ANALYSIS: French Appeals Court’s Suspension Of U.S. Company’s Whistleblowing Scheme Despite CNIL Approval: Reasons And Implications
By Olivier Proust, of Hunton & Williams LLP, Brussels.
On September 23, 2011, the Labor Chamber of the Caen Court of Appeals upheld a decision suspending a whistleblowing scheme implemented by Benoist Girard, a subsidiary of the U.S. group Stryker, even though the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), had inspected and approved the scheme before its implementation (see WDPR, October 2011, page 19).
The Court’s reasons for suspending the whistleblowing scheme are mainly based on the company’s failure to properly inform the employees collectively (through the Works Council) and individually, and the subsequent violation of several labor law provisions.
This decision illustrates how whistleblowing schemes may trigger the application of multiple laws (e.g., privacy, data protection, labor, criminal). In the context of whistleblowing, complying with different laws may be challenging for companies, particularly when such laws conflict with one another.
In this decision, it is interesting to note that, although the CNIL considered the whistleblowing scheme to be compliant with data protection law, the Court ruled that it did not comply with labor law.
A Whistleblowing Scheme Must Be Transparent Vis-à-Vis the Employees and Their Representative Bodies
In this decision, the Court considered that the employees of the French subsidiary had not received proper information regarding the whistleblowing scheme and, in particular, were not properly informed about their privacy rights (i.e., right to access and rectify their personal data) both in the company’s internal rules and in prior notices communicated to them.
However, the main reason for suspending the whistleblowing scheme was the fact that the company had not properly consulted the employee representative bodies (i.e., the Works Council and the Employees’ Hygiene & Safety Committee) before implementing the finalized version of its whistleblowing scheme.
Under French labor law, there are a number of circumstances in which companies are legally required to consult with the Works Council regarding the processing of personal data in the workplace. Specifically, companies must inform the Works Council about their processing activities involving employee data. The Works Council must also receive prior notice of, and be consulted on, any introduction of new technologies to the workplace that may have an impact on the working conditions, and any measure or technique that an employer intends to implement for the purpose of monitoring the employees’ activities.
In France, whistleblowing schemes are generally considered to be potentially invasive upon the employees’ privacy, and thus companies are required to inform the Works Council and obtain its opinion before implementing such a scheme. Failure to comply with these requirements constitutes an obstruction to the Works Council’s prerogatives, which may be criminally sanctioned. In certain situations, the Employees’ Hygiene & Safety Committee (“CHSCT”) must also be consulted, for example, when a decision is taken that may impact the employees’ health, safety or working conditions…