France

General context, key principles and hot topics

1Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

The year 2019 marks a new era in the implementation of anti-corruption and financial crime measures in France. The UBS decision notably shows that the French authorities – and the National Financial Prosecutor (PNF) in particular – intend to adopt a more hard-line approach that has a noticeable effect on companies that violate French law. UBS, which chose to stand trial rather than settle through the French equivalent of a deferred prosecution agreement (a CJIP), was convicted on 20 February 2019 and ordered to pay a €3.7 billion fine and €800 million in damages to the French state for unauthorised banking solicitation, aggravated tax fraud and money laundering – the highest sentence to date imposed on a company for these offences. The choice to leave it to the courts, resulting in a considerably higher payout, has raised the question of the judicial strategy that prosecuted companies should adopt in such cases. Some have concluded that recourse to a CJIP would have been beneficial, while others await the decision of the appeal court, arguing that UBS has strong judicial arguments in defence.

Following the introduction of the CJIP, the French authorities clearly defined the first sets of rules: the Anti-Corruption Agency (AFA) and the PNF have published guidelines detailing the criteria to be taken into account when concluding a CJIP and assessing the fine.

A new CJIP has been signed between the PNF and Google following the failure by Google Ireland Ltd to subscribe to declarations to corporate income tax for the tax years 2011 to 2014. In this CJIP in the area of tax fraud, the PNF acted jointly with the tax authorities, which also entered into an agreement with Google regarding tax matters.

Another CJIP is pending with Airbus, which is currently under investigation. Since 2016, the aircraft manufacturer has been co-operating with the PNF and the UK’s Serious Fraud Office in connection with allegations of corruption. The US Department of Justice (DOJ) subsequently joined the French–English investigation pool on a regulatory aspect: Airbus is alleged to have repeatedly omitted certain statements to the US authorities regarding the sale of weapons. This case is a renewed illustration of the tendency for international coordination between foreign authorities prosecuting the same facts. It is yet to be determined whether the prosecution pool will take the Société Générale case as an example case and coordinate a multi-jurisdictional settlement.

2Outline the legal framework for corporate liability in your country.

Corporations can be held liable on both civil and criminal grounds. Corporate criminal liability is limited to ‘offences committed on [companies’] account by their organs or representatives’, namely for actions committed by persons who exercise direction, administration, management or control functions, or by persons who act on behalf of an identified delegation of power that meets specific criteria. Thus, corporate liability does not exclude individual liability.

From 2006, a new trend in case law appeared, by which the Criminal Division of the French Supreme Court (the Court of Cassation) found corporations liable without identifying an organ or representative, relying instead on facts that reflect an endorsement by company management. The Criminal Division has nevertheless reiterated that corporate criminal liability implies the identification of an organ or a representative.

3Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

Enforcement authorities include judicial and administrative authorities. For the most part, jurisdiction between the authorities is based on subject matter, with numerous opportunities for co-operation – and competition – between authorities.

Each superior court has jurisdiction over offences committed within its territory or based on the location of headquarters. Specialised interregional courts have jurisdiction over economic and financial matters of some importance or complexity and whose scope involves several jurisdictions. Some particular fields fall within the scope of specialised sections of the prosecution authorities in Paris; for example, terrorism, war crimes and human rights, health and safety, and the environment. The aforementioned PNF was created in 2013 to deal with breaches of probity, public finance and proper functioning of the financial market.

Alongside judicial authorities, the main administrative authorities with jurisdiction over corporations are the French financial markets authority (the AMF, which regulates the integrity of financial markets, ensuring investor protection and information, and preventing market abuse), the Competition Authority (which conducts sector enquiries, antitrust activities, merger control, and publishes opinions and recommendations), the French supervisory and resolution authority (the ACPR, which investigates wrongdoing, issues warnings and sanctions French banks), the tax authority within the Ministry of Finance and the AFA (which controls, sanctions and monitors the implementation of anticorruption programmes by companies to which the Sapin II Law applies).

4What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

In respect of criminal offences, there is no minimum standard for a prosecutor to request enquiries to be carried out; prosecutorial discretion is considerable. In practice, investigations are opened after a complaint, self-report or flagrante delicto. If the matter is particularly complex, prosecutors may turn it over to an independent investigating magistrate to carry out a comprehensive investigation into the facts and give an opinion as to guilt. Investigating magistrates can also be required to investigate pursuant to a specific complaint filed by alleged victims, including, under specific conditions, non-government organisations.

Investigations can also stem from authorities’ detection of suspicious activities within their material jurisdiction (e.g., if mandated by a foreign authority, responding to a report from a whistleblower or an alert triggered by the anti-money laundering branch of the Ministry of Finance (TRACFIN), or owing to a legal obligation to support facts that may constitute a criminal offence).

5How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Although exceptions do apply (e.g., the AFA), it is unlikely that an enforcement authority would use a notice or subpoena to collect documents or data. There is little ground for challenging such a request if it is within the scope of the authority’s prerogatives and respects the legal requirements (see question 25). The company may argue against communicating data and documents that are covered by attorney–client privilege or medical secrecy, for instance.

6Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

As such, there is no co-operative agreement that grants immunity or leniency for individuals. At the Société Générale CJIP (SG CJIP) certification hearing, Mrs Houlette, former president of the PNF, stressed that the company’s co-operation had been taken into account in determining the penalty. The provisions of the CJIP do not create incentives for legal representatives to report misconduct as they remain personally liable for their actions during the performance of their work and the CJIP will only benefit the company. Similarly, whistleblower status does not provide for situations in which the person would agree to reveal his or her actions either. However, the guidelines enacted by the PNF regarding CJIPs expressly encourage the co-operation of legal persons to be eligible for the procedure and minimise the amount of any fine imposed.

7What are the top priorities for your country’s law enforcement authorities?

The two main priorities for enforcement authorities are tax evasion – for individuals and corporations – and corruption. Since it was created, the PNF has aggressively moved to fight tax evasion, including in instances when the tax authorities themselves have decided not to impose sanctions, by relying on money-laundering offences. The PNF’s ability to prosecute tax evasion has been extended by reducing the power of control and appreciation of the Ministry of Economy in this area.

The PNF currently has more than 240 open probity offences cases, of which 10 per cent involve international corruption. The Sapin II Law created the AFA – headed by a senior former investigating magistrate – which has carried out many audits of compliance programmes and, where a suspicion of crime is identified, referred the facts to the PNF.

Cyber-related issues

8Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.

Cybersecurity is a national priority in France. During the past 10 years, France has adopted a comprehensive framework at different levels to address the specific issues of cybersecurity: the central office for the fight against crimes linked to information and communication technologies within the National Police Office, the centre for the fight against digital crimes within the National Gendarmerie and the brigade for the investigation of information technology fraud within the Paris Prefecture. The National Information Systems Security Agency (ANSSI), created in 2009, is the national authority in the area of cyber-defence and network and information security. ANNSI’s missions target government departments and public services, businesses and operators of vital importance, and aims to provide a proactive response to cybersecurity issues.

At the European level, a Regulation was adopted on 17 April 2019 on the European Union Agency for Cybersecurity (ENISA) and on information and communications technology cybersecurity certification (the Cybersecurity Act), giving ENISA a permanent mandate while strengthening its role and establishing an EU framework for cybersecurity certification.

As regards the enforcement of cybersecurity-related failings, when it comes to data protection, a failure to implement cybersecurity measures is an administrative offence, subject to administrative fines and civil liability (see question 22). Further, pursuant to the Law on Military Programming dated 26 February 2018, those with the status of ‘operators of vital importance’ have an obligation to implement a cybersecurity framework. Failure to comply is sanctioned by the French Criminal Code.

9Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

The legal framework for tackling cybercrime in France has grown steadily in recent years. Most of the tools used to regulate cybercrime are inspired by the Budapest Convention signed by the European Council on 23 November 2001. The French Criminal Code penalises cybercrimes relating to offences such has hacking and denial-of-service attack, and the French Code of Intellectual Property further sanctions phishing and possession or use of hardware used to commit cybercrime. These offences are punishable by imprisonment and fines of up to €375,000.

In addition, French law provides for an extra­territorial application of its provisions since a cyber offence is deemed to have been committed in France (i.e., committed through an e-communication network to the detriment of a person in France or a company with its registered office in France). The implementation of cybercrime regulations is coordinated by the Ministry of the Interior, in collaboration with the ANSSI and dedicated police services.

Cross-border issues and foreign authorities

10Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

Criminal law can have an extraterritorial effect, based on the nationality of the perpetrator or the victim. It is applicable to any crime committed by a French national outside French territory. It is also applicable to a misdemeanour (délit) committed by French nationals outside French territory if the conduct is punishable under the legislation of the country in which it was committed (double criminality). French criminal law also applies to any felony, and to any misdemeanour punishable by imprisonment, committed by a French or foreign national outside French territory when the victim is a French national. The extraterritorial effect of French criminal law can also apply when an element constituting the offence takes place on French soil.

The extraterritorial reach of French criminal law can also apply in other limited circumstances, for instance when fundamental interests of the nation, diplomatic or consular premises are targeted. The Sapin II Law extends the extraterritorial effect of criminal law for corruption and influence peddling offences involving non-French perpetrators. French criminal law applies to acts of corruption or influence peddling committed abroad by a person carrying out all or part of their economic activity in the French territory.

11Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

To a large extent, pressure to increase enforcement of international financial and corruption issues comes from the United States, and co-operation with the United States usually works well in those matters, despite regular tensions and the overall impression that US prosecutions are, at least in part, carried out in support of US industry. Co-operation with other EU Member States is generally smooth.

Concern arises from the blocking statute that applies when a foreign authority is involved. The purpose of the statute is to prohibit compelled communication of virtually any information of commercial value without some involvement of French authorities. It carries both a fine and a prison term for violations. Appropriate contact with the French authorities that have been taking the lead in explaining its legitimacy, should mitigate risks – the AFA is tasked with ensuring observance of the French blocking statute, in the context of corporate compliance programme obligations imposed on French companies by foreign authorities.

