HR internal investigations can be opened at the reasonable discretion of the employer.  They are not therefore mandatory under French law, other than where indicated in 1.2 Legal Bases. However, even where it is not mandatory to conduct an investigation, this is generally prudent, unless of course the facts are so obvious that they would not be clarified or confirmed by further investigation.

Company collective agreements or internal rules documents may also set out the circumstances in which investigations must be undertaken and the procedures which must be followed.

Investigations are typically initiated in the following circumstances.

• At the initiative of the employer when it considers that an issue has arisen which requires investigation – for example on becoming aware of an issue, or following an allegation by an employee that they have been subjected to harassment, discrimination, unfair treatment, inequality of treatment in terms of pay and benefits etc.
• On the receipt of a formal alert made by an employee, either through a whistle-blowing hotline (“Sapin II Law” – Law No 2016-1691 of 9 December 2016 amended by law No 2022-401 of 21 March 2022).
• At the initiative of the works council (CSE – comité social et économique), when it alerts the company to a matter which requires investigation. These situations may, for example, relate to matters concerning breaches of the rights of employees, their physical or mental health or their individual liberties (droit d’alerte – articles L.2312-5, L.2312-59 of the French Labour Code). Common examples include alleged discrimination, alleged sexual or moral harassment.
• In the event that the CSE notes a serious and imminent threat to employees (Articles L.4131-2 and L. 4132-2 of the French Labour Code).

An employer is required “immediately, or without delay”, to undertake a joint investigation with the CSE in the following circumstances.

• In the event that the CSE raises an alert in relation to what it considers to be a serious and imminent danger to employees (Articles L. 2312-60, L.4131-2 and L. 4132-2 of the French Labour Code). If the employer fails to launch an investigation in such circumstances, the CSE is convened within a maximum of 24 hours and, in the absence of an agreement between the employer and CSE on the steps to be taken, the Labour Inspector must immediately be contacted by the employer.
• An attack on individual rights, employees’ physical and/or mental health or individual liberties as a result of moral or sexual harassment (Article L.2312-59 French Labour Code). If the employer fails to launch an investigation in these circumstances, the employee, or a member of the CSE can file a claim with the Employment Tribunal for an accelerated judgment. In the case of an action filed by the CSE, the employee must be informed in writing in advance and give their agreement to the procedure.
• On the receipt of a formal alert made by an employee – eg, through a whistle-blowing hotline.

Where investigations are triggered by the CSE’s right of alert (droit d’alerte), the investigation in undertaken jointly with one or more members of the CSE.

In the case of investigations following an alert by the CSE of a serious and imminent threat to employees in companies with 50 or more employees, the CSE is entitled to nominate an expert to assist it, financed by the employer.

An employer is permitted to carry out an investigation also in any other circumstances, provided it complies with the general principles on lawful investigations.

Investigations are not automatic in case of allegations relating to health and safety, but are usually strongly advisable (Supreme Court 12 June 2024, No 23-13.975) and a failure to investigate could give rise to a finding of fault on the part of the employer (Supreme Court 27 November 2019 No 18-10.551), even if no danger ultimately is identified. Investigations are also considered as necessary in such circumstances by Article 4.2 of the ANI dated 26 March 2010 relating to moral harassment and violence at work.

The Sapin II Law sets out certain requirements in relation to the nature and timing of the investigation into whistle-blowing alerts (see 8.1 Whistle-Blowing).

Companies with 50 or more employees must have in place a whistle-blowing policy, enabling employees to report alleged breaches or incidents.

The employee is not however obliged to use the whistle-blowing hotline and may alternatively choose to contact the employer directly (eg, the HR team, their manager) or the CSE.

The company has a discretion to decide who should make up the investigation team, provided such individuals are sufficiently independent, senior and competent to conduct the investigation. They should not have a reporting line to the person(s) who are the subject of the investigation.

External counsel can, at the discretion of the employer, be instructed to conduct an external independent investigation, but in that case, should not be the usual counsel instructed by the company on HR matters (ie, must be independent). They are not permitted, under their professional conduct rules, to advise the employer in relation to any litigation which may result from the investigation or any disciplinary action taken by the employer as a result.

