One Size Fits All? Handling Public Health and Environmental Risks in French Whistleblowing Legislation

Abstract

French whistleblower legislation establishes a unified legal regime for the treatment of reports and for the protection of whistleblowers. Drawing on French whistleblower law, recently amended by the transposition of Directive 2019/1937 of 23 October 2019, this article examines whether the specific features of whistleblowing in relation to public health and environmental risks are adequately addressed by this unified regime. The article identifies four key factors for the effective handling of whistleblowing relating to public health and the environment: (1) the possibility of protecting whistleblowers who report facts gathered outside the workplace; (2) the possibility of protecting legal persons as whistleblowers; (3) the possibility of carrying out in-depth investigations to characterise the reality of the risks reported; and (4) the possibility of archiving whistleblowing in order to detect weak signals of risks over the long term. In these four areas, the article provides a nuanced diagnosis of the situation in French law and offers suggestions for improvement.

I. Introduction

The adoption of whistleblower legislation in the USA and in several European countries ¹ was primarily intended to protect whistleblowers from retaliation. Remarkably, Directive 2019/1937 of 23 October 2019 on the protection of persons who report violations of European Union (EU) law ² addresses both the protection afforded to whistleblowers and the procedures for receiving and handling whistleblowing reports. In all matters falling within its material scope – breaches of EU legislation ranging from infringements of internal market rules and financial offences to public security, public health, the environment and consumer protection (Article 2) – the Directive requires Member States to protect whistleblowers against retaliation and to set up internal and external procedures for the collection and processing of reports.

In all of these situations, a uniform whistleblower protection regime is needed: there would be no reason to protect whistleblowers from retaliation differently depending on the nature of the information they report. But a more nuanced assessment might be warranted with regard to the handling of reports, given that the nature of the facts reported by whistleblowers may differ greatly. While the characteristics of the wrongdoing have been shown to influence the decision to speak out, ³ the question of whether the same procedure is appropriate for collecting and processing all types of reports remains unresolved. Indeed, when a report relates to an infringement of the law (crime, offence, violation of the law or regulations), the fact reported may or may not exist; in many cases, investigations must be carried out to verify its existence, and then a decision must be taken to ensure that it ceases and, if necessary, to punish the perpetrator. For this purpose, the recipient of the report is generally vested with investigative powers to establish the reality of the fact reported, whether it is an employer or, a fortiori, a public prosecutor. In contrast, in the case of risks to public health and the environment, the situation is not so clear cut. A report may point to a known danger (eg exposure to asbestos fibres) but also an uncertain risk (eg exposure to a pesticide that may adversely affect public health). In the latter case, the aim cannot be simply to stop and punish unlawful behaviour. Rather, it is necessary to undertake investigations to document the existence of the purported risk and possibly take temporary precautionary steps. In this area, whistleblowing and expertise are inextricably intertwined. These specific features of reports on risks to public health and the environment may require adapting the procedures for collecting and processing reports provided for in the Directive of 23 October 2019, and possibly going beyond its provisions.

French whistleblowing law offers an appropriate terrain for such a reflection. The first reason for this is that France has experienced the difficulty of bringing together the reporting of violations of the law and the reporting of health and environmental risks in a unified legal framework. The drafting of French legislation indeed resulted from two developments, initially distinct, then converging. ⁴ One of them offered protection against reprisals to whistleblowers who reported corruption, ⁵ conflicts of interest ⁶ and crimes or offences more generally. ⁷ The other one provided protection for people who reported the existence of risks caused by medicines or cosmetics, ⁸ and later more broadly for those who disclosed serious risks to public health or the environment. ⁹ This legislation had the merit of covering a fairly wide range of protected disclosures. However, its fragmented approach and the small yet real differences that existed from one regime to the next attracted criticism. Following this criticism, a law was adopted on 9 December 2016, known as the Sapin 2 law, which aimed to harmonise the legislation. ¹⁰ It is the law of 2016 that was amended to transpose the Directive of 23 October 2019 into French law. Although this law was generally regarded in France as providing substantial protection for whistleblowers, as compared to many other European countries, it nevertheless did not comply with the requirements of the Directive in all respects. Modification was therefore inevitable. Interestingly – and that is a further reason for examining French whistleblowing law – the choice was made to proceed with an ambitious transposition, going far beyond the requirements of the Directive on certain key issues, in particular with regard to risks to public health and the environment. ¹¹ This resulted in the adoption of Law 2022-401 of 21 March 2022, ¹² which came into force on 1 September 2022 and was later supplemented by Decree 2022-1284 of 3 October 2022.

