Anonymous reporting procedures in Europe

Recent decisions by German courts and German and French Data Protection Authorities require international companies with German or French subsidiaries to carefully examine the local legal requirements before implementing anonymous reporting procedures and codes of ethical conduct. The Sarbanes-Oxley Act (SOX) does not automatically legalize the implementation of such measures in Germany or France. On May 26,2005, the French Data Protection Authority (CNIL) issued two decisions, which strongly suggest a ban on the use of any anonymous reporting procedures by French companies. Conscious of the difficulties the decisions triggered in light of SOX, the CNIL thereafter issued guidelines on professional reporting procedures. Companies with French subsidiaries should see that they are in compliance with the CNIL's guidelines and requirements, which are to be published shortly, or require a specific authorization from the CNIL.