See 1.1 Circumstances and 1.2 Legal Bases.

There are no provisions under French law prohibiting investigations, but if investigations are undertaken, they must be undertaken with respect for the general principals on lawful investigations (see 3.3 Format).

The employer can decide to carry out an investigation at its discretion in other cases, provided it acts reasonably and complies with the general principals on lawful investigations (see 3.3 Format).

The person making an allegation triggering an investigation (the “Reporter”) should be promptly informed of the fact of the launch of the investigation and kept informed of the progress of the investigation, as appropriate and provided with feedback at the end of the investigation.

They may of course also have brought a formal grievance in addition, which will need to be dealt with by the employer, following the investigation in accordance with French law procedures (including any provisions set out in collective agreements).

In the case of formal whistle-blowing alerts, strict deadlines apply in relation to the communications with the whistle-blower – see 8.1 Whistle-Blowing.

In relation to investigations into matters covered by the Sapin II Law, the Respondent, any witnesses or other victims must be informed of the fact of the alert within a reasonable time, being a maximum of one month from receipt of the alert. This notification can however be deferred if it may seriously compromise the investigation (eg, there is a serious risk of destruction of evidence, intimidation of witnesses, etc). The notification should not of course name the whistle-blower or other potential witnesses (CNIL Referential document – 6 July 2023 on Alert Procedures).

Under Articles 13 and 14 of the GDPR, these obligations also apply where the Reporter is not considered a whistle-blower under the Sapin II Law.

Certain financial services institutions may be required to make communications to their Regulators in relation to investigations. This will depend on the relevant facts and circumstances.

The Reporter, Respondent and other employees interviewed may, in theory, be asked to sign confidentiality agreements and NDAs, but this is relatively rare in practice and generally they cannot be sanctioned for their refusal to sign such documents.

It should be noted that if the investigation is in the context of a Sapin II Law alert, it is necessary to guarantee the confidentiality of the author of the alert, the other persons referred to in the alert and any other relevant third parties (Article 9 Sapin II Law).

On occasions it may be appropriate to conduct a preliminary investigation, to determine whether it is necessary to then go on to conduct a fuller investigation involving additional witnesses. This is permitted by French law. 

It will be necessary to bear in mind:

• the prescription period of two months from the date that the employer has sufficient knowledge of the facts to take any relevant disciplinary action (see also 6.8 Disciplinary Measures); and
• the general requirement to act promptly and to complete an investigation within a reasonable time period.

The following individuals should typically be interviewed in the investigation:

• the employee(s) making the allegations;
• relevant witnesses – the employer has the right to reasonably identify who these are, taking into account the individuals identified by the Reporter and Respondent as having relevant information. It is not a legal requirement to interview every single potentially relevant witness, provided the investigation has obtained sufficient evidence from the persons interviewed;
• the Respondent; and
• any other persons who may be able to assist with the investigation and provide relevant evidence.

A refusal on the part of an employee to participate in a reasonable investigation can potentially give rise to disciplinary action, where this is warranted and depending on the circumstances. Such disciplinary action could, for example, typically range from a warning to potential a dismissal, in extreme cases.

French law does not prescribe in detail how investigations must be undertaken by employers – companies are therefore relatively free to undertake investigations in the manner which is most suitable to the facts of the case.

In principle therefore interviews can be carried out remotely by Teams or Zoom interviews for example, although it is often the case that interviews in person are preferable.

The following principles must be complied with in general in relation to the investigation:

• the decision to commence the investigation must be legitimate;
• the employer must respect certain legal requirements such as:
1. transparency, objectivity, impartiality and loyalty in the investigation process, with the use of proportionate investigation methods;
2. respect for the health and safety of employees (it being recognised that investigations can be stressful times);
3. compliance with timelines for the implementation of any disciplinary action which may be necessary following the investigation;
4. respect for French law on methods of obtaining evidence;
5. respecting confidentiality, to the extent possible and in compliance with the legal requirements in particular under the Sapin II Law; and
6. respect for the principals of data protection (see 7. Data Protection for further details).

