Internal and external reporting to the whistleblower protection officer
Everything you need to know about the internal and external reporting procedures with Santé publique France.
Resources and Contacts
For more information or if you have questions about whistleblower status and reporting procedures:
To learn more about the Santé publique France procedure:
Santé publique France has appointed a Whistleblower Protection Officer (RPLA), responsible for receiving “reports,” assessing their admissibility, and ensuring that they are handled in accordance with the provisions on “whistleblower protection” set forth in Articles 6 and following of Law No. 2016-1691*.
In accordance with Article 6 of this law, “report” means the disclosure, in good faith and without financial compensation, by a natural person, concerning a crime, an offense, a threat, or harm to the public interest, a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France, of a unilateral act of an international organization taken on the basis of such a commitment, of European Union law, or of a law or regulation. Facts and information covered by national defense secrecy, medical confidentiality, the secrecy of judicial deliberations, the secrecy of judicial investigations or proceedings, or attorney-client privilege may not be disclosed.
The RPLA at Santé publique France is responsible for receiving and processing reports:
Internal reports: reports submitted by any individual who has or has had a contractual relationship with Santé publique France (current and former Santé publique France employees, collaborators, service providers, committee members, job applicants, etc.) and relating to an incident that meets the definition set forth in Article 6 of Law No. 2016-1691*. In this case, the report must concern facts of which they became aware, either personally or through a third party, within the scope of their contractual relationship with Santé publique France and which have occurred or are likely to occur at Santé publique France.
External: submitted by any individual regarding facts that meet the definition of a public health-related report, within the scope of Santé publique France’s responsibilities: When the reported information was not obtained in the course of professional activities, the whistleblower must have personally become aware of it.
*Law No. 2016-1691 of December 9, 2016, on transparency, the fight against corruption, and the modernization of economic life.
You can contact the RPLA:
Via the online form | bluefiles
By mail: to ensure the confidentiality of your report, you should send your submission to the RPLA using a double-envelope system:
an inner envelope containing the details of the report and bearing only the following notation: “Confidential—Whistleblower Report,”
an outer envelope addressed to: Santé publique France - Whistleblower Protection Officer - 12 rue du Val d’Osne - 94415 SAINT MAURICE CEDEX
By phone: 01.41.79.68.00
Your report will be recorded on a voicemail system accessed only by the RPLA. Please remember to provide your contact information if you wish to be informed of the follow-up to your report
Anonymous reporting: When a report or public disclosure is made anonymously, the whistleblower whose identity is subsequently revealed is entitled to the same protections. However, the obligation to inform the whistleblower of the actions taken in response to their report does not apply.
In accordance with Law No. 2016-1691, any individual who reports or discloses information:
acting without direct financial compensation and in good faith;
information concerning a crime, an offense, a threat, or harm to the public interest; a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France; a unilateral act by an international organization based on such a commitment; European Union law; or a law or regulation;
excluding any facts or information covered by the five types of secrecy explicitly excluded from the right to blow the whistle (national defense secrecy, medical confidentiality, secrecy of judicial deliberations, secrecy of judicial investigations or inquiries, or attorney-client privilege);
the information disclosed was strictly necessary to shed light on the facts and to ensure their proper legal classification:
you obtained access to the information lawfully;
in compliance with the disclosure procedures established by law.
Failure to meet these conditions excludes the protections associated with whistleblower status, including immunity from criminal and disciplinary liability.
A person reporting an incident in violation of the conditions set forth by law will not benefit from the protections afforded to whistleblowers and may be subject to criminal prosecution.
There are four ways to report an incident:
Internal reporting procedure with the professional organization in question
The internal reporting procedure is available when the facts of the report:
relate to professional information;
and your knowledge of the facts stems from a current or past professional relationship with the organization in question (employee or former employee, recruitment process, contractor, colleagues, board members, shareholders, etc.).
The details of the report must concern facts of which you became aware, either personally or through a third party, within the scope of your contractual relationship with the organization, and must relate to events that have occurred or are likely to occur within the organization.
Internal reporting must be conducted as follows:
through the internal procedure for collecting and processing reports established within your organization;
or, if such a procedure does not exist, by contacting your direct or indirect supervisor, your employer, or a designated contact person appointed by your employer.
Internal reporting should be avoided if there is a risk of retaliation and no risk of evidence being destroyed. In such cases, an external reporting procedure may be initiated directly.
Even in the absence of such a risk, you remain free to file an “external report” if you deem it more appropriate. If you deem it useful, you may file an external report in parallel with an internal report.
The external reporting procedure
For incidents not involving professional information and unrelated to a professional relationship, or when the risk of retaliation and destruction of evidence prevents the implementation of an internal reporting procedure, you may file a report with:
One of the authorities listed in Decree No. 2022-1284 of October 3, 2022: Santé publique France is one of the competent authorities listed for the health sector. Also competent in this field are ANSES, HAS, IGAS, EFS, the Biomedicine Agency, CIVEN, and the national councils of the health professions.
The Defender of Rights: unless the Defender of Rights is itself competent to handle your report (see p. 40), the Defender of Rights will refer you to the authority or authorities best suited to handle your report. It is advisable to use this route if you have difficulty determining the competent administrative authority. The Defender of Rights may also be referred to by one of the authorities designated by Decree No. 2022-1284 of October 3, 2022, if that authority does not consider itself competent to handle your report. The Defender of Rights will then refer your report to the authority best suited to handle it.
The judicial authority (the public prosecutor, for example: in the case of a crime or misdemeanor).
An institution, body, or agency of the European Union competent to collect information on violations falling within the scope of Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019.
When the reported information was not obtained in the course of professional activities, the whistleblower must have personally become aware of it.