The Sapin 2 law of 2016, amended in 2022, offers a striking illustration of the difficulties encountered in France in reconciling the reporting of breaches of the law with that of risks. While the law of 2016, touted as a “law on transparency, the fight against corruption and the modernisation of economic life”, was essentially designed with a view to report violations of the law, its adoption quickly raised the question of whether the whistleblowing legislation was still suitable to handle reports concerning risks to public health and the environment. First, the Sapin 2 law repealed most of the provisions protecting whistleblowers reporting these matters, including the emblematic Article 1 of the law of 16 April 2013, which provided that “[a]ny natural or legal person has the right to make public or to disseminate in good faith information concerning a fact, data or action, when the lack of knowledge of this fact, data or action appears to him to pose a serious risk to public health or the environment”. Furthermore, the 2016 law stripped part of its prerogatives from the National Commission on Ethics and Alerts in Public Health and the Environment, ¹³ which had been created by the law of 16 April 2013 to oversee the ethics of expert agencies and to receive alerts in the fields of public health and the environment. ¹⁴ Moreover, the newly adopted definition of a whistleblower no longer mentioned the reporting of a risk to public health or the environment. According to the law passed on 9 December 2016, supplemented by the law of 21 March 2022 that included a reference to a violation of EU law, a whistleblower is defined as a natural person who reports, under certain conditions to which we will return, either:

information relating to a crime, an offence, a threat or harm to the general interest, a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France, of a unilateral act of an international organisation taken on the basis of such a commitment, of the law of the European Union, of the law or of the regulations. (Article 6)

Despite the removal of an express reference to risks to public health and the environment in the amended Sapin 2 law, it has been widely accepted that serious risks to public health or the environment were in fact included under the heading of “threat or harm to the public interest”. If there were any ambiguity in this respect, it is removed by the Directive of 23 October 2019. The fact that the Directive includes in its material scope the protection of the environment (Article 2, v) and public health (Article 2, viii) thus removes any possible doubt about the meaning of the reference to a threat or harm to the general interest in the Sapin 2 law, which must be interpreted in the light of EU law. It is worth noting, moreover, that the law of 21 March 2022 significantly amended the definition of whistleblowers provided for by the law of 9 December 2016, in addition to the aforementioned addition of violations of EU law among the protected disclosures. Whereas the law of 2016 referred to “a threat or serious harm to the general interest” (emphasis added), the law of 2022 deletes the reference to the seriousness of the threat, as it was feared that this condition would be too subjective and raise difficulties of interpretation. Furthermore, the material scope of application of the Sapin 2 law was broadened to include not only the violation of a legal norm but also an attempt to conceal such violation.

Yet, while it is acknowledged that health and environmental risks still fall within the scope of French whistleblowing legislation, the law of 9 December 2016, which as a whole represents a clear improvement, has, however, deteriorated the quality of the protection afforded to whistleblowers on certain specific points, without the law of 21 March 2022 reversing this situation. The weakening of whistleblowing on public health and environmental risks reflects deep political disagreements in France about what reports should be protected and how. While a broad consensus emerged on the need to protect whistleblowers reporting corruption or financial wrongdoing, the possibility of reporting health and environmental risks was met with significant reluctance by some political forces represented in Parliament, who feared that such reporting would expose companies to what was perceived as unwarranted environmental activism. ¹⁵ These concerns, which were made explicit in the discussions in Parliament, diverted attention from the requirements for proper reporting on health and environmental risks. Hence, we may ask, in adopting a uniform whistleblowing regime, has French legislation sufficiently addressed the particularities of the matters to which whistleblowers refer when they report a risk? Is a “one-size-fits-all” approach adequate in terms of receiving and handling alerts?