In the case of investigations into health and safety matters, the judges must be satisfied that the investigation is undertaken seriously.

In the event that the investigation is conducted by an external law firm, they must respect the principles of their relevant Bar – eg, for Paris, this is Annex XXIV of the Internal Rules of the Paris Bar (Vade-mecum de l’avocat chargé d’une enquête interne).

Interviewers must of course be as objective as possible as the aim is to identify, objectively and independently, the facts of the situation.

In the case of an investigation into allegations arising under an alert made under the Sapin II Law provisions, there are more specific requirements as to who can conduct the investigation. This must be:

• the persons designated to investigate in the whistle-blowing policy in place within the employer; and
• who must be competent, impartial, have the necessary authority and means available to them to conduct a proper investigation.

Otherwise, there are no specific rules in terms of the minimum or maximum number of interviewers or their gender. 

It is generally preferable however to have at least two persons present on the interviewing team to facilitate note-taking and be able to evidence the manner in which the interview has been conducted. It is also generally advisable not to have too many interviewers, so as not to provide intimidating conditions for the employee being interviewed – ie, no more interviewers than necessary.

The interviewers must however be sufficiently senior and experienced to be able to conduct the interviews appropriately. In certain cases it may be appropriate to ensure at least one of the interviewers is from the same gender as the interviewee (eg, in the case of allegations of sexual harassment).

If the CSE is associated with the investigation (see above), one or more members of the CSE should also be on the interview team.

It may in certain circumstances also be necessary to consider including the following individuals in the interview team, depending on the facts of the case:

• a representative from the Service for the prevention of risks and promotion of health and safety at work (Service de prevention et de santé au travail);
• the employee nominated as the Anti-Harassment Contact (Référent harcèlements); or
• a third party such as:
1. external law firm investigators; or
2. experts in psychological support measures (eg, for an investigation in relation to alleged stress at work).

It will depend on the facts of the case as to whether a neutral third party should be present during the interviews as a witness. This is not prohibited under French law, provided there is a continued respect for confidentiality obligations.

It is good practice to invite the interviewees to be accompanied at the interview with a colleague, if they so wish. In France this colleague may also be a member of CSE, if the interviewee so chooses.

Generally, interviewees are not accompanied by a lawyer.

The exception to this provision is if the investigation is being undertaken by external lawyers on behalf of the employer, in which case, the interviewees should be invited to be accompanied by a lawyer, if they so wish. This is particularly the case in relation to the subject of any allegations (the Respondent), who should clearly be informed of their right to be accompanied at the investigation interview by a lawyer.

The interviewers should provide the following information to the interviewees in the invitation to the interview:

• the fact that they are asked to attend an interview in the context of an investigation;
• that they can attend with a colleague if they so wish; and
• a reminder of their data protection rights and that their personal data will be processed as part of the investigation.

If the investigation is being conducted by an external lawyer, they should also be informed:

• that the external lawyers conducting the investigation are not representing the person interviewed;
• in particular for the subject of the alert (the Respondent) that they can be accompanied by their own lawyer if they so wish. In practice it can be prudent also to permit the Reporter and other witnesses, if they so wish, also to be accompanied by a lawyer; and
• that the exchanges are not covered by legal privilege and may be used in the investigation report which will be provided to the employer.

Where an interview is conducted by an external lawyer and the interviewee is not already accompanied by their own lawyer, in the event that at any stage the interviewees (including the Respondent) risk self-incrimination, the interviewers should stop the interview and inform the individual that they have the right to be accompanied by a lawyer at a re-scheduled interview.

Interviews should generally not be longer than three hours in any one session and the interviewees should be given the opportunity to take a break at regular intervals, as necessary. The interviewees should also be expressly informed that they can ask for a break at any time.

Employees must generally participate in interviews organised by their employer, as this right on the part of the employer falls within the employer’s general right to manage and take disciplinary action. However, if an employee asks to stop the interview, the employer must respect the employee’s health and safety and should in practice generally accede to the request to interrupt the interview. It may be that this is temporary – to give the employee a short break, or that the employee refuses to participate further in the investigation process. 

