February 1, 2010
On December 8, 2009, the French Supreme Court issued a decision impacting companies having operations in France and subject to the "whistle-blowing" requirements provided for by Section 301(4) of the Sarbanes-Oxley 2002 Act.
In 2004 and 2007, Dassault Systèmes ("Dassault") – the holding company of the Dassault group – adapted its "Code of Business Conduct" (the "Code") to provide for a whistle-blowing procedure.
The Code described the procedure as being
"neither mandatory nor exclusive. Any person having knowledge of material breaches of the principles described in the Code of Business Conduct in financial, accounting or banking matters or relating to anticorruption issues and which deems it appropriate may communicate such breach to the designated persons within the DS Group. This procedure may not be used outside these areas. It may be used, however, in areas relating to the vital interest of the DS Group or the physical or mental integrity of a person (in particular in case of … discrimination or moral or sexual harassment)."
The French Supreme Court held that the Dassault whistle-blowing procedure was in breach of the Act on Computing and Liberties dated January 6, 1978 ("Loi informatique et libertés") (the "ACT").
As a matter of principle, the Act requires the National Commission on Computing and Liberties ("Commission Nationale de l’Informatique et des Libertés") (the "CNIL") to authorize the operation of any automatic data processing system in advance of its implementation. The CNIL, however, has created simplified declaratory procedures in a number of areas. Under a deliberation dated December 8, 2005 on the Unique Authorization on Personal Automatic Data Processing Implemented in Respect of Whistle-Blowing Procedures (the "2005 Deliberation"), whistle-blowing procedures may be subject to a mere prior declaration to the CNIL, provided the procedures do not exceed the scope of the 2005 Deliberation. The 2005 Deliberation limits the possibility to use the simplified declaratory procedure in connection with procedures implemented in connection with "financial, accounting or banking matters or relating to anticorruption issues".
The Dassault whistle-blowing procedure going beyond these areas, the French Supreme Court decided that it was in breach of the Act as it should have received the CNIL’s prior authorization.
The French Supreme Court also held that the Dassault procedure was breaching the Act in that it failed to provide for a right for any person affected by the whistle-blowing procedure to be informed, and have a right of access to, and of rectification of, any information collected in this manner.
Gibson, Dunn & Crutcher lawyers are available to assist in addressing any questions you may have regarding these issues. Please contact the Gibson Dunn attorney with whom you work, or Jean-Philippe Robé ([email protected]) or Virginie Barnier ([email protected]) at +33 1 56 43 13 00 in the firm’s Paris office.
© 2010 Gibson, Dunn & Crutcher LLP
Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.