French Supreme Court Rules on SOX Whistleblowing Procedures in France

Issues have arisen from time to time regarding potential conflicts between the whistleblowing requirements of the Sarbanes-Oxley Act of 2002 and the provisions of French privacy and worker protection laws. In a recent decision, the French Supreme Court, the Cour de cassation, has addressed such an issue for the first time.

On December 8, 2009, the Supreme Court, in overturning the decision of a lower court, invalidated the whistleblowing procedures set forth in the Code of Business Conduct of Dassault Systèmes (“Dassault”). The Court ruled that the provisions (i) were too broad in that they applied not only to complaints relating to the finance, accounting, banking and anti-corruption areas, but also to whistleblowing relating to actions which could harm the vital interests of Dassault or the physical or moral integrity of an individual employee, and (ii) did not provide in sufficient detail information on French legal protections relating to whistleblowing, such as the right of an individual who is the subject of a whistleblowing complaint to be properly notified of the nature of the complaint and the right of persons identified in a complaint to access and rectify such complaint. The Supreme Court also invalidated specific provisions of Dassault’s Code of Business Conduct related to the treatment of confidential information by employees (this aspect of the decision is not discussed in this memorandum).

In other instances, including as recently as on November 5, 2009, French lower courts have also ruled against the validity of SOX whistleblowing procedures on a variety of grounds, including overly broad scope, absence of appropriate consultation with employee representative committees or health and safety committees, and the risk of slanderous denunciations in the workplace. The Supreme Court decision and other case law illustrate the caution required when implementing whistleblowing procedures in France.

Background

In 2005, decisions of the French Data Protection Authority, the Commission nationale de l’informatique et des libertés (the “CNIL”), and several French courts ruled that the broad and anonymous whistleblowing procedures of several companies, adopted in a large part in response to the requirements of the Sarbanes-Oxley Act of 2002 (“SOX”), were contrary to French law n° 78-17 of January 6, 1978, as amended (the “French Data Protection Act” or the “Act”). The Act transposes into French law the European Union Directive 95/43/CE on data protection applicable to member states of the European Economic Area (“EEA”), which harmonized data protection laws throughout the EEA.

Prompted by such decisions, on December 8, 2005 the CNIL adopted an expedited approval procedure (the “Expedited Approval Procedure”) for whistleblowing procedures. To benefit from the Expedited Approval Procedure, the scope of the whistleblowing procedure must relate to alleged violations in a limited number of legitimate areas (the “Core Areas”), such as finance, accounting, banking and anti-bribery, and the procedures must be in response to (i) French legislative or regulatory internal control requirements, or (ii) the whistleblowing requirements of SOX.

Under the Expedited Approval Procedure, companies do not need to obtain the CNIL’s pre-approval of their whistleblowing procedures provided that they file with the CNIL a declaration that such procedures comply with the Expedited Approval Procedure. Whistleblowing procedures that are broader in scope than the Core Areas covered by the Expedited Approval Procedure, or otherwise do not comply with such Expedited Approval Procedure, need to be assessed by the CNIL on a case-bycase basis.

Decision Of The French Supreme Court

Prior to implementing the whistleblowing procedures contained in its Code of Business Conduct, Dassault notified the CNIL that it opted for the benefit of the Expedited Approval Procedure. The Federation of Metallurgical Workers, a union at Dassault, subsequently attacked the Code of Business Conduct on the grounds that, among other things, its whistleblowing procedures violated the terms and conditions of the Expedited Approval Procedure. The Court of Appeal ruled against the union and the case was brought before the Supreme Court.

On December 8, 2009, the Supreme Court ruled that Dassault’s whistleblowing procedures as applicable in France and set forth in its Code of Business Conduct were invalid, in particular on the grounds that:

• 1. The scope of Dassault’s procedures was overly broad in covering reporting of alleged misconduct that extended beyond violations in the Core Areas covered by the Expedited Approval Procedure, i.e., finance, accounting, banking and anti-bribery.The language of the Expedited Approval Procedure contemplates that complaints that are not directly related to the Core Areas may nevertheless be communicated to personnel specialized in the treatment of whistleblowing complaints if a vital interest of the company or the physical or moral integrity of one of its employees is at stake. On their face and as summarized by the Supreme Court, the Dassault whistleblowing procedures appear merely to recite such a possibility. The Supreme Court, however, sanctioned Dassault for such a statement in its whistleblowing policy. Pending further guidance by the French authorities, it is advisable to delete from the scope of whistleblowing policies applicable in France any area other than the Core Areas.
• 2. The information communicated to Dassault employees did not inform them in sufficient detail of the legal protections related to whistleblowing contained in the Expedited Approval Procedure such as (i) the right of the individual who is the subject of a complaint to be properly notified of its nature and (ii) the right of access and rectification by persons identified in a complaint. Although such rights are set out in full in the Expedited Approval Procedure, the Supreme Court ruled that they must also be indicated in the whistleblowing policy itself.