In the case of a refusal to participate further, the employer can draw reasonable conclusions from such refusal, if pertinent, and ultimately it may be appropriate to take disciplinary action if an employee unreasonably refuses to participate in a reasonable and legitimate investigation.

Interviews should be recorded either by summaries of the discussion taken by the investigators or verbatim minutes taken, for example, by a stenographer.

There are no specific provisions in French law as to the investigation process or format of minutes. It is however advisable for minutes to be taken and for the interviewee to be asked to sign and date the minutes at the end of the interview, or shortly afterwards.

If the interview has other observations to make subsequently, these can be annexed to the signed interview notes.

It should be noted that this form of minutes will not however carry as much weight as a statement made by the employee in the format required by French tribunals and courts for formal witness statements used in hearings (under Article 202 Civil Procedure Code). This formal format requires the statement to:

• mention the name, date and place of birth, address and job title of the author;
• state their family relationship with the parties or any line of subordination, common interests, etc;
• be handwritten;
• include a specific mention that the employee recognises that the statement is intended be introduced before the courts/tribunals and they can be prosecuted if any of the statements they make are deliberately false;
• be signed and dated, with a copy of the passport/identity card annexed.

The minutes can either be minutes taken by the investigation team during the meeting, or prepared based on a recording of the interview or a verbatim account taken by a stenographer. 

Recording of an interview is permitted, with the express consent of the employee.

If the interview is recorded, the employee should be informed of such fact at the outset and asked to consent to this.  If they do not consent, the recording should not be taken.

The investigation team should attempt to ensure that the employee is not covertly recording the interview – eg, with their mobile phone.

Other relevant steps in relation to the investigation, in addition to the interviews, will generally include:

• a review of any relevant documents, non-confidential medical reports and records made available to the investigation team;
• a review of any SMS, WhatsApp, IM, emails, etc, exchanged between employees in relation to the matters being investigated;
• a consideration of the employer’s internal policies and procedures; and
• any other relevant documents.

It is important to note that restrictions apply under French law for the review of private and personal emails and documents and that these should not be reviewed without the employee being present and without their consent. If the employee is not present and does not consent, the employer should obtain a court order and only review the documents, emails, etc, covered by the court order and in the presence of a bailiff, who can independently attest to the correct procedures being followed and the extent and nature of the documents and emails reviewed.

Whistle-blowers and those employees who participate in investigations are entitled not to be subjected to any detrimental treatment related to the fact they have raised an alert or participated in an investigation.

Detrimental treatment can include (without limitation): absence of bonus or lower bonus, absence of a pay-rise or lower pay rise, sidelining, negative impact on career progression, failure to obtain a promotion, bullying or harassment, disciplinary action, termination of employment, etc.

This protection is not time limited and it will be important in practice for the employer to monitor this to ensure the respect of this obligation.

If however the whistle-blower is found to have acted in bad faith, they may be subjected to disciplinary action and could of course also face other action by the subject of the (false) alert, such as a claim for damages for defamation.

Investigations must be undertaken with respect for the principles, inter alia, of discretion and confidentiality in relation to all participants in the investigation, including the subject of any allegations (the Respondent). Typical measures may include:

• limiting the number of employees who are aware of the investigation and any disciplinary action following such investigation to the minimum necessary;
• reminding interviewees that they should not discuss the investigation with colleagues and should observe strict confidentiality in relation to this. This may include in some cases the use of NDAs (non-disclosure agreements); and
• compliance with data protection requirements – in particular the security of data.

If the employer fails to reasonably protect the reputation of the Respondent, it may face damages claims or claims for constructive dismissal, for example.

The employee may potentially decide, in serious cases where this is justified, for example, to protect other employees and avoid evidence being destroyed or tampered with, suspending the Respondent on a conservative basis (mise à pied à titre conservatoire). This would be without pre-judging the situation, pending the completion of an investigation and any disciplinary action which may need to be taken. In such case, the suspension should be for as short a period as possible. It is however generally not prudent to suspend the Respondent and this measure should only be used in very serious cases, where the alleged acts appear clearly to have been committed by the Respondent. A decision would need to be taken as to whether the Respondent was to continue to receive a salary during the suspension. The investigation would of course also have to be completed expeditiously.