EU-wide data protection and privacy rules are enforced by the French Data Protection Authority (CNIL), and the right of privacy of individual employees and the management of personal information should be properly addressed. The EU’s General Data Protection Regulation (GDPR), adopted in France on 20 June 2018, has introduced new rules on communication of personal data to foreign authorities and requires, pursuant to Article 48 of the GDPR, without prejudice to any other grounds for cross-border transfers, that any transfer of personal data be based on international conventions such as mutual legal assistance treaties. Although burdensome, both can be dealt with effectively by addressing the privacy issue as a firm policy and complying with data protection rules.

12Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

The principle of double jeopardy is enshrined in Article 14.7 of the International Covenant on Civil and Political Rights, Article 50 of the Charter of Fundamental Rights of the European Union and Article 4 of Protocol No. 7 to the European Convention on Human Rights.

However, the French state has made an exception in the interpretation of Article 4 of Protocol No. 7, limiting the application of the rule to offences falling within the jurisdiction of courts ruling in criminal matters. On 11 September 2019, the Court of Cassation confirmed this restriction, refusing to consider that previous tax sanctions fell into the scope of the previous criminal sanctions authorising the application of the double jeopardy principle.

Another exception is provided by French criminal law, which states that there is no extraterritorial application of the double jeopardy principle.

On 14 March 2018, in a decision regarding the Oil-for-Food Programme, the Court of Cassation confirmed that Article 14.7 of the UN International Covenant on Civil and Political Rights applies only when both proceedings are initiated in the territory of the same state, and refused consequently to apply the double jeopardy provision to a US deferred prosecution agreement.

The European Court of Human Rights (ECHR) adopted a similar position on the ne bis in idem principle in the Krombach case. The applicant argued that the German decision to drop charges prevented France from prosecuting him for the exact same facts. This indicates that a foreign decision does not automatically have res judicata in another state, in line with recent French Court of Cassation decisions on the issue.

Although this appreciation by French case law and the fact that there is no equivalent to the US ‘anti-piling on’ policy in the current French legal landscape, that situation may change. Indeed, on 6 June 2019, France was convicted by the ECHR for violation of the ne bis in idem principle (Nodet v. France, Case No. 47342/14). The case involved a double penalty from the AMF and the criminal courts for market offences. The ECHR calls France to encourage the various authorities to ensure that each procedure is duly considered and that the overall amount of all penalties is proportionate.

13Are ‘global’ settlements common in your country? What are the practical considerations?

Multiple authorities often investigate the same facts at the same time. There is no particular procedure for global settlements as relationships vary from co-operation to competition and sometimes lead to a race to a decision. A prior sanction or decision on the same facts will be taken into account by the other authorities involved. However, the CJIP agreed with Société Générale in 2018 (the SG CJIP) demonstrates an intent for stronger co-operation between authorities in the coming years (see question 14).

14What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

See question 12.

If a foreign court decision could be recognised by the French jurisdiction, the French authorities could decide to open their own investigation or to send the case before the French tribunals. However, the emerging trend is towards co-operation between French and foreign authorities. Efforts to co-operate with foreign authorities arise in the SG CJIP, for instance, although the US authorities were the first to open an investigation, as early as 2014. The PNF started working with the DOJ, reciprocally communicating details of the investigation on account of the mutual legal assistance treaty. It was determined that the fine would be divided equally between the DOJ and the PNF and the monitoring would be carried out by the AFA.

Economic sanctions enforcement

15Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

The implementation of economic sanctions in France is essentially part of UN sanctions policy and the EU Common Foreign and Security Policy. Restrictive measures (such as asset freezes, embargos, commercial restrictions) are enforced by a European Council decision supported by EU Regulations and are directly binding on EU Member States. Unilateral measures can also be implemented by national decree or order. The sanctions may target governments of foreign countries, non-government entities and individuals. France’s Ministry of Europe and Foreign Affairs oversees the implementation of any sanction decided at European level and is assisted by several ministries. On 17 May 2019, the Council of the European Union extended the economic sanctions against the Syrian government until June 2020, as the repression of Syria’s civilian population continues. France officially acknowledged this extension by a decree dated 13 June 2019. The sanctions currently in place against Syria include restrictions on certain investments, a freeze of assets and an oil embargo. As regards the latter, the company LafargeHolcim has been prosecuted in France for violation of this embargo.

16What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Economic sanctions are an instrument of France’s foreign policy and, as an EU Member State, it follows decisions laid down by the European Union. Nevertheless, autonomous measures can also be taken by each Member State. During the past few years, there has been an increase in measures to fight terrorism financing. For that purpose, the French Monetary and Financial Code entitles the Minister of Economy to order the freezing of assets belonging to individuals or legal entities who commit, or attempt to commit, terrorist acts, or who facilitate or participate in such acts (Articles L 561 and L 562). The French Directorate-General of the Treasury, which is the authority in charge of economic sanctions, published (on 17 June 2019) the updated version of the Guidelines drafted with the ACPR on the implementation of French economic sanctions.

17Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

As part of a multilateral decision system, economic sanctions shall result from a collective implementation and co-operation. Nevertheless, there is a lack of precedent relating to implementation of sanctions in French law, and the LafargeHolcim case might create the first guidance if it goes to trial. In addition, there is still no general provision to criminalise the violation of economic sanctions, although a bill for this purpose was considered by the French Parliament in 2016.

18Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

On 22 November 1996, in response to extraterritorial legislation in force at the time against Cuba, Iran and Libya, the European Commission adopted Council Regulation (EC) No. 2271/96 protecting against the effects of the extraterritorial application of legislation adopted by a third country, and actions based thereon or resulting therefrom (the Blocking Regulation). This Regulation is directly enforceable in France. The measure forbids EU citizens from complying with third-country extraterritorial sanctions unless exceptionally authorised to do so by the European Commission (as set forth in Commission Implementing Regulation (EU) 2018/1101). On 6 June 2018, the Blocking Regulation was updated by the European Commission (Council Regulation (EC) No. 2271/96), adding to its scope the extraterritorial sanctions that the United States reimposed on Iran in August 2018.

19To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Although the Blocking Regulation sanctions EU companies that would comply with third-country sanctions, the measure has much more of a symbolic effect than an economic one. It has only been applied in 1998 in the context of a complaint filed by the European Communities before the World Trade Organization. As regards the US sanctions on Iran, experts are sceptical about how far Europe will ultimately go to enforce such a rule. It could also prove difficult to enforce, in part because of the international banking system and the significance of the United States in international financial markets.

Before an internal investigation

20How do allegations of misconduct most often come to light in companies in your country?

Whistleblowers are an increasingly common source of disclosure of misconduct within corporations (see question 28).

As some specific professions – including financial institutions – are required to report any suspicious activity to TRACFIN, anti-money laundering reports have generated several high-profile cases.

The Sapin II compliance requirement is likely to create a new compliance culture. The transitional phase is likely to generate its share of new matters.

Extensive freedom of the press and protection from disclosure of journalists’ sources have led mostly web-based media to reveal facts resulting in prosecution of key political figures in recent years.

Under specific conditions, non-government organisations (NGOs) can initiate criminal procedures. Several landmark corruption investigations have been initiated by NGOs in recent years. For instance, in 2016, the NGO Sherpa filed a complaint against the cement group LafargeHolcim for alleged terrorist financing in Syria. In 2007, the Sherpa initiated criminal proceedings by a joint complaint with Transparency International France on charges of ill-gotten goods against the son of the president of Equatorial Guinea.

Information gathering

21Does your country have a data protection regime?

France adopted a data protection regime in 1978 with the Law on Information Technology, Data Files and Civil Liberties. Legislation has been amended to integrate the GDPR in France’s internal legislative framework. Law No. 2018-493, which was passed on 20 June 2018, serves to incorporate the GDPR legislative updates within the existing 1978 Law.

22To the extent not dealt with above at question 8, how is the data protection regime enforced?

Law No. 2018-493 grants new investigating and sanctioning powers to the CNIL. The major change of this law is that, except for the processing of certain sensitive data and data controllers no longer having to file CNIL declarations, data processing is no longer subject to former formalities. Through the GDPR, data controllers have more prerogatives, having to maintain a record of the processing of data and notify any data protection violation without undue delay.

The right to information and the right of access, rectification and deletion of personal data for the individual are reinforced and the sanctions in the event of obstruction or non-compliance with the legal provisions are increased. The CNIL has the power to impose a periodic penalty (limited to €100,000 per day) in addition to administrative fines (which can be as much as €20 million or 4 per cent of annual global turnover). CNIL agents also have a broader right to survey and investigate places used for the processing of personal data.

23Are there any data protection issues that cause particular concern in internal investigations in your country?

The use of personal information must not impinge on an individual’s right to privacy. Databases containing any kind of personal information must be established in accordance with European and French rules under the supervision of the CNIL. The GDPR will require careful consideration when conducting an internal investigation: without prejudice to any other grounds for cross-border transfers, that any transfer of personal data be based on international conventions.

24Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

See question 29. Employees’ communications through information technology devices made available to them by the company for professional purposes, are presumed to be professional and would therefore only be outside the scope of the company’s right to intercept communications if they are identified as private. However, employees who benefit from a protective status because of their position in the company (social representatives, for instance) must be given working devices that prevent their communications being intercepted and their correspondents being identified.

Dawn raids and search warrants

25Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Dawn raids are a key element of enforcement and evidence gathering in an overwhelming majority of cases by judicial and administrative authorities. However, external counsel should be contacted immediately, if for no other reason than to collect valuable intelligence about the investigation. There is little room for a company to object to a dawn raid if it abides by the rules framing the process and is authorised by the public prosecutor for in flagrante delicto and preliminary investigations or the investigating judge for judicial investigations. An important procedural rule is that, provided the raid does not relate to organised crime or terrorism, it may not start before 6am or after 9pm.

Companies should ensure they identify everything that is being seized, seek permission to make copies and specifically identify material that is attorney–client privileged or otherwise protected by law. If privileged materials are taken, they should be put under seal. Also, any incident should be reported in the minutes of the dawn raid and the minutes should not be signed if there is a disagreement as to content. Subsequently, if the legal requirements of a dawn raid have been violated, nullity of procedural steps can be obtained. The acts resulting from a raid, including the seizure of materials and all legal implications, will be considered ineffective. The company will therefore be able to apply for the return of the materials seized in the event that the raid did not comply with the legal requirements.

