Whistleblower Procedure
INTERNAL WHISTLEBLOWER PROCEDURE
The present whistleblowing procedure relates to the implementation of the whistleblower protection system within Médiaperformances.
This procedure allows anyone – internal and external stakeholders, staff members and business partners – to report reprehensible acts (a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France, a unilateral act of an international organisation taken on the basis of such a commitment, European Union law, a law or regulation).
Rationale for whistleblower protection:
The European Commission in its communication of 23 April 2018 stated that, “‘whistleblowers’ often risk their career and their livelihood and, in some cases, suffer severe and long-lasting financial, health, reputational and personal repercussions. Making sure that those who speak out are properly protected is a key element in preventing wrongdoings and defending the public interest”.
Legal framework:
– Law no. 2016-1691, known as “Sapin II” of 9 December 2016, on transparency, the fight against corruption and the modernisation of economic life, requires companies meeting the thresholds set by the law (Articles 6 and 17) to implement a system for collecting and processing whistleblower reports within the legal entities concerned.
– Law no. 2022-41 of 21 March 2022, aimed at improving the protection of whistleblowers, sets out the definition of a whistleblower, the conditions of admissibility and the procedures for handling reports, as well as the system for protecting whistleblowers.
– Implementing Decree no. 2022-1284 of 3 October 2022, on procedures for collecting and processing whistleblower reports and establishing the list of external authorities set up by the Act of 21 March 2022, specifies in particular the methods used to establish internal procedures for collecting and processing whistleblower reports, as well as procedures for collecting and processing reports sent to the competent authorities.
Whistleblower:
This is the individual who reports:
–without financial consideration: the person making the report must not derive any financial or material benefit from it.
-in good faith: the person making the report must have a reasonable belief in the veracity of the facts they are reporting and must not be acting with the intention of harming one or more persons, nor must they be acting in bad faith.
Misuse of the procedure, or use in bad faith, may result in disciplinary action or prosecution.
-on facts covered by the whistleblowing procedure.
-on facts of which they have personal knowledge if the information reported was obtained outside the professional environment.
The whistleblower may be a staff member of the company, a person whose employment relationship has ended, a person who has applied for a job with Médiaperformances, a shareholder, a director, an external and occasional employee, as well as external stakeholders (co-contractors, subcontractors, suppliers, customers, partners, etc.).
Facts that may be reported:
The report must relate to the organisation, operation or activities of Médiaperformances and concern:
➢ a crime,
➢ a misdemeanour,
➢ a threat or harm to the general interest,
➢ a breach or an attempt to conceal a breach:
– of a law or regulation (e.g. decree, order),
– of European Union law (e.g. the Treaty on the Functioning of the European Union, a European directive, a European regulation),
– an international commitment duly ratified or approved by France (for example: the European Convention for the Protection of Human Rights and Fundamental Freedoms, the International Convention on the Rights of the Child),
– a unilateral act of an international organisation taken on the basis of such a commitment.
By way of exception, the reporting of facts covered by the whistleblowing procedure provided for by the “Sapin 2” law may not concern elements covered by national defence confidentiality, medical confidentiality, the confidentiality of judicial deliberations, the confidentiality of judicial investigations or inquiries, or the professional confidentiality of lawyers.
➢ Examples of facts that may be reported:
Tax fraud, corruption, harassment, acts likely to pose a major risk to the public, etc.,
The whistleblower is responsible for ensuring that the conditions listed above are met, and verifying, if necessary by seeking advice (lawyer, French Defender of Rights), the following:
– That the facts fall within one of the categories defined by law,
– That the facts do not fall within one of the exclusions of the general whistleblower regime (medical confidentiality, national defence confidentiality, lawyer-client confidentiality).
Reporting procedure:
Notwithstanding recourse to the usual internal reporting channels (management, line management, HR, employee representative bodies), the whistleblowing system gives the whistleblower the choice of:
▪ an internal report, which is the subject of this procedure, in particular when the whistleblower considers that it is possible to remedy the breach effectively by this means and that they do not expose themselves to retaliation,
▪ an external report, either directly or after having made an internal report,
▪ or public disclosure in certain situations.
The choice of reporting channel (internal or external) rests with the whistleblower, who is not required to justify their choice.
1/ Internal reporting: whistleblowers can make their report via a dedicated, secure platform in accordance with the procedures set out below.
2/ External reporting: whistleblowers can choose to report to an external authority, whether or not they have already reported internally.
This procedure involves reporting to:
– The competent authorities listed in the appendix to decree no. 2022-1284 of 3 October 2022,
– The French Defender of Rights,
– The Judicial Authority (public prosecutor),
– A competent European institution, body or agency.
