Laurent Cohen-Tanugi Avocats highlights 6 significant French and EU legal developments of 2022 in cross-border compliance and white collar crime
News
By Laurent Cohen-Tanugi, Martin Méric and Louise Grosos
Laurent Cohen-Tanugi Avocats
This memorandum highlights six topics of particular interest to international white-collar crime and compliance professionals among the past year’s numerous French and European legal developments in those areas. Each of them will likely deserve attention in 2023.
I. France Beefs Up Enforcement of its Blocking Statute
The French “blocking statute” of 1968 has long been at the heart of transatlantic controversies: aiming at prohibiting the disclosure of sensitive information to foreign authorities, it was deemed inefficient, and was only enforced once. Three years after a parliamentary report of May 2019 (the “Gauvain Report”) raising growing concerns about French judicial sovereignty, the French government adopted on February 18, 2022, and March 16, 2022, decrees in an attempt to strengthen the statute and to better protect French economic interests against alleged fishing expeditions.
New Authority in Charge of Foreign Communication Requests. Since April 1st, 2022, French companies now have a one-stop shop to which they must address without delay document requests from foreign authorities or any person acting on their behalf (potentially covering monitorships). The Service de l’information stratégique et de la sécurité économiques (hereafter, “SISSE”), attached to the Ministry of the Economy, has one month starting from the referral to render a formal opinion regarding the applicability of the blocking statute to the documents concerned.
Continuing Dilemma for French companies. Although the amount of the fine was not raised despite the recommendations of the Gauvain report, failure to transfer requests entitles the SISSE to report a violation of the blocking statute to the public prosecutor. While the new mechanism was generally welcomed by French companies, they will still face a dilemma between complying with the foreign request and possibly exposing themselves to prosecution in France, or complying with the French blocking statute, with the risk of jeopardizing their pending settlements or litigation in the U.S. and weakening their position before U.S. courts.
It now remains to be seen how foreign authorities will react to this new mechanism. The decrees will no doubt complicate communication requests from foreign authorities and, therefore, cross-border proceedings for companies and their counsels. The reform of the EU blocking regulation currently being discussed also deserves attention.
II. Expanded Boundaries for the French Legal Privilege?
Narrower than the U.S. and UK legal privileges, the French legal regime traditionally makes a distinction between defense and advisory professional secrecy. However, recent developments have revived the debate surrounding their scope of application. After months of tense debates between the French Bar, the Parliament, and the government, France passed a “Law on Trust in the Judiciary” on December 22, 2021.
The Law noticeably enshrined in the Code of Criminal Procedure respect for the defense and advisory professional secrecy during criminal proceedings. It thus seemed to overcome the traditional division between defense and advisory professional secrecy. However, in cases of tax fraud and integrity violations, the Law provides that the advisory professional secrecy may not be invoked against investigative measures when the communications held or transmitted by the lawyer or the client establish proof of their use to commit or facilitate such violations.
In addition, the implementing Circular of February 28, 2022 obscured the interpretation of the Law, seeming to backtrack on the protection of advisory professional secrecy. Pursuant to the Circular, advisory communications between lawyer and client would only be protected when they relate to the exercise of the rights of the defense, “when a person has committed or believes it has committed an offense, but not when advice is sought from a lawyer before the commission of an offense”, although no criminal proceedings have been initiated.
Subject to future rulings of the French Court of Cassation, it appears that the legal privilege protection will apply when a person expects to be prosecuted soon or when that person knows that it has committed a criminal offense, as it is considered to be already preparing its defense, but not when advice is sought prior to the commission of an offense. By way of illustration, a client seeking a criminal risk analysis on some corporate conduct could benefit from the French legal privilege, unless prosecutors demonstrate that the advice was not used to prepare the client’s defense. This ambiguous progress did not convince the Paris Bar, who challenged the new framework resulting from the Law and the Circular before the Constitutional Council. Attention must be given to its upcoming decision.
In the context of multi-jurisdictional investigations, the French authorities seem to concede on a case-by-case basis claims of foreign legal privilege. The joint guidelines from the National Financial Prosecutor (“PNF”) and the Anti-Corruption Agency (“AFA”) provide that prosecutors should take into consideration the risk of waiver by a foreign company of its foreign legal privilege. Companies should then assert foreign legal privileges whenever applicable and justifiable, especially if they are subject to criminal proceedings in other jurisdictions.
