Protection of whistleblowers • APDP opinion on Bill no. 987 (Deliberation no. 2025-8 of 9 April 2025)

Presentation

Referred to for an opinion by the President of the National Council on 27 March 2025, in accordance with Article 38 of Law no. 1.565 of 3 December 2024, Deliberation no. 2025-8 of 9 April 2025 (JDM no. 8746 of 9 May 2025) of the Personal Data Protection Authority (PDPA) relates to Bill no. 987 on the protection of whistleblowers in employment relations of 10 December 2018.

Bill no. 987 provides for the establishment of a general framework of protection applicable to private sector employees, civil servants, contractual State and Commune employees, as well as trainees, when they report in good faith information of which they have become aware during the performance of their duties, relating to the occurrence of a crime or misdemeanour, or a threat or serious harm to the general interest in the health or environmental field.

The APDP's opinion is based on the following points:

• scope of employing entities;
• scope of protected persons;
• extent of the exemption from criminal liability;
• conditions and information excluded from whistleblowing;
• guarantees against retaliation;
• implementation of whistleblowing;
• information for whistleblowers;
• interaction with foreign standards concerning the banking and financial sector;
• waiver or limitation of rights and remedies.

* * *

Analysis of the APDP

PREAMBLE

The APDP recalls the "inherent dangers" identified by the Commission de Contrôle des Informations Nominatives (CCIN) in its Deliberation no. 2011-73 of 26 September 2011 making recommendations on whistleblowing schemes implemented in the workplace:

• "the risk of disproportion between the system put in place and the objectives pursued by the company or organisation;"
• "the unfairness of collecting and processing the nominative data of a person who does not have the means to object or defend him/herself."

It then reviews the scope of application of whistleblowing mechanisms. In the absence of a legislative framework in Monaco, the CCIN initially restricted its scope to the financial sector. However, this position changed, notably in response to requests from banking institutions "subject to whistleblowing provisions in other countries in which they were established", leading the CCIN to redefine the scope of legality of whistleblowing mechanisms in Deliberation no. 2020-016 of 15 January 2020:

• corruption (articles 113-2 et seq. of the Monegasque Criminal Code);
• fraud (articles 331 et seq. of the Monegasque Criminal Code);
• harassment and violence in the workplace (Law no. 1.457 of 12 December 2017, amended);
• non-compliance with professional ethics rules - client protection, regularity of transactions and conflicts of interest (Sovereign Order no. 1.284 of 10 September 2007);
• non-compliance with rules on the fight against money laundering, terrorist financing and corruption (Law no. 1. 362 of 3 August 2009 and Sovereign Order 2.318 of 3 August 2009, amended);
• non-compliance with the rules on sanctions and embargoes;
• non-compliance with the rules on market integrity (Law no. 1.338 of 7 September 2007 on financial activities, amended);
• non-compliance with the rules on the protection of personal data (Law no. 1.165 of 23 December 1993, amended).

Also in 2020, when examining a draft amendment to the above-mentioned Law no. 1.362, the CCIN drew attention to the need for "a stronger legal basis in the Principality to precisely define the scope, by legislative or regulatory means, namely the supervision of professional alert systems, often implemented by banks".

I. ON THE SCOPE OF PROTECTION

A) On the scope of whistleblower protection

→ Scope of entities concerned

Bill no 987 targets employees of natural persons or legal entities under private or public law in Monaco, which excludes independent administrative authorities (AAI), which have no legal personality in Monaco, unlike in France where they are covered by Article 3-III of Decree No 2022-1284 of 29 September 2022 (for example, Article 23 of the French CNIL Charter of Ethics on the protection of whistleblowers). "The APDP believes it would be appropriate to include the AAIs in the system, given their independence from government departments".