26How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

There is a distinction to be made between external and in-house counsel. Legal privilege attaches to any advice provided by external counsel. Very often, privileged materials will be seized along with other material and a specific request must subsequently be filed to have the material covered by privilege returned to the company. There is no in-house counsel privilege, however, thus communications with in-house counsel are not protected by attorney–client privilege.

27Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

An individual and (at least in theory) a company can refuse to answer questions based on the right against self-incrimination, and on the basis that the information is privileged. Provided there is no self-incrimination or information under privilege, an individual or a company that is not yet part of proceedings can be compelled to attend a hearing to testify – failure to do so incurs a €3,750 fine.

Whistleblowing and employee rights

28Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

The first legal protection for whistleblowers dates back to 2007 and has developed since to target specific areas, including corruption and risks to public health or the environment. The Sapin II Law provides for a general whistleblower protection. Whistleblowers cannot be excluded from recruitment procedures or professional training, or face dismissal or discriminatory measures, whether direct or indirect, notably regarding remuneration. However, they are submitted to a three-tier process, consisting of a preliminary report to the whistleblower’s supervisor and, in the event of that supervisor’s failure to address the report within a reasonable amount of time, to the relevant administrative or judicial authorities or professional orders, and, as a last resort, to the public via the press.

In addition, France has two years to transpose a new whistleblower directive on the protection of persons reporting on breaches of European Union law dated 7 October 2019. This directive grants a broader protection to whistleblowers (beyond the scope of the work environment and applicable to their relatives). Unlike French law, the European provisions further provide for a two-stage process: disclose the information (1) internally, to the legal entity concerned, and (2) externally, to the competent national authorities, or to the relevant EU institutions, bodies, offices and agencies.

The idea of a financial incentive scheme was considered but the French Constitutional Council censored it. However, a Decree of 21 April 2017 set an experimental provision of two years that gave the General Directorate of Public Finance the authority to compensate any person, outside public administrations, who would provide information to lead to the discovery of tax evasion. This system has been perpetuated by the law of 23 October 2018 on the fight against tax evasion. The directive, without providing a direct financial incentive, guarantees whistleblowers access to free and independent advice.

29What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Data protection and privacy laws apply to all employees regardless of allegations of wrong­doing. Pursuant to French case law, messages sent by a company’s employees using information technology devices made available to them by the company for professional purposes, are presumed to be professional. Hence, the employer is entitled to access the files and folders located on the company’s computers or open messages within a professional messaging system without the employee being present, unless that employee has identified the material as personal. Nevertheless, the employee is entitled to invoke the right to privacy, which includes the secrecy of correspondence.

Officers and directors of companies who are subject to board decisions must be dealt with in the same way. In certain positions, which are subject to authorisation by a regulatory authority, removal of the authorisation can lead to termination.

30Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

An employee deemed to have engaged in misconduct must be allowed the same rights as other employees (i.e., delay in being summoned for a prior interview and the application of legal and statutory conditions of sanctions).

If the misconduct is confirmed, an employer has a large set of tools to sanction the employee, including releasing the employee from his or her duties until completion of the investigation.

31Can an employee be dismissed for refusing to participate in an internal investigation?

An employee can be sanctioned for refusing to participate in an internal investigation, which is considered a sufficiently severe fault by the labour courts.

Commencing an internal investigation

32Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

It should be considered good practice to prepare a document setting out the investigatory scope, especially when a judicial review seems likely by labour courts if an employee who is deemed to have engaged in misconduct challenges the findings of the internal investigations, for instance. The Paris Bar is due to publish detailed ethics recommendations for lawyers involved in internal investigations based on a report by Stéphane de Navacelle.

33If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

There is no obligation to report back to authorities nor is there a leniency programme. The company should assess the scope of the facts and the likelihood of a leak as soon as possible without creating unnecessary internal awareness.

34What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

It is very likely that the enforcement authority would collect documents or data directly by conducting a raid within the company, having gathered sufficient information from third parties to ensure they are able to collect relevant information. If a company has any reason to believe a raid is likely, it should immediately ensure that any documents that may be seized are created in a privileged manner if possible, and consider providing separate representation to key employees. In some specific instances, it may make sense to reach out to the appropriate authority ahead of time.

Administrative authorities, for example the AFA, the AMF, the ACPR, the Competition Authority and the Ministry of Economy, can request communication of data and documents from companies under review or directly from third parties.

35At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Other than obligations attached to publicly traded companies, there are no obligations as to when a company must disclose the existence of an internal investigation or contact from law enforcement. Self-disclosure is voluntary.

36How are internal investigations viewed by local enforcement bodies in your country?

Having initially been embedded in legal culture, internal investigations have been accepted by specialised financial investigating magistrates as a necessary evil. Extra caution should nonetheless be taken if a judicial investigation is likely, as speaking to potential witnesses could be regarded as subornation and obstruction of justice, which is a crime in itself. It is useful to note that, in France, there is a monopoly on an investigation by the public authorities.

In a legal culture where negotiating a deal with a prosecutor or an investigating magistrate is uncommon, and as in-house counsel has no legal privilege, close attention will be paid to attorney–client privilege in internal investigations.