This article addresses this question by analysing the legal regime for whistleblowing that has been established in French law, with a particular focus on reports concerning public health and environmental risks. The article identifies four elements that are particularly necessary to ensure the effective handling of reports involving these matters. These four elements alone may not be sufficient to ensure appropriate handling of whistleblowing; moreover, they are also relevant for handling alerts other than those of risks to public health and the environment. However, the experience of the French National Commission on Ethics and Alerts in Public Health and the Environment, ¹⁶ which has received and handled more than 200 reports of risks to public health and the environment since 2017, has proven that these features are of crucial importance when it comes to public health and environmental risks. Indeed, the circumstances in which a large number of these reports occur point to the need for an alert system capable of receiving reports from ordinary citizens, at times brought together in legal entities, of carrying out in-depth investigations and expert appraisals and of collecting weak risk signals. These features are discussed in Sections II–V. Section II notes the importance of allowing reports to be lodged about information that has not been obtained in the course of professional activity. Section III shows the benefits of establishing effective protection for legal persons as whistleblowers. Section IV underlines the extent of the human, material and financial resources needed to deal with reports properly. Section V discusses the conditions under which the information gathered can be archived and processed in order to identify weak signals on emerging risks. On all of these grounds, the article discusses the extent to which French legislation on whistleblowing allows for adequate handling of risks to public health and the environment. Section VI concludes with a contrasting assessment of the current state of French law and outlines avenues for improvement.

II. Enabling whistleblowing outside the workplace

A first condition that a whistleblowing system would have to meet if it were to be adapted to the reporting of public health and environmental risks is that it would have to allow for the reporting of events discovered outside the workplace. Ayers and Kaplan have argued for a broad conception of professional communities, stressing the need for employees to be able to report wrongdoing by consultants outside the company’s workforce. ¹⁷ In the case of public health and environmental risks, the link between whistleblowing and professional activity needs to be relaxed even further. Indeed, in this field, reports are very often made by consumers, users of a service, dwellers suffering from pollution or citizens witnessing unauthorised dumping of toxic waste or suspecting a potentially higher-than-normal prevalence of cancer cases in a given area. ¹⁸ It is not uncommon that the citizens should have formed an association or a more informal grouping. In such cases, when the alert is given by local residents or consumers, the information has not, by hypothesis, been obtained in a professional context. Therefore, the protection of these whistleblowers would not be guaranteed if it were conditional on their being employees or civil servants and having obtained the information in the workplace.

Yet it is just such a restrictive approach that is advocated by the Committee of Ministers of the Council of Europe, which “recommends that member states have a normative, institutional and judicial framework to protect persons who, in the context of their working relations, report or reveal information concerning threats or harm to the public interest”. ¹⁹ The European Court of Human Rights has also found that the existence of a relationship of subordination between a whistleblower and their employer, and the resulting duty of loyalty, reserve and discretion, is “a special feature of the concept of whistleblowing”. ²⁰ This approach echoes Jubb’s view that loyalty to the organisation in which they operate is pivotal to the character of the whistleblower. ²¹ This restrictive stance may be understandable if one considers that the persons most in need of protection against retaliation are indeed those who are subject to a power of direction and sanction exercised by a hierarchical authority, as is the case of persons bound by a contract of employment or by a statutory civil service regime. ²² Directive 2019/1937 of 23 October 2019 has not much improved the situation for whistleblowers outside a professional organisation. Article 4 states that its provisions apply to “whistleblowers working in the private or public sector who have obtained information about violations in a professional context”. However, this argument is clouded by the fact that the Directive adopts such a broad conception of the professional framework that it goes far beyond the sphere of the exercise of hierarchical power. Indeed, in its Article 4 the Directive specifies that the persons entitled to make a report via an internal reporting channel, and who are thus protected against retaliation, should not be limited to those bound by a contract of employment or a statutory relationship, but should also include shareholders and members of the management body of a company including non-executive members, as well as trainees, or any person working under the supervision and direction of contractors, subcontractors and suppliers. In addition, persons who disclose information obtained in the context of an employment relationship after the end of their employment contract or before the formation of the contract of employment in the context of a hiring procedure are also protected.

