By a Decision of 14 October 2010 (published on 8 December) the French data protection authority, the CNIL, modified its “Blanket Authorisation” of December 2005 on whistleblowing/ hotlines in relation to the scope of reporting.

An Extension of scope

Until now, to fall within the Blanket Authorisation, a whistle-blowing scheme had to relate either to:

– legal obligations of French law in relation to implementing internal audit procedures in the fields of finance, accounting, banking and the fight against corruption ; or

– legal requirements set out in section 301(4) of the Sarbanes-Oxley Act in the fields of accounting and auditing for companies concerned by this law,

The Decision of the CNIL indicates that the so called “Japanese SOX “ is also covered by the Blanket Authorisation but, and more importantly, it also extends the scope to internal audit on breaches to competition law.

The CNIL had already indicated that it would proceed with this extension as it has granted to date 90 authorisations for whistleblowing schemes that included such reporting topic and could not benefit from the simplified procedure of the Blanket Authorisation. This change is of material importance to companies that may have been required by French or EU competition authorities to implement more extensive internal audit processes to prevent breaches to competition law after having been sanctioned for past practices.

A Clarification of the scope

The CNIL has also removed a provision that has caused misunderstandings on the permitted scope of reporting.

Indeed, the Blanket Authorisation indicated until now that information reported through the whistle blowing scheme and that falls outside this scope but that may affect the vital interest of the business or the physical or moral integrity of employees, “may be sent to the relevant persons in the company”.

Certain companies considered that this was meant to broaden the scope of authorised reporting, whereas the actual purpose was to indicate that complaints which fall outside of the authorised scope , may, if they are of material importance, be transferred to the appropriate person (such as the HR manager) instead of being simply disregarded.

In a decision of 8 December 2009 the French Supreme Court sanctioned this interpretation and this seemed to be the first of many cases on this subject. The CNIL has therefore chosen to simply remove the relevant provision and to stipulate that any information reported through a hotline that falls outside the scope should immediately be destroyed or archived.

Companies have 6 months to become compliant. The CNIL has indicated that to date 1605 companies have filed their whistleblowing scheme under the Blanket Authorisation.