Attorney–client privilege

37Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

There is no attorney–client privilege for communications with in-house counsel in France. For privilege to attach, the internal investigation should be carried out by external counsel, namely French lawyers admitted to the Bar. Interviewed employees are bound by contractual obligation to confidentiality, but this obligation cannot be used to avoid answering questions put by an investigating magistrate or police investigator. The Paris Bar released an opinion stating that professional secrecy applies between lawyers and their clients but does not apply to communications between lawyers and the employees of their clients when lawyers interview employees. Lawyers must therefore notify the employees of this, and their right to be represented by a separate attorney.

Professional secrecy applies to conversations between lawyers whether or not there is a common interest between their clients. Providing separate counsel to individuals is recommended to facilitate communications safely.

38Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

The principle of the attorney–client privilege was set down in Article 66-5 of the Law of 31 December 1971, amended by the Law of 7 April 1997 and by Article 226-13 of the French Criminal Code.

These provisions expressly set out that an attorney may not disclose information that contravenes professional secrecy. Article 226-13 of the French Criminal Code states that disclosure of secret information by persons entrusted with such a secret, by virtue of their position or profession, or a temporary function or mission, is sanctioned by imprisonment for one year and a €15,000 fine. Attorney–client privilege only applies when the lawyer is acting as a lawyer, that is to say, giving legal advice.

The holder of the privilege is the attorney’s client, whether an individual or a company.

39Does the attorney–client privilege apply equally to in-house and external counsel in your country?

No privilege attaches to communications with in-house counsel. Privilege only attaches to external counsel although the Gauvain Report dated 26 June 2019 recommends introducing a privilege applicable to legal advice given by in-house counsel.

40Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

Article 2 of the National Rules Procedure for Lawyers provides that the lawyer is of necessity the confidante of the client. Attorney–client privilege is a matter of public policy; it is general, absolute and unlimited in time. Subject to the strict requirements of their own defence before any court and the cases of declaration or disclosure prescribed or authorised by law, lawyers may not make, in any matter, any disclosure in violation of attorney–client privilege.

There is no general provision regarding attorney–client privilege as regards foreign lawyers in relation to investigations. However, the Paris Bar Council has stressed that email exchanges between a client and a foreign lawyer are covered by attorney–client privilege. In addition, foreign lawyers can be temporarily and occasionally authorised to practise consulting and counselling activities in France. In that case, they are bound by both their home country’s professional rules and the ethics rules applicable to French lawyers, which include attorney–client privilege.

41To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

Waiver of the attorney–client privilege is not specifically considered a co-operative step in France. The attorney–client privilege cannot be waived by the attorney under any circumstances, save for some exceptions (if an attorney must present his or her defence in a conflict opposing the attorney to his or her client). Only the client is entitled to waive the attorney–client privilege. At this point in time, there is still little reliance by enforcement authorities on internal investigations.

42Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

This concept does not exist in France.

43If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

Privilege can be maintained in France after a limited disclosure abroad. However, co-operation between enforcement authorities would be likely to make the privilege moot.

44Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privileges do not exist per se in French law. However, it is possible, for the purpose of defending a client, to share privileged information with other attorneys (without losing the privilege) – whether the clients share a common interest or not – and retained experts, such as forensic accountants.

45Can privilege be claimed over the assistance given by third parties to lawyers?

The scope of professional secrecy is very broad and lawyers are expected to rely on experts. That being said, it is usually safer to have the information collected and processed within the law firm’s offices.

Witness interviews

46Does your country permit the interviewing of witnesses as part of an internal investigation?

There are no clear rules as regards internal investigations, and interviews with individuals who are not employees or former employees of the company should be considered with great caution. If the underlying facts amount to an offence under French law, such an interview would be likely to be considered an obstruction of justice. The proper alternative is to rely on external counsel.

47Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

There are competing doctrinal opinions as to whether or not internal interviews are covered by attorney–client privilege. Attorney reports are covered by attorney–client privilege as long as the attorney is providing legal advice. On the other hand, attorneys’ reports are not covered by attorney–client privilege if the attorney is providing an expertise assignment, as indicated in addendum XXIV to the Rules of Procedure of the Paris Bar published in 2016 by the Paris Bar Council. If this is the case, attorneys who draft an internal investigation report could be required to testify at a later stage in judicial proceedings.

48When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Interviews of third parties should be ruled out unless specific precautionary steps are taken. The Paris Bar Council has issued recommendations, according to which attorneys should explain the purpose of an interview and its non-coercive nature to employees and inform them that their exchanges are not covered by professional secrecy (equivalent of Upjohn warnings). Employees should also be informed that they can be assisted by an attorney, but only when it appears that they may be blamed for their actions at the end of the investigation.

49How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Assuming external counsel carries out the interview, they should explain both whom the attorney–client relationship is with and how the privilege rule works. Independent counsel should be provided to interviewees if there is any sense that they might be involved in any wrongdoing. Documents are usually provided ahead of time when counsel for the employee is involved, from the counsel for the company to the counsel for the employee directly, as correspondence between attorneys is covered by privilege. This ensures that the employee is not given the opportunity to communicate the documents to third parties and that the authorities are unable to seize such documents.