As to whether the protection of whistleblowers should only benefit employees and civil servants, the law of 9 December 2016, in its initial version, was ambiguous. On the one hand, the law made whistleblower status conditional on reporting facts of which the whistleblower had “personal knowledge”. No reference was made, in the definition of whistleblowers, to obtaining information in the workplace. But, on the other hand, the law made the protection of whistleblowers conditional on compliance with the procedures set out in Article 8, which demanded that the report be made first to a superior. ²³ This procedural requirement would therefore limit the protection of the law to persons in a professional setting where an internal reporting channel must be in place. This apparent inconsistency led to the law being challenged on the grounds that it was contrary to the constitutional objective of the accessibility and intelligibility of the law. The French Constitutional Court refused this argument, however, and ruled that the legal definition of whistleblowers “is intended to apply not only to the cases provided for in Article 8, but also, where appropriate, to other [ie possible future] whistleblowing procedures decided by the law, outside the professional framework”. This ruling therefore leaves the door open for the protection of whistleblowers reporting facts obtained outside the professional context, but it confirms that no such protection is provided under the Sapin 2 law of 2016.

In this regard, the law of 21 March 2022, transposing Directive 2019/1937, introduces a dramatic change. It now provides that whistleblowers may choose to report internally (in companies with more than fifty employees and a large number of public administrations) or to address a competent authority through an external reporting channel. Thus, while the protection of whistleblowers remains conditional on compliance with the reporting procedures provided for by the law and while the Directive encourages internal reporting, ²⁴ whistleblowers working in a professional capacity are no longer obliged to report first to their line manager. Logically, if a whistleblower chooses to report through an internal reporting channel, the information must have been “obtained in the course of their professional activities”. Indeed, as the report is made within a private or public entity, it is necessary that the information concerns this entity and that it has the capacity to process it. Conversely, when a report is directed to an external reporting channel, the information need not have been obtained in the course of a professional activity. The effect of allowing whistleblowers to choose whether to use an internal or external reporting channel is debatable. The factors that determine the use of one or the other of these reporting channels have been extensively studied, in a variety of organisational settings. ²⁵ The change introduced in the French legislation, following the possibility given by the Directive to establish the use of internal and external channels as an alternative, ²⁶ hinges on the premise widely defended by non-governmental organisations supporting whistleblowers – although some studies suggest the opposite ²⁷ – that an obligation to report through an internal channel increases the risk of retaliation against whistleblowers where the supervisor is associated with or chooses to cover up the reported misconduct, and ultimately discourages reporting.

As a consequence of these changes in the French legislation, residents, consumers, users and citizens raising concerns about a risk to public health or the environment now have the option of turning to a competent authority designated by the decree of 3 October 2022. Provided that they comply with the conditions set out in the amended Sapin 2 law (reporting “without direct compensation and in good faith”) and that they abide by the procedural conditions of external reporting, they benefit from the protection against reprisals provided for by the law. As a further consequence of this change, and pursuant to the provision of the Directive (Article 19), the law of 21 March 2022 no longer limits the list of prohibited retaliatory measures to those related to a work situation (dismissal, disciplinary measures, demotion or withholding of promotion, etc.), but includes a wider range of sanctions that have bearing outside the work sphere: damage to a person’s reputation, early termination or cancellation of a contract for goods or services, cancellation of a contract for goods or services, etc. (Article 10-1 of the amended Sapin 2 law).

III. Protecting legal entities as whistleblowers

As reports of risks to public health and the environment are frequently made by associations and more informal “collectives”, the law of 16 April 2013 conferred adequate protection upon both natural and legal persons as possible whistleblowers. The law of 9 December 2016 reversed this provision and granted protection only to natural persons. This step backwards was to be regretted, since one effective way of protecting whistleblowers is to allow them to step behind a legal entity that makes the disclosure on their behalf and hopefully has the legal competence and financial resources to deal with possible reprisals. ²⁸ Recognising the status of whistleblower for a legal person is therefore of undisputed interest.

In this respect, the Directive has allowed only very limited progress. Indeed, it defines a reporting person as “a natural person” (Article 5), and, similarly, when extending protection against retaliation to so-called “facilitators”, the Directive defines them as “a natural person who assists a reporting person in the reporting process in a work-related context, and whose assistance should be confidential” (Article 5). Only marginally does the Directive grant protection to legal persons: legal entities owned by a whistleblower, for which they work or with which they are connected in a business context, are afforded indirect protection (Article 4.4.c).

