General Background

For several years, the French Duty of Vigilance has been at the forefront of recent legislative developments in the fields of corporate responsibility and sustainability, with prevention of human rights violations being at the centre of legal commentary. Nevertheless, the imbrications of the Duty of Vigilance and other fields of law, particularly employment and labour law, has remained surprisingly unexplored.

A case brought before the Paris Civil Court, who enjoys exclusive jurisdiction in first instance proceedings for matters related to the French Duty of Vigilance since 2021, has given the Court the opportunity to provide an interpretation grid for both companies and practitioners in this field.

Over five years after the enactment of Law no. 2017-399 on Duty of Vigilance, the limits and the scope of the resulting obligations incumbent on major French corporations still remain vague and not specific. This decision will constitute a first step in case law shedding some light on what courts expect from in-scope companies beyond the high-level wording of the statute.

Until now, the only decisions handed down on the subject to date have concluded that the filings were inadmissible on procedural and formal grounds.

Reminder on the French Duty of Vigilance

By enacting the Duty of Vigilance Law in March 2017, France positioned itself as a forerunner in the field of corporate responsibility, imposing a Duty of Vigilance on certain companies. Introducing new articles into the French Commercial Code – Articles L. 225-102-4 and L. 225-102-5 – said Law requires French legal entities (including their subsidiaries), which at the closing of the fiscal year, count at least 5,000 employees on the French territory and/or over 10,000 employees worldwide (including affiliates' employees) to set up, publish and implement a so-called "vigilance plan", which aims at identifying and preventing any human and environmental risks resulting from the companies' activities, as well as those of its group, its suppliers and subcontractors.

The letter of the Law is fairly concise – the plan must include 5 items, which are :

• a map of potential human and environmental risks arising from corporate activities as well as supply chain;
• an assessment (updated regularly) of the situation of subsidiaries, subcontractors and suppliers;
• measures implemented for risk mitigation and prevention;
• an alert mechanism, to ensure receipt and proper management of any alert signaling potential violations as well as
• a system for monitoring and assessing prevention/remediation measures.

In the event of a breach, any interested parties may serve a formal notice on a company and, if this notice is left unanswered for 3 months, the matter can be brought to the Paris Civil Court. Stakeholders may then seek injunctive relief, with the potential application of a recurring financial penalty to secure enforcement of the court order. Furthermore, companies may also face tort actions where their civil liability could be sought for failing to prevent human rights violations through the effective implementation of a reasonable and suitable vigilance plan.

Previous decisions regarding the Duty of Vigilance

Previously, the Paris Civil Court had, in a decision handed down on 28 February 2023 (see our litigation team's analysis here), analyzed that the Law sets forth one practical requirement, which is to elaborate the vigilance plans in collaboration with stakeholders, noting that reading more into the obligation would not be aligned with the text of the statute.

Namely, because the obligation has a very extended scope, not limited to the activities of the parent company, but covering the activities of almost all actors likely to come in contact with it (other group companies, suppliers, subcontractors etc.). In addition, a strict interpretation of the wording of the Law only provides a high-level definition of the measures to be implemented as part of the vigilance plan. The Duty of Vigilance Law does not provide for a detailed definition of the information to be included, nor a reference to a specific standard to which the plan's content needs to abide by.

Lastly, the Court had recognized that no regulator or third party had been appointed with the mission to oversee conformity of the vigilance plans (or even their publication).

The plaintiff's approach

Abiding by the procedural requirement set out in the Law, a trade union (the "Union") had served several formal notices between July 2020 and May 2021 to its employer, a postal and parcel delivery company (the "Company"), considering they were in breach of the Duty of Vigilance Law.

More precisely, the Union alleged that the vigilance plan was deficient in several regards, and requested that it be completed with the following:

• a more comprehensive risk mapping to identify, analyze and prioritize risks;
• a list of subcontractors and suppliers for each department and region as well as information about their significance and impact;
• procedures for assessing subcontractors on the basis of the specific risks identified via the risk mapping;
• a warning and reporting mechanism set up in consultation with trade unions;
• adequate measures to prevent undeclared work at subcontractors' level, situations of bargaining and illicit lending of labour in the context of subcontracting, and to ensure the safety of subcontractors' employees;
• adequate measures to prevent psycho-social risks at group, affiliates and subcontractors' levels;
• appropriate anti-harassment measures and
• an effective system to monitor vigilance measures, including information about the resources allocated and the objectives pursued.

Considering that the Company had not taken any concrete measures following the receipt of the formal notices, the Union referred the matter in Court in December 2021, in an attempt to force the Company to complement its vigilance plan and set up more effective vigilance measures. The Union was asking for a penalty of 50,000 € per day of delay in compliance to be applied.

The Union's main concern lied apparently in the outsourcing of activities by the Company, particularly in the parcel and express delivery sectors, and the potential resort by subcontractor to illicit work practices. In this respect, the Union alleged that some workers were illegally hired by subcontractors, under conditions which did not comply with basic employment law requirements with regards, inter alia, to working time periods and worker's safety.

The defense's arguments

The arguments put forward by the Company are closely aligned with the Paris Court's analysis grounding its February 2023 decision. The Company's line of defense consisted in arguing strict compliance with the legal requirements, noting that the five-item list for vigilance plans grants companies leeway on how to implement their obligations. In addition, the Company claimed that the Union had itself participated in the elaboration of the vigilance plan, without ever raising any issue in terms of compliance.

