Internal procedure for collecting professional alerts

Any company, association or public institution with at least 50 (fifty) employees or any local authority with more than 10,000 (ten thousand) inhabitants.

The number of employees must be at least 50 (fifty) for twelve months, consecutive or not, during the previous three years.

The persons concerned must establish procedures for collecting the alerts provided for in III of Article 8 of the Act of 9 December 2016, in accordance with the rules governing the legal instrument they adopt. This procedure can be entrusted to a third party and/or can be set up jointly with other companies (only for companies with less than 250 employees).

From September 2022, the procedure must allow for the collection of internal (employees, former employees) or external (candidates, applicants, subcontractors, external collaborators, etc.) reports.

The procedure for collecting alerts specifies the way in which the author of the alert :

• Addresses the alert to the direct or indirect superior, the employer or the referee (who may be external to the organisation setting up the procedure);
• Provide the facts, information or documents, whatever their form or medium, to support the report when they have such information;
• Provide the elements allowing, if necessary, an exchange with the addressee of the alert.

The procedure specifies the measures taken by the body:

• To inform the author of the alert without delay of the receipt of the alert, as well as of the reasonable and foreseeable period of time required to examine its admissibility and of the arrangements for informing the author of the alert of the action taken;
• To guarantee the strict confidentiality of the author of the alert, of the facts that are the subject of the alert and of the persons concerned, including in the event of communication to third parties where this is necessary solely for the purposes of checking or processing the alert;
• To destroy the elements of the file on the alert that enable the author of the alert and the persons concerned to be identified when no action has been taken on it, as well as the time limit, which may not exceed two months from the end of all admissibility or verification operations. The author of the alert and the persons concerned shall be informed of this closure.

The procedure must also mention the existence of automated processing of alerts implemented after authorisation by the Commission nationale de l'informatique et des libertés (CNIL).

The body shall disseminate the procedure for collecting alerts that it has established by any means, in particular by notification, posting or publication, if necessary on its website, in such a way as to make it accessible to members of its staff or agents, as well as to its external or occasional collaborators. This information may be provided by electronic means.