In transposing the Directive, however, the French Parliament followed a recommendation by associations supporting whistleblowers and took a more protective stance towards legal persons, deciding that facilitators can be not only natural persons, as the Directive provides, but also non-profit legal persons under private law (Sapin 2 law amended, Article 6-1). This wording – the reference in the law to non-profit legal persons rather than to legal persons in general, as proposed in an earlier version of the bill – reflects the fear of some members of the Parliament that a market could emerge in which economic operators would trade in the support of whistleblowers and offer, against payment, to help them to lodge a report. This fear was perhaps ill-founded, since in France the law expressly provides that whistleblowers are only protected if they act “without direct financial compensation”. Unlike in the USA, ²⁹ and with only rare exceptions, ³⁰ whistleblowers in France would not be permitted to claim a fraction of the sums recovered by the State, through tax proceedings or fines, following the disclosure of unlawful facts. In France, the absence of financial compensation for whistleblowing has always been seen as a condition for the legitimacy of whistleblowing procedures. ³¹ Since whistleblowing remains an act without financial compensation, the risk of a whistleblower support market developing in France remains rather hypothetical.

Under these conditions, local residents’ or consumers’ associations raising public health and environmental concerns can be deemed “facilitators” and so protected against retaliatory measures. This development is certainly to be welcomed and might facilitate whistleblowing in the field of public health and environmental risks. However, it has two important limitations. On the one hand, groups of people assisting whistleblowers need to be aware of the importance of setting themselves up as legal entities in order to benefit from the protection provided by the law to facilitators. If, on the other hand, they were to choose, as is often the case, to set up more informal organisations, such as “collectives” or “coordinations”, only the individual protection extended to the facilitators would be open to them. Yet in any case the protection of legal persons remains indirect, since they are protected as “facilitators” and not as whistleblowers per se. Consequently, an association created to campaign against a public health or environmental risk would not be able to blow the whistle on its own, without a natural person agreeing to raise an alert individually, with all of the risks of reprisal that this move entails. Although it is certainly a step forward that health and environmental associations enjoy appropriate protection as facilitators, recent legislative developments have still not succeeded in restoring the situation created by the 2013 law that recognised, in the field of health and environmental risks, legal entities as possible whistleblowers.

IV. Giving authorities the means to handle the reports received

In the field of public health and the environment, it is essential that the alerts received give rise to investigations to ascertain the existence of the risk reported and that appropriate measures are implemented to prevent or remove exposure to these risks. It is therefore crucial that the addressee of an alert has a real investigative capacity and the necessary skills to deal with the alert.

With regards to reporting to internal channels, the reception and processing of health and environmental reports are governed by occupational health and risk-prevention law. Thus, the law of 16 April 2013 affords both employees and their elected representatives the right to report. Reports concerning a serious risk to health or the environment caused by the products or manufacturing processes used or implemented by a company must be recorded in a special register and be investigated by the employer jointly with the elected representatives. ³² The employer must also inform the reporting person, whether an employee or a representative, of the action they intend to take on it. If these are found to be inappropriate, the reporting person may refer the matter to the prefect, the representative of the State in the department.

As regards the external reporting channel, the decree of 3 October 2022 provides a list of the competent authorities responsible for receiving and processing reports. In the field of environmental damage, external reporting may be directed to a body of civil servants responsible for advising the government and inspecting services (the Inspectorate-General for the Environment and Sustainable Development; IGEDD). In the field of public health, no fewer than sixteen external authorities are identified by the decree, some of which are public expertise agencies, ³³ others public agencies responsible for specific public policies ³⁴ or for compensating victims, ³⁵ specialised research organisations, ³⁶ service inspection authorities ³⁷ and professional institutions responsible for monitoring health professionals. ³⁸

A first obvious difficulty is the fragmentation of the authorities entitled to receive external reports in the fields of public health and the environment. Although the National Commission on Ethics and Alerts in Public Health and the Environment (cnDAspe) covers all of these matters and has unique experience in dealing with alerts in these areas, it was not designated as an external authority in the decree of October 2022, and the choice was made instead to entrust this competence to various authorities with heterogeneous functions. This decision reflects the difficulty for this Commission to find its place among the institutions in charge of risk assessment and management. Created by the law of 16 April 2013 referred to above and hampered by the political opposition it encountered from the outset, ³⁹ the Commission’s prerogatives have been continuously challenged, against a background in which the institutions responsible for the assessment and management of health and environmental risks in France are already fragmented. The identification of a number of external authorities to receive reports in these areas only makes things worse, and there is a serious risk that whistleblowers may not find their way through this complicated maze. ⁴⁰ In an attempt to limit this risk, the law of 21 March 2022 therefore entrusts the Defender of Rights with the role of helping whistleblowers to choose the most appropriate external authority to receive their report.