Each authority on the list in appendix to the aforementioned decree publishes information on its website about an internal procedure for collecting and processing reports.
Where appropriate, the person making the report should inform the relevant authority whether or not they have made the report internally when they submit their report.
The authority will verify that the report falls within its jurisdiction and whether the conditions set out in Article 6 of the Law of 9 December 2016 have been met; to this end, it may request any additional information from the person making the report.
If the report does not fall within its remit, or falls in part within the remit of other authorities, it is forwarded without delay to the relevant authority or to the Defender of Rights under conditions that guarantee the integrity and confidentiality of the information it contains.
If applicable, the person making the report is informed of the reasons why the authority considers that their report does not comply with the conditions set out in Article 6 of the Law of 9 December 2016.
Public disclosure:
The whistleblower may decide to make the report public in the following limited cases:
➢ public disclosure following external reporting:
– if the relevant external authority has not taken appropriate measures,
or
– if the relevant external authority has not complied with applicable deadlines.
➢ direct public disclosure if:
– there is, for reports that do not concern information obtained in a professional context, a serious and imminent danger, or an imminent or obvious danger to the general interest (particularly in the case of an emergency situation or a risk of irreversible harm) if the information was obtained in the context of professional activities,
or
– external reporting runs the risk of retaliation against the whistleblower, or does not allow the report to be investigated effectively due to special circumstances (suspected conflict of interest, risk of concealing or destroying evidence, collusion, etc.).
Failure by the whistleblower to comply with these steps may deprive them of the protective status attached to whistleblowing and incur civil and criminal liability, without prejudice to other whistleblowing cases relating to specific measures.
Note: the whistleblower alone is responsible for assessing the need and possibility of forwarding the report to the judicial/administrative authority, a European body or a competent professional body, or of making it public.
In particular, they are responsible for ensuring that the conditions for whistleblowing are met.
If necessary, the whistleblower can seek advice from a lawyer or the Defender of Rights, the administrative authority responsible for guiding and protecting whistleblowers.
Protection of whistleblowers and facilitators:
Scope of protection:
If the person making a report meets all the conditions for recognition as a whistleblower, they benefit from the protections attached to this status:
The secrecy of the whistleblower’s identity must be protected by those who collect and process reports.
Failure to comply with this obligation is punishable by two years’ imprisonment and a fine of €30,000.
However, identifying information about the whistleblower may be shared with the judicial authorities if the company is required to report the facts to them.
The whistleblower is informed of this sharing, except in cases where this information could compromise legal proceedings.
As an employee, whistleblowers cannot be punished by their employer or suffer retaliation as a result of their report.
The French Labour Code lists 15 prohibited measures (e.g. disciplinary sanctions, transfer, negative performance evaluation, etc.).
In the event of negative measures being taken against them, whistleblowers can take their case to the industrial tribunal in summary proceedings.
The staff member may also be entitled to compensation for damages (e.g. loss of earnings as a result of the report).
The onus is on the employer to prove that the measures taken against them are unrelated to the report.
In addition, the law provides for:
• no civil liability for the whistleblower if their report appears necessary to safeguard the interests in question and complies with the rules laid down by law.
• no criminal liability for the whistleblower in the event of disclosure of confidential information or a secret of which they were lawfully aware, for example, in the course of their employment.
However, disclosure of such information must be necessary and proportionate to safeguard the interests at stake.
Whistleblowers can enjoy:
• financial support decided by the judge (court fees or subsidies if the whistleblower’s financial situation has deteriorated) during legal proceedings,
• measures to encourage professional reintegration: fast action by the industrial tribunal to rule on the dismissal, asking the judge to impose the replenishment of their individual training account.
– psychological and financial support from the relevant external authority.
The law provides for sanctions against those responsible for retaliation or “gagging procedures”, including:
• preventing a person from making a report, which is an offence punishable by one year’s imprisonment and a fine of €15,000.
• bringing malicious legal action against a whistleblower, which is punishable by a civil fine of up to €60,000.
Protection is extended to the whistleblowers’ entourage:
– “facilitators”, i.e. individuals who may be at risk of retaliation (e.g. a colleague) or non-profit legal entities (association, trade union, non-governmental organisation) who support the whistleblower.
– persons in contact with the whistleblower (e.g.: colleagues, relatives, employer subcontractors) and the legal entity connected to the whistleblower (e.g.: a company controlled by the whistleblower or for which the whistleblower works).
Protection limit:
A person acting in bad faith and reporting facts that they know to be inaccurate may be subject to:
– disciplinary sanctions
– legal action for defamation or making a false report
Rights of the person targeted by the report:
The law protects the third parties mentioned in the report (including any witnesses) in addition to the persons targeted (mentioned in the report).