In addition, the Company argued it did not hold investigation powers enabling it to verify the accuracy of information provided by its subcontractors and suppliers, since, for employment related offences, said powers are entrusted to various authorities, and in particular the Labour Inspectorate, Social Security administration (URSSAF) and criminal investigation officers.

Content of the decision

The decision is particularly comprehensive as the Court examined in detail every allegation of the Union, comparing them against the statutory requirements for vigilance plans.

1. Risk mapping

In a nutshell, the Company's plan identifies risks within the Company, its suppliers, business partners and subcontractors, listing these risks in broad categories (e.g., human rights and fundamental freedoms). A hierarchy is then established according to a criterion of "criticality", after taking into account existing actions.

In its decision, the Court criticizes this methodology on three main grounds:

• the risk map describes risks at a very high level of generality, without determining which specific risk factors linked to the activity and its organization generate a risk;
• the analysis and prioritization of risks are carried out at a global level and
• the assessment of risks is performed after implementation of mitigation measures which reduce the risks, thus hindering the initial identification of fields/actions to prioritize.

It is noteworthy that the Court dismissed the Union's request for publication of the list of suppliers and subcontractors, considering that this is not required for the effective implementation of the plan and taking into account trade secrets' protection.

2. Subcontractors' assessment procedures vis-a-vis specific risks identified in the risk map

In its plan, the Company listed a number of specific assessment procedures, combining outsourced assessment, internal operational control and an automated document control system.

However, the Court ruled that the plan does not specify the precise risk factors taken into account nor their prioritization criteria. According to the ruling, this makes it impossible to determine whether the assessment procedures are appropriate in light of the seriousness of the potential damage.

3. Lack of warning and reporting mechanism

Pursuant to French employment law, personnel representatives have to be consulted before the implementation of an alert system pursuant to the Duty of Vigilance Law. The Company adapted its pre-existing whistleblowing system to also include alerts related to the Duty of Vigilance. While doing so, the Company did not organize a new dedicated consultation process with personnel representative bodies.

Thus, the Court decides to grant the Union's request to supplement the vigilance plan with a mechanism implemented after a concertation process with the representative trade unions. This being said, the Court provides no specific guidelines on how to organize such a dialogue.

4. Lack of appropriate risk mitigation or serious injury prevention measures

In this respect, the Court blames the Company for only listing its current policies and existing procedures, without detailing how they help to prevent or mitigate risks. Further, the Court considers that the measures implemented cannot be considered "appropriate" within the meaning of the Duty of Vigilance Law because health and safety risk factors are not addressed in the risk-mapping (e.g., subcontractor's impact on illegal employment).

Nevertheless, the Court recognizes that the Duty of Vigilance Law does not grant it the power to force companies and their stakeholders to implement precise and detailed measures in this regard.

5. Lack of effective implementation and monitoring mechanism

The Company's vigilance plan presents certain indicators (e.g., number of work accidents, number of audited subcontractors, etc.) supplemented by a short analysis of certain measures undertaken within the vigilance plan.

The Court considered that the lack of exhaustivity of this table does not allow it to usefully measure the effectiveness of the measures taken, nor did it serve as a useful assessment to guide action in terms of vigilance.

6. Conclusion of the ruling

In conclusion, the Court enjoined the Company to complete its vigilance plan in order to address the above-mentioned topics, namely : (i) supplement the vigilance plan with a risk map designed to identify, analyse and prioritize risks; (ii) set up subcontractors' assessment procedures on the basis of the specific risks identified by risk mapping; (iii) supplement its vigilance plan with a whistleblowing mechanism after consultation of representative trade unions and (iv) publish an effective system to assess vigilance measures.

Nevertheless, the Court refuses to impose a penalty payment for each day of delay, considering that the Company has proven its willingness to comply by upgrading its plan in a "dynamic improvement approach" over the past years.

Looking forward

This decision is not only interesting because it is the first one rendered on the merits since the enactment of the Duty of Vigilance Law, but because it sets the first brick of the Paris Civil Court's grid to evaluate compliance with the statutory requirements resulting from this Law

The Court's decision is built on a detailed criticism of the Company's risk-mapping. Since the entire vigilance plan needs to be based on an adequate risk mapping, compliance with all other items composing a vigilance plan (i.e., prevention measures, assessment and monitoring procedures, whistleblowing system etc.) will depend upon having thoroughly identified, analyzed and classified risks. An exhaustive risk-mapping is therefore key to compliance pursuant to the Duty of Vigilance Law.

One needs to stay tuned for further guidance from the Paris Civil Court on the right level of detail to be included in the risk mapping as well as regarding the other items of a vigilance plan. From a labour law standpoint, the decision does not provide major insights as the decision is focused on the interpretation of the requirements for a proper vigilance plan.

Please contact us or a member of Hogan Lovells' Business and Human Rights group if you wish to discuss this development and how it impacts your business. We stand ready to assist companies from all industry sectors to assess how to adjust their processes and operations in this context, as well as review compliance programs.

Authored by Christelle Coslin, Alexandra Tuil, Margaux Renard, and Cristina Sanchez Herran.