A second difficulty lies in the way in which protected disclosures are distributed between the competent authorities. While the competence of the cnDAspe covers both public health and the environment, the new legislation splits the two areas and directs alerts concerning the environment to other authorities than those competent for public health reports. This choice amounts to foregoing the means to deal with environmental health, a matter that is nevertheless the subject of assertive public policies both in the EU ⁴¹ and in France ⁴² and that might thereby be weakened.

A third difficulty concerns the means available to the external authorities designated in the decree of 3 October 2022 to enable them to take effective action on the reports received. The Directive requires that “Member States shall designate the authorities competent to receive, give feedback and follow up on reports, and shall provide them with adequate resources” (Article 11). Yet the external authorities listed in the decree to receive alerts on public health and the environment have very heterogeneous investigative powers. While general inspectorates have the power to obtain documents or conduct hearings, this is very much not the case for expertise or research bodies. Similarly, the professional bodies responsible for monitoring health professionals have disciplinary powers over their members that are lacking to expertise and research bodies, or even general inspectorates, which can only refer matters to the ministers. In any case, few of the authorities listed in the decree have experience in collecting and processing alerts: their core competence lies instead in expertise, research, administrative control and management of specific public health policies. Consequently, the handling of reports is a new prerogative for these authorities, which will require a new internal organisation, sufficient resources in terms of staff and IT support and enhanced investigation capacities. The scale of the resources that would be required to handle alerts properly has been rightly noted by the deputy, Cécile Muschotti. In a parliamentary report, she outlined a proposal for a position of Defender of the Environment and Future Generations (DDEGF) modelled on the Defender of Rights, who would have strong investigative powers in the area of environmental offences. Yet this suggestion was not followed up in the transposition of the Directive of 23 October 2019. ⁴³ On the contrary, the task of receiving and processing alerts has been added to the existing burden of heterogeneous authorities with fixed budgetary resources. There is therefore a legitimate fear that the resources necessary for the proper handling of alerts are not available, or at least that there will be contrasting treatment from one external authority to another. There is also reason to fear that the limitation of available budgets will render largely nugatory the possibility, opened up by the 2019 Directive (Article 20) and taken up by French law, for external authorities to provide whistleblowers with financial assistance and support, including psychological support. ⁴⁴

V. Collecting weak risk signals

Where a risk, whether known or unknown, has occurred, the damage to public health and the environment is evident. But in some cases the reported risks are themselves uncertain. The fact that the information transmitted is not fully established does not disqualify it from being a protected disclosure. The requirement of good faith, set out in the Sapin 2 law as a condition of benefitting from whistleblower protection, means that the whistleblower may have legitimately believed that the facts reported were correct, even if it appears in retrospect that this was not the case. Whistleblower protection is only excluded if it is proven that the whistleblower had knowledge of the inaccuracy of the facts reported, a proof that is de facto difficult to provide. Hence, there is a need to conduct an investigation upon receipt of a whistleblower’s report in order to confirm or deny the risk reported.

In the field of public health and the environment, detecting early warnings is key, ⁴⁵ and whistleblowers have an important role to play. ⁴⁶ From this point of view, although the primary objective of health and environmental alert systems is to identify and terminate current exposure to risks, they also offer a significant opportunity to use the information so gathered as a means of assessing weak signals that may eventually lead to the characterisation of as-yet unknown risks. Given the time scales over which risks materialise – some risks become apparent after several decades or even have intergenerational effects (as in the case of diethylstilbestrol) ⁴⁷ – it is crucial that the information being collected is kept over the long term.

Yet the 2019 Directive requires that recipients of alerts “keep records of every report received, in compliance with the confidentiality requirements …. Reports shall be stored for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Directive, or other requirements imposed by Union or national law” (Article 18). Following the directive, the law of 21 March 2022 provides that the information reported should be kept only for “the time strictly necessary and proportionate for their processing and for the protection of the authors, the persons concerned and any third parties mentioned in the report, taking into account the time needed for any further investigations”. However, the law goes further than the Directive requires. After consultation with stakeholders and in particular at the request of the National Commission on Ethics and Alerts in Public Health and the Environment, the rapporteur for the bill in Parliament amended the text to allow that “[d]ata relating to alerts may, however, be kept beyond this period, provided that the natural persons concerned are neither identified nor identifiable” (Article 9 III of the amended Sapin 2 Act).