Anyone who is the subject of a report is presumed innocent until the allegations against them are proven true.
Referral agents take every precaution to ensure the strict confidentiality of identifying information about the persons concerned by a report (identity, position, contact details).
If the use of experts proves necessary in the course of the investigation, only strictly necessary information is communicated, and the referral agents ensure that the persons associated with the investigation agree to respect stricter privacy requirements with regard to the identity of the person concerned.
In addition, the persons concerned by the report may exercise the rights they have by virtue of and within the limits of the applicable regulations on the protection of personal data, including their right to access, rectify or delete data, to limit data processing relating to the person concerned, to object to processing on legitimate grounds, and to lodge a complaint with a supervisory authority.
The person who is the subject of a report cannot, under any circumstances, obtain information concerning the identity of the whistleblower on the basis of their right of access.
In order to guarantee the right of access to and rectification of data concerning any person who is the subject of a report, referral agents must inform the person of the facts of which they are accused.
When precautionary measures are necessary to prevent the risk of destroying evidence, these persons are informed after these measures have been taken
Reporting and processing procedure – MEDIAPERFORMANCES
Issuing a report
The confidentiality of reports and the protection of those making them are major concerns for Médiaperformances.
Within this framework, Médiaperformances has decided to use an outsourced and secure platform to collect reports (hereinafter referred to as “the Platform”): https://mediaperformances.integrityline.fr/
The external Platform is accessible 24 hours a day, from any Internet-connected device (computer, tablet, smartphone)
It can be accessed by going to the URL: https://mediaperformances.integrityline.fr/
or
– For staff members, on the Médiaperformances intranet.
– For third parties, from the Médiaperformances corporate site.
Once on the Platform, after clicking on “Soumettre une alerte” (Submit a report), the whistleblower must fill in a form and describe the subject of their report.
Whistleblowers are asked to provide specific, factual and exhaustive information directly related to the subject of their report:
– the facts,
– the people involved,
– the place and date or period of the events being reported.
The person making the report must provide any supporting documents as soon as they are available.
In accordance with the law, the person making the report may choose to remain anonymous.
In this case, the person making the report is notified:
– that they must be careful not to accidentally reveal their identity by communicating indirectly identifying information,
– that an anonymous report is examined with care and must be sufficiently substantiated and documented to establish the seriousness of the facts reported,
– that they will not be able to receive whistleblower protection since their identity will be unknown.
The person making the report may reveal their identity at any time, thereby benefiting from the protection afforded by the regulations.
When reports are received by persons or services not authorised by the present procedure, they must forward them to the Referral Agents via the Platform.
Acknowledgement of receipt:
Once the report has been transmitted, the person making the report will receive an acknowledgement of receipt within 7 (seven) working days from receipt of the report, confirming that the report has been registered and specifying the report reference, via the Platform.
Please note that acknowledgement of receipt does not constitute acceptance of the report.
The person(s) concerned by the report will be informed of the data concerning them within one month of the report.
This information may be delayed if it is likely to seriously compromise the achievement of the processing objectives (risk of destruction of evidence), in which case the information will be provided as soon as the risk has been averted.
The information will specify the facts reported, the departments to which the report is addressed, and the procedures for exercising rights of access, rectification, deletion and opposition, where applicable.
Identity of the Referral Agents and the Ethics Committee:
The Referral Agent(s) is/are responsible for collecting and processing reports sent to the Platform.
The Finance and Administration Director and the Human Resources Director have been appointed as Referral Agents.
These two people are appointed for their competence, authority and the sufficient resources at their disposal to properly carry out this mission within Médiaperformances.
Appointing two people limits the risk of processing delays in the absence of one or the other, as well as the risk of conflict of interest.
In the event that the report is directed at one of the referral agents, the latter will be relieved of responsibility for monitoring and processing the report.
Based on the reports received, the referral agents will convene an Ethics Committee to decide what action to take on the reports and to launch an investigation, if necessary.
This Ethics Committee will be composed according to the fields concerned by the reports:
– an internal or external IT expert
– a lawyer
or
– any other internal or external specialist whose expertise may be required.
In the event of particular difficulties (significance of issues, people involved, etc.), a report will be sent to Médiaperformances’s general management.
The Ethics Committee may not be composed of persons in a position of conflict of interest in relation to a given report.
Each member of the Ethics Committee is bound by a strict obligation of confidentiality, formalised in a confidentiality agreement for each report received.
The Ethics Committee will deal with reports transmitted by the Referral Agents.
