Whistleblowers: the internal procedure for the collection and processing of alerts specified

Under the Waserman Act, which came into force on 1^er September 2022, strengthening whistleblower protection, the internal procedure for the collection and processing of reports issued by whistleblowers has just been defined. This procedure must be implemented by companies with at least 50 employees. The latter must establish this procedure in accordance with the rules governing the legal instrument which they adopt, after consulting the social dialog bodies.

For companies employing less than 250 employees, this procedure may be common to several other companies or to several businesses of the same group, subject to a corresponding decision by the competent bodies of each of them.

Receipt of the alert by any means

The internal procedure for the collection and processing of alerts provides the possibility to collect alerts by any means (written or oral).

Oral reporting may be done by telephone, by any voice messaging system and, depending on the choice of the employee, by means of a videoconference or a physical meeting organized no later than 20 working days after receipt of the request.

This report concerns events that have occurred or are “very likely” to occur within the company.

Information of the person making the report

The entity shall inform the reporting person in writing of the receipt of the report within 7 working days of its receipt. It is also free to request further information from the reporting person.

If applicable, the author of the alert must be informed of the reasons why his alert does not comply with the conditions of validity laid down in Article 6 and in A of I of Article 8 of the Law of 9 December 2016. The procedure should also indicate the follow-up given to alerts which do not comply with these conditions. It also specifies the follow-up given to anonymous reports.

Processing and closure of the alert

Where the allegations are found to be true, the entity shall remedy the subject matter of the report.

It shall provide the reporting person in writing with information on the measures envisaged or taken to assess the accuracy of the allegations and to remedy, where appropriate, the reported situation. The entity shall inform the reporting person of the reasons for such action. On these points, the company shall have a period of three months from the acknowledgement of receipt of the alert or, in the absence of acknowledgement of receipt, three months from the expiration of a period of seven working days after the alert.

It is also provided that the reporting person must be informed in writing of the closure of the report. This shall take place where the allegations are incorrect or unfounded or where the alert has become moot.

Competence and confidentiality

The procedure shall indicate the person(s) or department(s) designated to carry out the internal procedure for the collection and processing of alerts.

Such persons or services shall have, by virtue of their position or status, the competence to carry out that task. To this end, they must be adequately resourced and receive specific training that will be provided or funded by the company.

The procedure for collecting and processing alerts must respect the integrity and confidentiality of the information collected (identity of the person who made the alert, the persons concerned, etc.).

The communication to third parties of information collected shall only take place where necessary to process the alert.