French law thus allows for the conservation of information collected through whistleblowing, and hence for the conservation of weak signals that may be indicators of possible risks to public health or the environment. The possibility thus granted by the law to preserve weak risk signals should make it possible to put in place more robust risk assessment procedures, based on relevant information collected cumulatively over time from different reports. However, the question remains as to the conditions under which the external authorities competent to receive reports through external reporting channels concerning public health and the environment are able to archive these data over the long term and ensure their statistical processing in order to highlight possible correlations requiring further investigation of a possible risk. Clearly, the external authorities designated by the decree of 3 October 2022 do not have the material and human resources, nor the organisational culture, to ensure effective processing of weak risk signals. It is therefore desirable that public health and environmental alerts be transmitted to a single authority, which would be responsible for centralising them, archiving them and exploring the data thus collected in order to identify risks that the external authorities to which the report was initially sent would not have been able to identify.

VI. Conclusion

Building on the experience gained by the National Commission on Ethics and Alerts in Public Health and the Environment, this article identifies four conditions that are proving to be crucial to ensuring appropriate treatment of public health and environmental risks: (1) it is necessary to protect not only whistleblowers who report information they have come across in the course of their work, but also those who report information gathered outside their professional activity; (2) it is necessary to protect legal entities as whistleblowers in order to reduce the risk of retaliation against whistleblowers as individuals; (3) authorities setting up external reporting channels must have appropriate human, IT and financial resources to ensure effective processing of the alerts received, which implies inter alia that they should have the capacity to carry out effective investigations in order to establish the facts about the risks reported; and (4) there is a need to collect, keep records of and ensure effective processing of weak signals in order to highlight downstream risks that may go under the radar at the time of reporting but are confirmed in the medium or long term. These four elements are hardly the only conditions for appropriate handling of whistleblowing: secured and confidential reporting channels, proper information on the existence of reporting channels and, of course, adequate protections for whistleblowers against reprisals are all equally important aspects. Moreover, they may also be relevant for the processing of alerts on issues other than public health and environmental risks. However, the four features highlighted above are most critical to properly addressing two distinctive characteristics of reports on risks to public health and the environment. On the one hand, these reports are most often brought forward by ordinary citizens (local residents, customers, users of services), possibly constituted in legal entities (eg associations), rather than by employees or civil servants in the context of their professional activities. On the other hand, given the uncertainty that may impact health and environmental risks, the authorities receiving the reports must have access to appropriate investigation techniques and expertise, as well as the possibility of keeping track of weak risk signals. If the four conditions identified in this article are not met, the ability of states to ensure effective handling of health and environmental alerts could be seriously undermined. They therefore constitute a relevant yardstick against which to assess the relevance of the health and environmental alert systems put in place by the Member States on the occasion of the transposition of Directive 2019/1937 of 23 October 2019.

As regards French law, the legislation resulting from the transposition of the 2019 Directive undeniably allows for better consideration of the specificities of handling public health and environmental alerts: it disconnects the alert from the obtaining of information in a professional setting; it protects health and environmental organisations as “facilitators”; and it allows the conservation and processing of information over a period compatible with the timeframes in which certain risks materialise. However, with regards to the handling of alerts, the legislation certainly needs to be strengthened. Most external competent authorities do not have a culture of handling alerts and do not have sufficient resources either to carry out the necessary investigations or to detect weak risk signals. In this respect, there is a striking contrast between the modest resources available to external authorities for dealing with public health and environmental alerts and the much more substantial resources available to external authorities for receiving alerts about breaches of law and regulations, such as the French Anti-Corruption Agency in the field of anti-corruption or the Defender of Rights in the field of anti-discrimination. The effective handling of alerts on public health and the environment therefore requires a strengthening of the investigative powers of the external authorities responsible for receiving these alerts so that they can obtain additional information to assess the reality of the risks brought to their attention. The link between reporting and expertise, which was at the heart of the law of 16 April 2013 and was to a large extent undone by the Sapin 2 law of 9 December 2016, must be clearly reaffirmed and coupled with real and effective legal investigative powers.