Public Disclosure
Public disclosure of the report generally requires, in order to qualify for whistleblower protection, that an external reporting procedure have been initiated beforehand. Exceptions to this principle are, however, provided for, particularly when there is a serious and imminent danger. Details of the exceptions and conditions that must be met to qualify for whistleblower protection in the event of public disclosure of the report are described on page 14 of the whistleblower guide drafted by the Defender of Rights.
Anonymous reporting
When a report or public disclosure has been made anonymously, the whistleblower whose identity is subsequently revealed is entitled to the same protections. However, the obligations to inform the whistleblower of the measures taken following their report do not apply.
The main guarantees are:
Confidentiality of communications
The procedure guarantees the anonymity of the whistleblower. The whistleblower’s anonymity may be lifted with their consent or when the RPLA is required to take legal action (the whistleblower is informed of this).
Criminal and disciplinary immunity
You cannot be subject to retaliation related to your report, and you are protected from civil and criminal liability to a limited extent, provided that you:
You have complied with the reporting procedure
You obtained the information lawfully
The information disclosed was strictly necessary to clarify the facts and ensure their proper legal classification.
For more information: see the whistleblower guide | Defender of Rights
During the investigation of the report, the RPLA will:
1. Will keep the reporter informed of the follow-up to their report and the measures implemented at each stage of the process:
A written acknowledgment of receipt will be sent to you within seven business days of receipt, unless you expressly waive this right or Santé publique France has reasonable grounds to believe that such an acknowledgment would compromise the confidentiality of your identity.
Santé publique France will provide you, within a reasonable timeframe not exceeding 3 months from the acknowledgment of receipt of the report or, failing that, 3 months from the expiration of a 7-business-day period following the report, information regarding the measures planned or taken to assess the accuracy of the allegations and, where applicable, to address the subject of the report, as well as the reasons for such measures. This period is extended to 6 months if the specific circumstances of the case require further investigation. In this case, Santé publique France must provide justification to you before the expiration of the three-month period.
2. May request additional information from the whistleblower
3. May share the details of the report with the relevant departments and agencies while preserving the whistleblower’s anonymity
4. If the report is deemed inadmissible, may, where appropriate, refer the reporter to the relevant procedure or authority.
5. Shall inform the persons named in the report, unless doing so would prejudice the investigation, while preserving the anonymity of the whistleblower.
| Submission of the Request | ||
|---|---|---|
| Phase 1a | Acknowledgment of receipt of the request to the reporter within 7 days | 7 days |
| Phase 2 | Review of the formal admissibility of the report :- Does the report concern a situation falling under the scope of the alert as defined by Article 6 of Law No. 2016-? - Is the chosen procedure or authority appropriate? - If the report is not admissible, the RPLA informs the reporter that the case has been closed and, if necessary, directs them to the appropriate procedure. |
3 to 6 months |
| Phase 3 | If the report is formally admissible, assessment of the accuracy of the allegations |
|
| Phase 4 | If the facts are substantiated, definition of remedial measures: the RPLA informs the reporter of the remedial measures being considered or implemented within 3 months of issuing the acknowledgment of receipt, or up to 6 months in complex cases (the RPLA then informs the reporter of the extension of this deadline). | |
| Phase 5 | If the facts are sufficiently substantiated, implementation and monitoring of remedial measures | Time required for implementation |
| Phase 6 | Case closure | |
| Retain the entire file for 6 years or longer if a related alert is received. Anonymize the file after 6 years unless there is historical or archival interest. | ||
The implementation of this procedure involves the processing of personal data under the responsibility of Santé publique France.
Legal Basis and Responsibility
Santé publique France is responsible for the processing of personal data received and managed as part of its role as the competent authority for health alerts. This processing is based on compliance with a legal obligation (Article 6.1.c GDPR). Depending on the reported facts, the procedure may require the processing of specific personal data (Article 9.1 GDPR) for:
the establishment, exercise, or defense of a legal claim or whenever courts act in their judicial capacity (Article 9.2.f GDPR);
for reasons of substantial public interest (Article 9.2.g GDPR).
Data Processed
The personal data processed in the context of this procedure concerns:
the identity and contact details of the person making the report;
the identity of the data subjects or persons involved in the report or its processing.
The data includes:
a description and documents enabling the characterization of the report submitted by the reporter;
a description and documents enabling the characterization of the report collected by the RPLA as part of the admissibility review;
a description and documents relating to the processing of the report
Depending on the reported facts, this data may include sensitive personal data as defined in Article 9 of the GDPR or data relating to criminal offenses, misdemeanors, or crimes.
Retention Period
Personal data collected during the report are retained as follows:
In the event of a decision of inadmissibility: all data transmitted to the RPLA is retained for 6 years following the transmission of the decision of inadmissibility and then archived in accordance with the provisions of the Heritage Code (anonymization or transfer to the National Archives if of historical, statistical, or scientific interest).
If the report is admissible: all data transmitted to the RPLA is retained for 6 years after the conclusion of the investigation into the report and any management measures implemented, then archived in accordance with the Heritage Code (anonymization or transfer to the National Archives if of historical, statistical, or scientific interest).
Recipients of the data
The processed data is intended exclusively for the Whistleblower Protection Officer, except in cases where it becomes necessary to report the facts to the judicial authorities.
Rights of data subjects
Data subjects may exercise the following rights (subject to the conditions for exercising these rights pursuant to the provisions of Articles 15 through 21 of the GDPR): access to data concerning them and the right to request a copy, rectification of the data, and restriction of processing. These rights may be exercised by mail to the whistleblower protection officer at Santé publique France: Santé publique France, RPLA, 12 rue du Val d’Osne, 94415 Saint Maurice Cedex.
If data subjects believe that their data rights are not being respected, they may file a complaint with the CNIL.