Such a temporary suspension is not a disciplinary measure however. Disciplinary measures (such as a demotion, suspension without pay, warning, dismissal, etc) can only be taken once the employer has full knowledge of the facts (usually after the completion of the investigation). 

The employer must also follow the disciplinary procedures and processes provided for under French law and under the Internal Rules, and if applicable, national collective bargaining agreement applying to the employer.

Depending on the circumstances, the employer may also need to take other measures to protect employees involved in the investigation. These should be reviewed at the relevant time, it being understood that there is a strict legal obligation on the part of the employer to provide a safe place of work.

The employer must also ensure that any other employees involved in the investigation as witnesses are not subjected to any detrimental treatment related to the fact they have participated in the investigation.

Whilst French law is generally silent on the format of an investigation (other than in relation to the procedural requirements set out in the Sapin II Law), certain provisions require the employer to act within certain time limits – eg:

• alerts raised by the CSE must be investigated “without delay” (the period is however not further defined) – Article L.2312-59 of the French Labour Code;
• investigations in relation to moral harassment must also be dealt with “without delay” (Article 4.2 ANI 26 March 2010); and
• in the case of facts which may give rise to disciplinary action, the employer must take any disciplinary action no later than two months after becoming fully and precisely aware of the facts (Article L.1332-4 of the French Labour Code). Generally, this is at the end of the investigation, unless the employer has certain knowledge of the facts before the end of the investigation (Supreme Court 29 May 2024 No 22-18.887).

The Company may put in place – eg, via a collective agreement or Internal Rules document negotiated with the trade union representatives, specific investigation procedures. These must of course respect the general principles referred to at 3.3 Format.

This will depend on the nature of the allegations – eg, specific provisions apply in the cases of alleged sexual and moral harassment.

Generally, however it is for the person making the allegations to establish the proof of the allegations. The investigation process obviously would constitute the fact-finding exercise.

The degree of proof in practice will be on the balance of probabilities, with the employer being required to demonstrate that it has acted reasonably in reaching its decisions on the outcome of the investigation and any disciplinary action. The decision must be based on the evidence available which has been reasonably and thoroughly considered.

Generally, the investigation ends once all reasonable relevant facts have been investigated. There are no maximum or minimum time limits for the investigation, but it should be undertaken and concluded in a reasonable time limit, bearing in mind in particular the fact that this is often an anxious time for the employees involved.

There are no express provisions for what communications must be made to the protagonists (other than in the case of alerts by whistle-blowers under the Sapin II Law – see 8.1 Whistle-Blowers).

Generally, however it is advisable to:

• inform the Reporter of the fact that the investigation has completed and provide a summary of the findings.  There may of course be other stages to be complied with in relation to the Reporter – eg, dealing with any formal grievances they may also have raised;
• inform the subject of the alert (Respondent) of the end of the investigation and whether:
1. the allegations have been found to be substantiated in whole or in part;
2. any further potential disciplinary action is envisaged.

The witnesses may also be informed of the end of the investigation – they are not required to be given details of the findings. Indeed, it is generally advisable not to provide any further information to witnesses who are not also alleged victims, in order to respect confidentiality obligations.

There are no formal prescriptions under French law in relation to the form that the conclusions to an investigation report must take. 

These should of course be justified by the factual findings and adequately reasoned to be understood.

The format of an investigation report, again, is not prescribed by French law. In general, it is however advisable to:

• set out the context of the alert/matter investigated;
• set out the investigation methodology followed;
• present the facts of the investigation;
• summarise the interviews undertaken and the documents obtained during the investigation;
• analyse the facts; and
• set out the conclusions of the investigation.

In relation to investigation reports prepared by an employer, the employer is free to provide a copy of this to the individuals they wish (eg, members of the CSE, if applicable, the Reporter, the Respondent). It is usually preferable however to provide a summary of the report where possible, rather than the full report, depending on the circumstances.