Reporting to the authorities

50Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Except for specific crimes that are inchoate and can be avoided, only civil servants have a general obligation to report crimes of which they become aware in the context of their employment. There is no requirement to self-report. However, the guidelines on CJIPs clearly state that voluntary self-reporting of offences to prosecutors, if made in a timely manner, both as regards the choice of the CJIP procedure and as a factor reducing the amount of the public interest fine, will be taken into consideration favourably.

51In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Except for antitrust issues, only in very limited circumstances does a corporation have an interest in reporting wrongdoing to enforcement authorities. It should first determine the scope of the wrongdoing and the responsibilities of those involved to assess potential corporate criminal liability. If the wrongdoing is carried out by a current or former employee, the corporation should weigh the pros and cons of filing a criminal complaint against the perpetrators to deter others, show commitment to compliance and shield itself from prosecution by acquiring the status of victim.

Self-reporting outside France should be based on a decision tailored to the foreign country’s laws and enforcement policies. Should the company decide to self-report in a foreign jurisdiction, reporting the facts to French authorities should also be considered. Arguments to weigh up include the potential interest of French authorities in the underlying matter, where the facts occurred, whether they are continuing, and how closely national and foreign authorities work together. The SG CJIP suggests full co-operation between authorities and a real willingness on the part of the French authorities to take up investigations occurring in France or involving a French entity.

In more than 300 ongoing matters, the PNF is working closely on trying to address cases at the preliminary enquiry phase of criminal investigations before an investigating magistrate is appointed, namely, the instruction phase, which limits the leeway for plea bargaining and considerably extends the length of procedures.

52What are the practical steps you need to take to self-report to law enforcement in your country?

There is no specific procedure for self-reporting and no legal requirement to do so. Informal contacts should be made, through external counsel, with the competent authority, at the appropriate hierarchical level, after a thorough cost/benefit analysis. Although there is no statutory requirement to evaluate self-reporting and co-operation in a CJIP, the AFA and the PNF guidelines published on 26 June 2019 indicate that self-reporting within a reasonable period of time shall be favourably considered, in particular as a factor for reducing the fine.

Responding to the authorities

53In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

There is no common practice by enforcement authorities of providing advance notice to corporations that may become defendants in criminal procedures. Contact should be made with the police investigator, prosecutor or investigating magistrate depending on the status of the investigation. Challenges can be made against requests beyond the scope of the instruction from the judicial authority.

54Are ongoing authority investigations subject to challenge before the courts?

Ongoing investigations led by the public prosecutor are not subject to challenge before the courts. Challenges are only possible once the investigation is closed.

Ongoing investigations led by the investigating magistrate can be challenged before the courts.

55In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

The company should answer all the authorities involved separately, as the questions that can be raised by different authorities could vary, and it should be borne in mind that authorities communicate with one another. When dealing with foreign authorities, blocking statute, privacy and data protection issues should also be addressed.

56If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

The collection of material abroad will have to be carried out in compliance with the applicable foreign law. However, national authorities will only be concerned about the actual answer to the production request.

57Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

There is extensive co-operation with foreign enforcement authorities both within the European Union and elsewhere, through mutual legal assistance treaties, agreements between regulators and enforcement authorities, and EU co-operation agreements. With the SG CJIP having signed deferred prosecution agreements with the DOJ and the US Commodity Futures Trading Commission, this co-operation is even more visible.

58Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Except where the law provides otherwise, and subject to a defendant’s rights, enquiry and investigation proceedings are secret. Any person contributing to an investigation is bound by professional secrecy, and the disclosure of secret information is punishable by imprisonment for one year and a €15,000 fine. In practice, information is often leaked by people who are under no legal obligation and leaks to the press in sensitive matters occur very frequently.

59How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

The company should retain external counsel to explain the foreign country’s law to the requesting French authority, and work with the French and foreign authorities for the production to be carried out appropriately, possibly pursuant to formal co-operation agreements.

60Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

France has both blocking and data protection and privacy statutes. The French blocking statute, subject to treaties or international agreements and to currently applicable laws and regulations, prohibits communication to foreign public officials of economic, commercial, industrial, financial or technical information or documents if that communication is harmful to France or is to be used as evidence in view of foreign judicial or administrative proceedings or in relation thereto. Secrecy should also be properly addressed when a notice or subpoena concerns a bank: banks owe a legal duty to their customers not to disclose information about their affairs to third parties. Breach of this duty is criminally sanctioned pursuant to the French Monetary and Financial Code and the French Criminal Code. To ensure that the blocking statute, the data protection law and, if applicable, banking secrecy, do not affect domestic enforcement, the communication should be properly addressed when responding to a foreign authority.

61What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Voluntary production is limited to very specific circumstances, mostly when foreign authorities are involved, or when, in an ongoing investigation, there is a strategic interest to do so. Criminal files are accessible to all parties involved, including victims and other defendants. Although legally covered by secrecy rules for legal professionals, parties themselves are free to share information from the file – not documents – with third parties. Information from high-profile cases is regularly leaked to the press.

Prosecution and penalties

62What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Corporate liability does not shield individuals from liability. In an overwhelming majority of cases (as required by law), the courts have to identify the individual or organ acting on behalf of the company (see question 2).

