaliation is the heart of the law. It starts from the report or public disclosure. One condition applies. The whistleblower must have had fair reason to believe, at the time, that the information was true and that it fell within the law.

Ban on retaliation

The list of banned reprisals is open-ended. It runs to fifteen measures: dismissal, suspension, demotion, a refused promotion, a transfer of duties, a pay cut, suspended training, a negative review, financial sanctions, intimidation, harassment, freeze-outs, discrimination, a non-renewed contract, harm to your name, blacklisting, or even an abusive referral for medical treatment. The ban also covers the threat or attempt to use any of them.

Any act of retaliation is void from the start. The law strips it of effect. The person who suffers these measures can have them set aside and, where it applies, claim payment for the harm.

Reversal of the burden of proof

The whistleblower does not have to prove the retaliation. Once they put forward facts that suggest they reported by the book, it is up to the employer to show the decision rests on grounds unrelated to the report.

"Once the claimant puts forward facts suggesting that they reported or disclosed information in line with articles 6 and 8, it falls to the defendant to prove that its decision is duly justified."
Article 10-1, III of loi n° 2016-1691, as amended by the law of 21 March 2022

Civil and criminal immunity

A good-faith whistleblower does not answer for the alert. They are not liable in civil law for harm caused by their report if they had fair reason to believe it was needed. They get the criminal immunity set out in article 122-9 of the Criminal Code. Above all, they can no longer be prosecuted for taking or removing documents they accessed lawfully, as long as they report or disclose them in line with the law.

The three reporting routes

The law sets out three routes for the same alert:

The 3 October 2022 décret names the external authorities. It lists them by sector, and they include the financial markets regulator and the French Anti-Corruption Agency. The Défenseur des droits (the national ombudsman) plays a pivotal role. It steers the whistleblower to the authority best placed to handle the report and gets a yearly account of what each one did. Free choice between the internal and external channels is the big change of 2022: the old Sapin II rule made you report inside the firm first.

What penalties and support does the law set?

Blocking an alert is a crime. Anyone who gets in the way of a report faces one year in prison and a 15,000 € fine. Leaking the whistleblower's identity carries two years in prison and a 30,000 € fine.

The law also targets gag lawsuits. When an abusive or delaying lawsuit is aimed at a whistleblower to silence them, the judge can hand down a civil fine raised to 60,000 €, on top of any damages owed to the target of that lawsuit. The judge can also order the ruling to be posted or published.

The whistleblower can also get support. The labour court can order the employer to top up their personal training account. The external authorities can put psychological support in place and grant temporary financial aid when the whistleblower's finances have badly worsened because of their report.

The French regime took effect on 1 September 2022. So the companies and public bodies it covers should already have a working internal channel. If yours does not, every month that passes raises the risk. To see where France sits among its neighbours, browse our list of whistleblowing laws by country.