III. France Strengthens its Protection of Whistleblowers
Two months after the deadline to implement the EU Directive on Whistleblowing, France eventually adopted on March 21, 2022 a law “aiming at improving the protection of whistleblowers,” also referred to as the “Waserman law,” thus becoming one of the nine EU Member States to comply with the implementation obligation. The new law strengthens the protection previously conferred by the Sapin II Law.
Broadened Definition of Whistleblowers. The new law adopts a broader definition of whistleblowers. While whistleblowers remain individuals who disclose in good faith information concerning an array of crimes, misdemeanors, or harm to the public interest, the Waserman law replaces the requirement of “disinterestedness” with the more flexible one of “absence of direct financial consideration,” and adds violations of EU law to the list of crimes that may be reported.
Enhanced Protection for Whistleblowers. Additional measures complete the existing protection, now preserving whistleblowers from being held criminally liable in case of theft of information they had been regularly made aware of (notably in a professional context), or civilly liable for the damages they cause – provided that the disclosure was necessary and proportionate. The new law further provides for criminal and civil sanctions against any person obstructing the transmission of a report, be it by taking retaliation measures, engaging in a “strategic lawsuit against public participation” (“SLAPP”, i.e., defamation lawsuits to censor or intimidate whistleblowers), or even by failing to protect the identity of the whistleblower. These protections also apply to “facilitators” of the disclosure (individuals or non-profit legal entities assisting whistleblowers in making a disclosure), as well as the “entourage” of the whistleblower (individuals connected to a whistleblower).
Facilitation of the Reporting Process. Most importantly, the law revisits the previous hierarchy between internal and external reporting channels set out by the Sapin II law. It now allows for the direct external reporting to the French authorities without a requirement to inform the organization internally beforehand, notably in cases of serious and imminent danger, and failure from the organization to provide either an appropriate response in time or sufficient guarantees against retaliation or collusion.
Higher Stakes for Organizations. This more protective framework should see the rise of alerts, especially through external channels. It is thus critical for organizations to build a warning system that inspires as much confidence as possible and guarantees a high level of proactivity and confidentiality in order to reconcile the need to protect their employees or agents with the preservation of their corporate interests.
IV. French National Financial Prosecutor and Anti-Corruption Agency Publish Joint Guidelines for Internal Anti-Corruption Investigations
In March 2022, the PNF and the AFA jointly published a draft guide providing welcome guidance to companies on internal anti-corruption investigations. It followed the 2019 AFA-PNF guidelines on implementing the Sapin II Law, which had already emphasized the importance of internal investigations. The National Bar Council also recommended good practices in that regard in June 2020.
An internal investigation may be triggered by internal and external factors, such as an audit report or the opening of a criminal proceeding. The draft guide recommends reporting any suspicion to the prosecutor as early as possible to increase the chances of a settlement, and companies should inform the latter of their intent to conduct an internal investigation. Any request by foreign judicial authorities should follow mutual judicial assistance procedures. Should any other foreign authority or a foreign party seek documents, the company must contact the SISSE without delay as per the blocking statute.
Companies should formalize their internal investigation procedures as much as possible. The draft guide lays out general principles companies must comply with, such as fairness, lawfulness, proportionality, impartiality, and the presumption of innocence. Companies should be mindful to abide by local labor laws that are favorable to employees, including those implicated in potential misconduct. For instance, companies may not investigate employees’ explicitly personal files located on their professional devices. Privacy rights and compliance with the GDPR may also be challenging when gathering digital evidence.
The draft guide expects companies to inform the authorities of any potential criminal acts they identify without delay, including before the end of the investigation. It also calls for transmitting the investigation report to the prosecuting authorities to get cooperation credit, which is still not appropriately defined, unlike in the DOJ or SFO guidelines. This may raise concern given the fundamental right not to incriminate oneself and the absence of an obligation to self-report under French law. The AFA-PNF may also be at odds with French or foreign privilege rules. Companies, therefore, have to weigh the costs and benefits of self-reporting. In any case, companies should act as transparently as possible with the prosecuting authorities to gain credibility at the earliest stage, engage in disciplinary actions against individuals, and remedy any compliance vulnerabilities brought to light by the investigation.