Penalties for individuals include fines, imprisonment, payment of civil compensation to victims within the same criminal procedure and prohibition from specific managerial positions in addition to publication of the decision in the press. Except for imprisonment, penalties for companies include all the above, as well as dissolution and debarment for certain specific offences.

63Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

Ordinance No. 2015-899 of 23 July 2015, which transposes Directive 2014/24/EU on public procurement, prohibits companies found guilty of specific offences (e.g., corruption, fraud, money laundering, terrorism or embezzlement and misappropriation of property) from competing for government contracts throughout the European Union. This exclusion is automatically for a period of five years unless the sentencing decision specifically provides for a more limited period (Article 45 of the Ordinance). Article 39 of the Sapin II Law amended Article 45 of the Ordinance, which now allows a declaration on honour as sufficient proof that the candidate is not prohibited from applying for a government contract.

64What do the authorities in your country take into account when fixing penalties?

Although laws provide for very high penalties, including those based on a percentage of overall revenues for companies, penalties will be based on net worth, income, personality and mens rea. Although not recognised as such by law, deterrence appears to be a growing component of the rationale for penalties.

Resolution and settlements short of trial

65Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Non-prosecution agreements are not part of the French legal system. Deferred prosecution agreements (DPAs) are slowly becoming part of the legal system. The Sapin II law provides for a DPA procedure limited to corruption and ‘probity offences’: the CJIP. Plea agreements – also limited to specific offences – have been available for more than a decade.

66Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

There is no such reporting restriction under French law outside applicable labour law that the individual could invoke against the company at a later stage. Far from providing reporting restrictions, the recently published CJIP guidelines provide that the aim of internal investigations conducted by a prosecuted company is also to determine individual liabilities. To that extent, keys witnesses shall be identified and, if interviews have been conducted with witnesses or with persons likely to be involved, the reports shall be communicated to the prosecutor.

67Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

There is an increasing recourse to the pretrial guilty plea procedure (CRPC) and CJIPs in France. The Sapin II law provides for CJIPs limited to instances of corruption and ‘probity offences’. Companies should move swiftly to settle if possible, as both procedures provide for, and are likely to include, forceful involvement of alleged victims who will pursue their own interests. If the case may involve foreign jurisdictions, companies should assess the consequences of admitting guilt in France.

68To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

The AFA was empowered by the Sapin II Law to supervise companies as part of the implementation of CJIPs. Among the obligations imposed by the CJIP is the implementation of an action plan, as required, with the aim of improving the company’s compliance system under the AFA’s control for a maximum of three years. In such cases, the AFA can be helped by law firms and experts. During the past two years, of the six companies that entered into a CJIP, four designated the AFA as a compliance monitor.

69Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Parallel private actions are possible. In most instances, alleged victims will join the criminal procedure as civil parties and, as such, will be granted full access to the files and be able to submit requests for investigative steps to investigating magistrates. Also, alleged victims can start a criminal investigation by filing a specific complaint to that effect.

Private parties do not normally have access to administrative authorities’ investigation files.

Publicity and reputational issues

70Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Secrecy at the investigatory stage is required by law. However, defendants and victims have access to the file. It is sometimes very difficult to keep communications and information taken from the criminal file private. Once a case is before a court, the press can cover the event, be present at the hearing (albeit microphones and cameras are prohibited) and attend the debates. Defendants and victims are free to make statements.

71What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

It is very common to have press releases, communications and crisis management strategies prepared, and, when appropriate, public relations firms assisting. The spokesperson is often a lawyer on the case, especially when individuals are involved.

72How is publicity managed when there are ongoing related proceedings?

Publicity is part of the overall strategy, especially in high-profile matters that attract political attention and have numerous civil parties.

Duty to the market

73Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Unless otherwise specifically requested by an agreement, there is no obligation to disclose settlements to the public. In anti-corruption matters, the Sapin II Law makes disclosure compulsory. Any settlement in criminal matters will have to be approved by a judge at a public hearing. Although investigative measures and the results of investigations are to remain confidential, and police officers, judges and legal experts are bound by that confidentiality, administrative authorities are permitted to communicate on sanctions and settlements.

It is interesting to note that CJIPs do not amount to an admission of guilt in France and companies will not have a criminal record, thus allowing them to still participate in public procurement proceedings.

Anticipated developments

74Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

France is quite proactive. The Gauvain report entitled ‘Restoring French and European sovereignty and protecting our companies from extraterritorial laws and measures’ (published on 26 June 2019) recommends a number of legal changes with the aim of strengthening the French legal framework applicable relating to foreign procedures initiated against French companies. The main recommendations include strengthening the blocking statute by heightening applicable sanctions and by making sure that requests for information go through the competent channel (the Economic Strategic Information and Security Department); introducing a legal privilege applicable to in-house counsels; and protecting French companies’ data against the Clarifying Lawful Overseas Use of Data Act (or US Cloud Act, enacted in 2018) by imposing administrative fines similar to those applicable for violations of the GDPR (up to 4 per cent of annual global turnover or €20 million) in the event of transmission of any such data by US data hosting companies outside applicable international agreements or treaties.

Footnotes