Admissibility of the report:
The referral agents will check the admissibility of the report:
– that the person making the report belongs to the categories concerned by this procedure (provided that the report is not anonymous),
– that the facts reported fall within the scope of the whistleblowing procedure,
– the plausibility of the facts reported and the circumstantial nature of the facts reported and the supporting evidence provided,
– good faith in reporting,
– knowledge of the facts reported by the whistleblower in the course of their professional activities or personal knowledge.
Referral agents can ask the person making the report for further information if the facts reported are not sufficiently clear.
Where appropriate, the person making the report will be informed of the inadmissibility of the report and the reasons for this decision
Report follow-up:
If the report is admissible, the referral agents can convene the Ethics Committee.
The Ethics Committee will determine the procedure to be followed and will conduct the necessary investigations to verify the alleged facts.
It may be decided to launch an investigation, carry out an audit, or call in one or more experts or external consultants.
Via the Platform, the referral agent receiving the report will inform the whistleblower, within a reasonable period of time not exceeding 3 (three) months from the date of acknowledgement of receipt, of the measures planned or taken to assess the accuracy of the allegations and, if necessary, to remedy the matter.
If necessary, the company will take all necessary steps to remedy the situation in the report.
If the breaches are proven true, and depending on their seriousness, the report may be followed by disciplinary or legal proceedings against the persons implicated, depending on the case.
In addition to disciplinary and/or legal sanctions, Médiaperformances’ general management can identify areas for improvement in order to resolve any disfunction.
The report will be closed if the allegations are inaccurate or unfounded, or if the report has become irrelevant.
The person making the report will then be informed in writing that the file has been closed.
Personal data protection:
Data processed:
The data collected in the context of reporting and processing reports is subject to automated processing in the Médiaperformances data processing register.
The following data will be processed as part of this reporting system:
– The identity, positions and contact details of the person who made the report,
– The identity, positions and contact details of persons subject to a report,
– The identity, positions and contact details of persons involved in receiving or handling the report,
– Reported facts,
– Elements gathered as part of the verification of reported facts,
– Verification operation reports,
– The follow-up to the report.
Only information that is relevant and necessary for the purposes of processing is collected.
Purposes and legal basis of data processing:
Data is processed for the purposes of collecting and processing reports, carrying out the necessary checks and investigations, determining the action to be taken on reports, ensuring the protection of the persons concerned and the confidentiality of the identity of the person making the report and of the facts reported, and exercising or defending legal rights.
The legal basis for processing is the legal obligation arising from the provisions of law no. 2016-1691 of 9 December 2016.
Data recipients:
Data may be shared with the persons in charge of collecting and managing reports, to experts commissioned for the purposes of the investigation, and to the judicial authorities where appropriate.
Data retention and destruction:
Reports containing personal data will be stored, archived and/or destroyed in accordance with current regulations.
✓ For reports declared inadmissible: data will be destroyed or archived after anonymisation, in accordance with current regulations.
✓ For reports declared admissible:
– if the report does not result in any disciplinary or legal proceedings, the file will be closed without further action, and the personal data (relating to the identity of the whistleblower and of the person(s) concerned) contained in the documentation associated with the report will be destroyed or kept in the form of an intermediate archive in accordance with the regulations in force,
– if the report leads to disciplinary proceedings or legal action being taken against the person implicated or the person who made a frivolous report, the personal data contained in the documentation associated with the report is kept until the end of the proceedings or the time limit for appealing against the decision via the Platform.
Rights of data processing subjects:
Individuals whose data is processed have the right to access, rectify any erroneous data concerning them, and, in the cases provided for by the regulations, to oppose, delete certain of their data, have its use restricted or request its portability with a view to its transmission to a third party, as well as to determine how their data is used after their death.
The person concerned by a report may not, on the basis of their right of access, obtain the identity of the person making the report or of data relating to third parties.
The person concerned may exercise their rights:
➢ by post: Médiaperformances – Service Juridique / DPO Tour Alto – 4 place des Saisons 92400 Courbevoie
➢ by e-mail: dpo@mediaperf.com
In the event of unresolved difficulties, the relevant supervisory authority (CNIL) may be contacted.
Data security measures:
Médiaperformances takes all necessary precautions to protect the security of personal data.
As such, Médiaperformances complies with the provisions of European Regulation No. 2016/679 of 27 April 2016 (known as the “GDPR”) as well as the recommendations of the CNIL.
The Platform’s data centres are highly secure and ISO 27001-certified.
The data processed as part of this procedure is encrypted and stored in France.
Dissemination of the procedure:
The internal report system was the subject of information and consultation with employee representative bodies, in accordance with legal provisions.
This procedure is published online on the Médiaperformances website and intranet.