In the case of joint investigations with the CSE, the investigation report should also be provided to the CSE (or a committee of the CSE).

If the investigation report is prepared by an external lawyer, it may only be provided by the lawyer to the employer (as the client in relation to the investigation). The employer may of course provide this to others.

The conclusions of an internal investigation generally only have to be communicated to the authorities in the event of a legal obligation. The employer should of course be careful to continue to respect its obligations of confidentiality to all employees involved in the investigation (the Reporter, Respondent, witnesses, etc).

There are however certain exceptions that must be reported to authorities (eg, market manipulation to the AMF).

If any effective officers (dirigeants effectifs) are terminated, the AMF would also have to be informed, but do not necessarily receive details of the reasons for the dismissal.

The employer is generally required to respect a strict confidentiality obligation in relation to the results of an internal investigation vis-à-vis all involved and only to provide the information necessary, such as:

• feedback to the whistle-blower, or person raising allegations;
• feedback to the subject of the investigation – if no further disciplinary action is taken otherwise providing information to them;
• feedback to the CSE, if applicable;
• more limited feedback to other witnesses – eg, thanking them for participating in the investigation and confirming that this is now closed.

In practice it may of course be necessary to provide more detailed communications, particularly in cases where employees have been seriously impacted by the alleged acts and need further psychological or other support from the employer.

The employer may determine reasonably the disciplinary measures, if any, to be taken at the end of an investigation, in compliance with its Internal Rules document (Règlement Intérieur).

Any disciplinary action must however be commenced no later than two months following the employer having sufficiently detailed knowledge of the facts. Generally, this is at the end of the investigation. The investigation must be undertaken within a reasonable time period.

The “commencement of disciplinary action” in this context means:

• issuing a warning letter; or
• the convocation of the relevant employee(s) to a pre-dismissal meeting.

Other measures, aside from, or in addition to, disciplinary action, may be determined by the employer to be appropriate following the investigation. Typically, these could include:

• training – eg, in anti-harassment or anti-discrimination;
• team-building exercises – eg, following allegations of bullying and harassment; and
• reorganisations of teams – eg, moving employees to a different line manager (in certain cases this may require employee consent).

The employer may collect personal data for the purpose of an HR internal investigation, provided that it complies with GDPR (General Data Protection Regulations – Regulation (EU) 2016/679) requirements and applicable CNIL (the French Data Protection Authorities) deliberations, and in particular must:

• provide a reference to such purpose in its record of processing activities;
• unless the investigation is mandated by a French or EU legal obligation, conduct a “legitimate interest assessment”, balancing the interest of the employer in conducting the processing versus the interests and rights of the relevant employees;
• if the processing may give rise to a high risk for the relevant employees (depending on the consequences and type of data collected), conduct a “data protection impact assessment” – note that this is mandatory pursuant to CNIL Deliberation 2018-327 if the investigation is part of a whistle-blowing procedure;
• apply the data minimisation principles – ie, only collect the data that is necessary for the purposes of the investigation;
• if disciplinary or legal proceedings are initiated, keep the necessary data until the end of the proceedings but delete it if it is determined that no disciplinary action will be taken. In a whistle-blowing context, this destruction should take place no later than two months after the completion of all admissibility or verification operations pursuant to CNIL Deliberation 2018-327. In the case of actual or threatened litigation, it may however be necessary to retain the data for a longer period, provided this is reasonable;
• inform the relevant data subjects as to the possible collection and processing of personal data in compliance with Articles 13 or 14 of the GDPR, as applicable; and
• if data may be transferred outside the EEA, put into place adequate safeguards, such as conducting a data transfer impact assessment and entering into Standard Contractual Clauses (SCCs) with the party importing the data outside the EEA.

