Privacy & Information Security Law Blog

On December 10, 2019, the French Data Protection Authority (the “CNIL”) published the final version of its standard (“Referential”) concerning the processing of personal data in the context of whistleblowing hotlines. The Referential on whistleblowing hotlines was adopted following a public consultation launched by the CNIL on April 11, 2019. It replaces the CNIL’s Single Authorization AU-004 decision regarding such data processing, and anticipates certain changes introduced by the EU Directive on the protection of whistleblowers (Directive (EU) 2019/1937 of October 23, 2019), which EU Member States will have to implement into their national laws by December 17, 2021. The CNIL also published a set of questions and answers (“FAQs”), which aim to answer some practical questions that the CNIL are regularly asked regarding the operation of a whistleblowing hotline.

Background

Following the 2018 update to the French Data Protection Act in light of the EU General Data Protection Regulation (the “GDPR”), the CNIL was granted the power to issue Referentials. These Referentials are not compulsory; they are mainly intended as guidance for carrying out specific data processing activities under the GDPR. However, companies that operate a whistleblowing hotline in France in compliance with the CNIL’s Referential on whistleblowing hotlines can be confident that they comply with the GDPR and the French Data Protection Act. The Referential on whistleblowing hotlines will also aid companies in carrying out a data protection impact assessment (“DPIA”), which is required by the CNIL for the operation of a whistleblowing hotline. Companies that do not comply with the Referential on grounds relating to their particular situation will need to demonstrate why they need to depart from it and take all appropriate measures to ensure compliance with the GDPR and the French Data Protection Act. In addition, companies will have to comply with all other applicable laws, including French labor law and specific laws such as the French law of December 9, 2016, regarding transparency, the fight against corruption and the modernization of the economy, also known as the “Sapin II Law.” In particular, Article 8 of the Sapin II Law requires companies with at least 50 employees in France to implement a “general” whistleblowing hotline allowing employees and external and occasional collaborators (such as consultants/contractors) to report serious facts listed in that law. Article 17 of the Sapin II Law further requires companies with at least 500 employees in France (or companies that belong to a group headquartered in France and whose parent company has at least 500 employees), and with a (consolidated) turnover of more than €100 million, to implement an internal whistleblowing hotline allowing their employees to report behavior or situations that may constitute a violation of the company’s code of conduct with respect to bribery or influence peddling. Companies may implement a single whistleblowing hotline that allows whistleblowers to report various types of issues to comply with their different legal obligations and/or because they decide—on their own initiative—to allow reporting on these issues. Irrespective of the scope of their whistleblowing hotline, companies will process personal data when operating the hotline. The Referential on whistleblowing hotlines only relates to the processing of personal data in that particular context.

Main Changes in the Referential on Whistleblowing Hotlines

We have summarized the key changes introduced by the Referential on whistleblowing hotlines below.

• Scope of the Referential: The Referential applies to all types of whistleblowing hotlines. This includes (1) whistleblowing hotlines regulated by a specific French law that companies have the obligation (or choose) to implement (even if they do not meet the employee and/or turnover thresholds provided in the law), and (2) whistleblowing hotlines that are not contemplated by a specific French law and therefore are implemented on the company’s own initiative to combat improper or unethical behaviors in light of their internal rules (e.g., code of ethics or internal regulations). The Referential sets a single set of data protection rules that cover all these whistleblowing systems.
• Data Retention: The Referential on whistleblowing hotlines clarifies that, once a report has been investigated, personal data relating to a report must be erased or anonymized within two months of the conclusion of the investigation, where no action was taken on that report. The term “action” is to be interpreted broadly and may include the adoption or change of internal rules, a reorganization of the company’s operations or services, the imposition of disciplinary measures or the initiation of court proceedings. This means that personal data relating to a report may be kept after the two month period, even if no disciplinary or court action is undertaken.
• Notice to the Whistleblower: In addition to (1) the general privacy notice that should be provided to all potential users of the whistleblowing hotline and (2) the specific notice to the incriminated person, the Referential requires the provision of a specific notice to the whistleblower as follows:
  • the whistleblower must receive the information required under Article 13 of the GDPR at the beginning of the collection of their report (e.g., by displaying some privacy language on the web reporting form before the whistleblower fills in the form);
  • once a report has been submitted, the whistleblower must receive an acknowledgment of receipt to enable them to benefit from a specific protection regime, where relevant. This acknowledgment of receipt must indicate the time and date when the report was submitted. It also must summarize (1) all the information that has been reported (including the questions asked and the responses provided by the whistleblower, if the information was collected through a questionnaire), and (2) the documents the whistleblower has attached to their report; and,
  • when the company (acting as the data controller) decides on the follow-up action(s) to be taken, the whistleblower must be informed of that decision.

View the CNIL’s Referential and FAQs on whistleblowing hotlines (in French).