Explore our collection of PDF documents and enrich your knowledge now!
back
Data Protection Newsflash - 1
Article IT and Data Protection Intellectual Property, Media, and Art Law Competition, Retail and Consumer Law Commercial and International Contracts | 10/12/10 | 2 min. | Mahasti Razavi Florence Chafiol
WHISTLEBLOWING SYSTEMS: THE CNIL CLARIFIES ITS POSITION
The Labor Chamber of the French Cour de cassation handed down quite a remarkable decision on December 8, 2009 regarding the interpretation of the provisions of single authorization no. AU-004 applicable to whistle-blowing systems in the workplace.
To recap, the CNIL (French Data Protection Authority) considered that it was not necessary for companies to obtain an authorization prior to implementing such systems if they undertook to comply with the provisions of single authorization no. AU-004. For its part, the Cour de cassation applied a restrictive interpretation and ruled that whistle-blowing systems in the workplace could not have any other purposes than those defined in Article 1 of the single authorization without obtaining the CNIL’s prior authorization.
Following this decision, the CNIL indicated that it was going to modify the scope of its authorization. And it has done just this, since a deliberation of October 14, 2010 published by the CNIL on its website on December 8, 2010.
To overcome the difficulties in interpreting the initial document, the scope of application of single authorization no. AU-004 has been specified and from now on, pursuant to Article 1, covers exclusively whistle-blowing of serious wrongdoings in the areas of accounting, finance, banking and bribery and also acts pertaining to compliance with competition rules, which is new. Article 3 of the single authorization, which could be interpreted as extending the scope of the single authorization and which had been a source of confusion, has also been modified accordingly.
Furthermore, companies will have to inform their employees that only the areas specified in the authorization will be concerned by any whistle-blowing systems set up in the company, and that all other information will be subject to the usual requirements (reporting information to line managers, union representatives or human resources departments).
Regarding the formalities as a result of these changes, the CNIL has stated that companies which have already filed a statement of compliance with single authorization no. AU-004 will not be required to make any further notification, provided, however, that the whistle-blowing systems existing in their organization comply with the new scope of application. Otherwise, notifying companies will have six months to bring their processing into compliance.
However, any whistle-blowing systems which do not comply with the modified authorization (particularly those covering issues related to intellectual property or discrimination), and which companies do not plan to bring into compliance with said authorization, will be subject to an individual authorization application. The CNIL has stated in this respect that applications will be carefully reviewed on a case-by-case basis.
The CNIL and the Cour de cassation’s decision are thus now in unison and aim to strictly limit the scope of single authorization no. AU-004 to information in the regulated areas in order to prevent any abuse.
Florence Chafiol-Chaumont
Partner
Mahasti Razavi
Partner