Furthermore, if a whistle-blowing procedure is implemented, the following additional rules should be considered, based on CNIL deliberation 2018-327:

• the identity of the whistle-blower must be treated as confidential and access to that information should be limited to authorised persons or judicial authorities;
• precautions should be taken if an outside provider data processor is used, and an agreement entered into setting out the obligations of Article 28 of the GDPR;
• data may only be shared within other group companies if necessary to verify or process the alert;
• data relating to an alert may be kept in an active database until a final decision has been taken, and this decision must be taken within a reasonable time from the receipt of the alert;
• once the final decision has been taken on the action to be taken in response to the alert, the data may be kept in the form of intermediate archives, for the time strictly proportionate to the protection of the whistle-blower, persons who are the subjects of the allegations and any third parties mentioned, taking into account the time required for any further investigations;
• if there are disciplinary or litigation proceedings, the data relating to the alert may be kept until the end of the legal procedure or the time limit for appeal; and
• data may be kept for a longer period, in intermediate storage, if the data controller is legally obliged to do so (for example, to meet accounting, social or tax obligations), or for evidence purposes with a view to a possible audit or litigation.

It is highly recommended to set out the foregoing requirements in the employee privacy policy, as well as in a whistle-blowing policy.

The person who is the subject of the alert or accusations must be informed of the processing of their personal data, even in the context of a whistle-blower procedure. However, in terms of when this notification must take place, in certain cases, notification of the information may be postponed to allow precautionary measures to be taken by the employer to prevent the destruction of evidence required to process the alert. The accused person however must be informed of the alert within a reasonable period, which should not exceed one month pursuant to requirements set out by the CNIL.

Accused persons must also be informed of their general data protection rights, such as the right to access, respond, contest, modify or delete inaccurate or incomplete data.

The parties have a right of access to data under Article 15 of the GDPR.

This includes any whistle-blower, any victims, accused persons, witnesses or persons questioned during the investigation. However, the exercise of this right must not infringe on the rights and freedoms of others, including trade secrets or intellectual property, such as trade secrets of the employer.

As a result of that limitation, the identity of a whistle-blower/witnesses or documents disclosing that identity, should generally not be provided to an accused person without the consent of the former.

Article 6 of the Sapin II Law (Law No 2016-1691 of 9 December 2016 relating to transparency, the fight against corruption and modernisation of the economy) defines whistle-blowers as:

• a physical person;
• who reveals or raises an alert relating to:
1. a crime or lesser form of criminal breach (délit);
2. a serious and manifest violation of an international undertaking which has been duly ratified or approved by France or of a unilateral act of an international organisation taken on the basis of such undertaking;
3. a breach of a law, European law or regulation;
4. a threat or serious prejudice for the general interest;
• in a disinterested manner (eg, not for direct personal gain or interests);
• acting in good faith; and
• which came to their knowledge in the course of their professional activities or of which the whistle-blower has direct personal knowledge.

The following matters are excluded: facts, information or documents which are covered by national security, medical confidentiality or legal privilege.

There are specific provisions in terms of the timing of the investigation in the event of a whistle-blowing alert under the Sapin II Law:

• the Reporter must be provided within seven working days of the alert with a confirmation of reception of the alert;
• they must receive within three months of the date of the alert details of the measures envisaged or already taken to investigate the allegations or remediate the alleged breaches and the reasons; and
• they must be informed when the file is closed.

The Reporter, Respondent and any other third parties identified in the alert have the right for their identity not to be disclosed without their consent, other than where legally required. A breach of this obligation is sanctioned by two years’ imprisonment and a fine of EUR30,000.

Sexual harassment is defined by the French Labour Code and case law as follows :

Sexual harassment is characterised by “repeated comments or behaviour with a sexual or sexist connotation which either undermine (the employee’s) dignity by being degrading or humiliating, or create an intimidating, hostile or offensive situation” (Article L. 1153-1, paragraph 1 of the French Labour Code).

It is also characterised by “any form of serious pressure, even if not repeated, exercised with the real or apparent aim of obtaining an act of a sexual nature, whether this is sought for the benefit of the perpetrator or a third party” (Article L. 1153-1, paragraph 2 of the French Labour Code).

Sexual remarks and inappropriate attitudes by an employee towards an individual with whom they are in contact by virtue of their work do not fall within the scope of personal life and may therefore justify a disciplinary sanction, regardless of whether the acts occurred outside working hours and the workplace (Supreme Court 19 October 2011, No 09-72.672).