→ Scope of protected persons

The APDP considers it "appropriate to extend the protection afforded to temporary workers/former employees/candidates, service providers, suppliers, (...) to those who may suffer retaliation "by ricochet" (...) in particular (...) facilitators (...) and also third parties who are in contact with those who have made the report", on the basis of :

• Recommendation CM/Rec(2014)7 of the Council of Europe, which covers "all individuals working in either the public or private sectors, irrespective of the nature of their working relationship and whether they are paid or not", "individuals whose work-based relationship has ended and, possibly, where it is yet to begin in cases where information concerning a threat or harm to the public interest has been acquired during the recruitment process or other pre-contractual negotiation stage".
• Article 8-I-A of French Law no. 2016-1691 (Law Sapin 2), which includes, in particular, shareholders, partners, managers, external collaborators, co-contractors, subcontractors and their staff;
• Article 4 of Directive (EU) 2019/1937, which allows protection to be extended to facilitators and third parties who are connected to whistleblowers and who are at risk of retaliation in a professional context, such as colleagues or relatives.

→ Exemption from criminal liability

Articles 12 and 13 of the Bill provide for exemption from criminal liability, respectively for slanderous denunciation (article 307 of the Criminal Code) and breach of professional secrecy (article 308).

The APDP notes that these provisions are subject to the whistleblower's good faith, a criterion that also features in principle 10 of Recommendation CM/Rec(2014)7 of the Council of Europe.

It then calls for non-liability to be extended to “all secrets” in order to avoid retaliation through other criminal grounds (such as those in Law No. 1.565 on the protection of personal data) and to “facilitators”, drawing on Article 122-9 of the French Criminal Code, which covers:

• any breach of a secret protected by law, where disclosure is necessary, proportionate and in accordance with legal procedures,
• acts of removal, misappropriation or concealment of documents or any other medium containing the information,
• accomplices of the whistleblower.

B) On the material scope of whistleblowing

The bill stipulates as conditions for the admissibility of whistleblowing that:

• the person acts "in good faith and in a disinterested manner". The APDP believes that the condition of "disinterestedness" could be adjusted, in particular by substituting the terms "without direct financial consideration" as in French law since the Law Sapin 2.
• the information must relate to "the occurrence of 1. a crime or misdemeanour, 2. a serious threat or harm to the general interest in the health or environmental field." The APDP advocates that the scope of the general interest should not be limited to cover other areas (such as consumer protection, personal data protection), and that "attempt" should be included, based on Directive (EU) 2019/1937 and the French Law Sapin 2 of 2022.

C) On the excluded information

The bill excludes information covered by national security secrets, medical confidentiality or lawyer-client privilege, as well as information of which the author of the alert had no personal knowledge and which he could not legitimately consider to be accurate.

These exclusions are similar to those provided for in Article 3 of Directive (EU) 2019/1937 and Article 6, II of the Law Sapin 2. However, the APDP recommends considering specific reporting mechanisms for the excluded areas (more restrictive regime without depriving the whistleblower of protection or defence), along the lines, for example, of what is provided for in Article L. 861-3 of the French Internal Security Code in relation to intelligence.

Moreover, by requiring that the whistleblower have personal knowledge of the facts reported, this excludes alerts based on credible but reported elements. The APDP notes that French law has abolished this requirement since the Law Sapin 2. According to the APDP, such an approach "has consequences for the incentive to blow the whistle", as Recommendation CM/Rec(2014)7 of the Council of Europe calls on states to adopt a legal framework that encourages the reporting or disclosure of information of public interest without fear of retaliation.

II. ON MODALITIES FOR IMPLEMENTING ALERTS AND PROTECTION

A) A procedure that is mandatory for all employers

The APDP emphasises that the Bill requires all employers in the Principality of Monaco to set up an alert procedure, with no threshold condition (unless a threshold is set by ministerial decree).

With regard to the processing of personal data associated with these procedures, the APDP notes that they may be based on:

• compliance with a legal obligation;
• or in the event of a threshold, if the procedure is implemented voluntarily, on the fulfilment of a legitimate interest.

B) On Article 3 of the Bill

The APDP considers that the protection afforded to whistleblowers is inadequate: it would be "judicious" to replace the notion of "disciplinary sanction" with the broader concept of "retaliation", referring to Directive (EU) 2019/1937 (Recital 44, Article 19) and the Law Sapin 2 (Article 10-1), which covers other forms of measures.

Secondly, it points out that the automatic nullity of measures taken in breach of this protection would require the immediate reinstatement of the dismissed employee.