V. The EU Builds Up its Sanctions Enforcement Policy
In the aftermath of the Russian aggression against Ukraine, the EU has become a major player on the economic sanctions’ scene, as evidenced by the adoption of nine sanctions packages. On November 28, 2022, the Council unanimously made the violation of EU sanctions a “euro-crime.” Accordingly, the Commission presented on December 2, 2022, a draft directive to harmonize the criminal offenses and penalties for violating EU restrictive measures among Member States. EU sanctions have been inconsistently enforced due to Member States’ diverse criminal definitions and penalties. Very few individuals or companies have been held criminally liable to date.
Sanctions violations would cover intentional or seriously negligent breaches, as well as the acts of inciting, aiding or abetting to commit these offenses. Circumventing EU sanctions would also be criminalized. Companies might also be held liable for their lack of supervision or control over their subsidiaries or personnel. The usual humanitarian exemptions are also contemplated.
The Commission pushes for harmonized penalties to be effective, proportionate and dissuasive, including imprisonment of up to five years for individuals. Companies might be disqualified from business activities, see their permit/license withdrawn or face closure of facilities. Additionally, fines could reach up to 5% of their worldwide turnover. There may be aggravating circumstances, such as the criminal organization context of the breach or commission by a professional service provider. Cooperation with the investigation would, on the contrary, have a mitigating effect.
A Member State would have jurisdiction over a sanctions breach committed in whole or in part within its territory, by a national, resident, or public official acting within its duty, for the benefit of companies established on its territory, or for the benefit of companies’ business totally or partially conducted on its territory. Coordination is expected between EU institutions, such as the Commission, Eurojust, Europol and the European Public Prosecutor’s Office (EPPO), and national enforcement authorities.
All the EU’s efforts to build on its sanctions regime call for the involvement of an enforcement arm as effective as the U.S. Office of Foreign Assets Control. Extending the EPPO’s jurisdiction to sanctions breaches is currently being discussed. Any further step should be scrutinized by sanctions practitioners across the Atlantic, as it will likely speed up sanctions enforcement in the EU.
VI. The EU Unveils Several Drafts of a Human Rights Due Diligence Directive
2022 saw the Commission’s and the Council’s efforts to promote a human rights corporate due diligence directive, inspired by the 2017 French Duty of Vigilance Law. Several issues remain to be settled between the different EU institutions. Still, the directive will have a significant impact on large companies operating in the European market and on their smaller business partners.
The scope of the future directive is not yet defined. Unlike the Commission, the Council took a two-step (and less ambitious) approach by targeting the largest companies and considering lower thresholds seven years after the directive’s entry into force. Both proposals converge in lowering the thresholds for risky activities in the food, textiles and extractive industries. The Council is in favor of leaving to the Member States’ discretion the inclusion of the financial sector in the scope.
The Commission and Council proposals have a common architecture, imposing a general due diligence obligation broken down into six topics: due diligence policies and procedures to be disseminated within the group, environmental and human rights risk identification, risk prevention and mitigation, a complaint procedure, the monitoring of the policies’ effectiveness, and public communication on due diligence. Due diligence efforts may be materialized by codes of conduct, risk mapping, preventive action plans, compliance clauses, and potential suspension or, at last resort, termination of the contractual relationship with a business partner, in order to prevent and bring to an end potential or actual adverse impacts.
National authorities will supervise the implementation of preventive measures within companies and may impose administrative sanctions. Companies may be held civilly liable for failure to implement due diligence obligations, but the triggering criteria for liability has not been agreed upon yet. In addition to the directive’s scope, some issues still need to be clarified. For instance, the Council’s more restrictive stance is noteworthy: It substituted the “value chain” notion with the narrower term of “chain of activities.” In practice, this means that corporate due diligence efforts would focus on the companies’ supply chain, and carve out the downstream of the value chain, i.e., the purposes for which the companies’ products or services are used. Directors’ duty of care in setting up and overseeing due diligence measures will be intensely discussed.
If a consensus is found on the future directive, companies and their counsel should anticipate significant developments in 2023.