This is particularly the case when, in order to achieve their ends, the person accused of harassment abuses their hierarchical power, regardless of whether the behaviour took place outside of work time and place (Supreme Court 11 January 2012, No 10-12.930).

According to the rules of evidence, in order for sexual harassment to be recognised, an employee who considers themselves to be a victim must present preliminary evidence suggesting the existence of such harassment.

If it is established, based on this evidence, that the behaviour did not in fact constitute sexual harassment but was justified by objective factors unrelated to any harassment, sexual harassment is not deemed to have occurred.

Case law therefore considers, in the first instance, that it is up to the employee to establish the reality of specific and concordant acts that make it possible to presume the existence of harassment (Supreme Court 22 March 2017, No 15-26.838).

French law also recognises the concept of “moral harassment”, which is defined as follows.

Moral harassment is characterised by “repeated acts which have as their object or effect a deterioration in working conditions likely to affect the rights and dignity, alter the physical or mental health or compromise the professional future” of the employee (Article L. 1152-1 of the French Labour Code).

This presupposes that all of the following conditions have been met:

• the existence of repeated acts that contravene the rules governing the normal performance of the employment contract;
• with the object or effect of worsening working conditions likely to:
1. adversely affect the rights and dignity of the employee being harassed;
2. adversely affect the physical or mental health of the employee being harassed; or
3. jeopardise the employee’s career.

The evidential requirements for moral harassment are identical to those for sexual harassment.

Moral harassment can include (but is not limited to) issues such as sidelining, bullying, etc, and can be a relatively common allegation triggering a requirement on the part of an employer to commence an investigation.

For French law purposes, bullying would fall within the concept of moral harassment, as defined in 8.3 Other Forms of Discrimination and/or Harassment.

An external independent investigation can be conducted by an external lawyer when it appears important to maximise the chances of applying legal privilege under French law.

In most cases, private companies are not legally required to report allegations to the authorities. In practice, the decision to report will primarily depend on strategic considerations, including the risk of disclosure by (i) the whistle-blower (as they have the option to report internally or to an external authority as listed in the Annex of Decree No 2022-1284 of 3 October 2022) or (ii) third parties. 

If a criminal investigation has already been launched against the employer, an evaluation of the allegations contained in a report must be carefully conducted in light of the employer’s existing knowledge and strategy in the proceedings.

If a complaint is filed, or if negotiations for a Judicial Public Interest Agreement (CJIP) are initiated, an internal investigation can still be conducted. The National Financial Prosecutor’s Office (PNF) and the French Anticorruption Agency (AFA) recommend ensuring that the internal investigation does not interfere with ongoing judicial investigations during the negotiation period and that actions taken as part of the internal investigation do not contribute to the alteration of evidence.

As part of the other considerations to bear in mind, verifying allegations is crucial. It can demonstrate the employer’s good faith and may, where applicable, mitigate a potential fine. Conversely, deliberately concealing allegations or choosing not to assess their relevance may be negatively assessed by prosecuting and adjudicating authorities, if discovered.

In the event that the investigation or disciplinary action that may arise from an investigation is multi-jurisdictional, the following key issues may also be relevant:

• whether it is possible to transfer data outside of the EEA and the measures that must be put in place to ensure that this is lawful (see 7.1 Data Protection);
• compliance with the local employment laws and prescription periods in each relevant jurisdiction;
• taking into account different rules to obtaining evidence – eg, in France, reviews of employee emails and documents created by them are subject to certain restrictions (personal and private emails relating to the employee cannot be reviewed without the employee’s presence or in the absence of a court order and the presence of a bailiff);
• whether there is an obligation to involve the local employee representatives – eg, in an investigation;
• a requirement to notify the relevant local regulatory authorities of breaches (particularly relevant in the financial services sector); and
• taking into account different approaches to legal professional privileged – eg, in France, only external lawyers are covered by legal professional privilege and this does not yet apply to internal counsel. Care should therefore be taken in relation to communications internally about an investigation and the legal issues relating to this. The status of in-house lawyers in France is however a subject under review in this regard.