The APDP also recommends strengthening the procedure in the event of a dispute:

• by specifying the competent jurisdiction, the time limits (in France, the judge rules within a short period of time);
• by providing for "support mechanisms" such as an advance on costs or aimed at covering the whistleblower's subsistence (Recommendation CM/Rec(2014)7 of the Council of Europe providing for interim measures);
• by requiring the employer to "prove that its decision is duly justified" (Article 10-1-III of the Law Sapin 2).

Finally, the APDP recommends guaranteeing the protection of whistleblowers acting in good faith, even in the event of an error of assessment of the facts, based on Recommendation CM/Rec(2014)7 of the Council of Europe (point 22 "reasonable grounds to believe in its accuracy").

C) A system with mandatory stages, and limited external and public reporting

The APDP considers the proposed system to be restrictive on certain points:

• obligation to transmit all reports to the "judiciary" within 15 days "regardless of the outcome of the internal investigation". The APDP "questions the effectiveness of internal reporting" if referral to the courts is automatic;
• "absence of external reporting to other independent administrative authorities", referring to Recommendation CM/Rec(2014)7 of the Council of Europe (reporting to public regulatory bodies, law enforcement authorities and supervisory bodies), Directive (EU) 2019/1937 and the French Law Sapin 2, which has evolved by "allowing external reporting with greater latitude" (Article 8-II, designated competent authority, Rights Defender, judicial authority);
• the prior requirement of serious, imminent danger or irreversible damage "does not justify making a public alert and only allows the matter to be referred to the Judicial Authority, potentially delaying the public alert by more than three months."
• "Finally, there is no way of overriding an internal alert that the whistleblower considers problematic in advance."

D) On the implementation of reporting

A ministerial order will set out the conditions for applying the Law with regard to the procedures for collecting and transmitting reports.

The APDP recommends establishing a "clear link" with Law no. 1.565 on the protection of personal data, pointing out that "the processing of reports and related investigations leads to the collection of such data and that the principles of the law must apply, such as the minimisation of data in the alert processing procedure, etc. (timeframe, relevance, confidentiality, access, transfer, outsourcing)".

A framework for processing times and acknowledgement procedures is also recommended.

In addition, if provision is made for external reports to be sent directly to other authorities, "these should be defined and the possible channels of communication between them should be provided for". In doing so, Monaco could draw inspiration from Directive (EU) 2019/1937 (Chapter III "External reporting and follow-up").

Finally, anonymous reports should not be excluded as a matter of principle, but should be regulated.

E) On information for whistleblowers

The APDP recommends that provision be made for "informing people of the ways in which they can report facts or be referred to information likely to fall within the scope of the text", and that a clearly identified entity be designated for this purpose, referring to Recommendation CM/Rec(2014)7 of the Council of Europe (free access to confidential information and advice) and Directive (EU) 2019/1937 (clear and public access to information on reporting procedures, the scope of protection and available remedies; impartial, confidential and free advice from identified structures).

The APDP suggests that the High Commissioner for the Protection of Rights, Freedoms and Mediation could fulfil this information and referral role.

F) On the interactions between the Bill and the reporting applicable to the financial sector pursuant to French law (and, potentially, of sectors concerned by specific provisions relating to alerts applicable in the Principality)

The APDP "questions the applicability in the Principality of Articles L. 511-41, L. 634-1 and 2 of the Monetary and Financial Code (CMF), which provide for procedures for reporting to French regulators. In any event, the APDP notes that the French Order of 3 November 2014 on the internal control of companies in the banking, payment services and investment services sector subject to supervision by the Autorité de Contrôle Prudentiel et de Résolution is applied by the banks, and it provides for the implementation of whistleblowing arrangements."

It notes that Monegasque banks already apply the principles of the Law Sapin 2, with extensive protection for whistleblowers. However, the more restrictive Monegasque text could "lead (...) to a lowering of the scope of protection granted under foreign law." The APDP calls on the legislator to clarify the relationship between these regimes.

G) On the impossibility of waiving or limiting the rights and remedies of whistleblowers

Finally, the APDP considers that Bill no. 987 should provide that the rights of whistleblowers may not be waived or otherwise limited, following the example of Directive (EU) 2019/1937 (Article 24) transposed by the Law Sapin 2 (Article 12-1).

* * *