French Duty of Vigilance Law: first decision on the merits rendered by a French Court

Key takeaways for businesses

• The French 2017 Duty of Vigilance Law is precursor to the forthcoming EU Corporate Sustainability Due Diligence Directive (CSDDD) and the French enforcement decisions based on the Duty of Vigilance Law are key to understanding the litigation risks that are likely to arise from the CSDDD. 
• The first decision on the merits under the French Duty of Vigilance Law was rendered on 5 December 2023 by the Paris Judicial Court, more than six years after the enactment of the Duty of Vigilance Law in 2017. 
• Prior to 5 December 2023, only four cases brought on the basis of the Duty of Vigilance Law had been ruled upon, but they were dismissed for procedural reasons.
• In its landmark decision dated 5 December 2023, the Judicial Court of Paris upheld the claim of a trade union against the French state-owned postal company and ordered the latter to amend and supplement its vigilance plan. 
• For the first time, a French court has set out its expectations with respect to: (i) the risk mapping in the field of human rights and environment; (ii) the assessment of subcontractors; and (iii) the assessment of the effectiveness of the measures taken under the vigilance plan.
• However, the Paris Judicial Court has dismissed the request for the implementation of precise and concrete measures to prevent risks. The latter are considered to fall outside the judges’ powers, as it cannot step into the shoes of the company and its stakeholders.
• The decision is immediately enforceable but is not final as it may be appealed by either party before the Paris Court of Appeal and, possibly, before the French Supreme Court (Cour de cassation) at a later stage. 

Context 

The Duty of Vigilance Law 

On 27 March 2017, the French legislative enacted the French Duty of Vigilance Law, setting out an obligation for large corporates (subject to specific thresholds based on their turnover and number of employees) to define and implement a “vigilance plan”, seeking to identify and prevent serious violations of human rights and fundamental freedoms, health and safety of individuals and damage to the environment resulting from the corporates’ activities, as well as of those of its subcontractors and suppliers down the value chain. 

Since 2017, a number of legal challenges were brought by activists seeking French corporates to amend and act on their vigilance plans in the field of environment and human rights. 

The French Duty of Vigilance Law is a precursor to the draft CSDDD (CS3D) currently being negotiated at the EU level. Until 5 December 2023, all claims made under the French Duty of Vigilance Law were declared inadmissible on procedural grounds, leading activists to believe that “doors were being shut” by the courts with regards to bringing litigation based on the French Duty of Vigilance Law.

Sud PTT's claim based on the Duty of Vigilance Law 

On 22 December 2021, the trade union Sud PTT served a writ of summons on the French state-owned postal company (“Company”) based on the Duty of Vigilance Law. 

In particular, the trade union requested the Paris Judicial Court (the “Court”’) to order the Company to amend and supplement its vigilance plan by including: 

• its risk mapping identifying, analysing and prioritising risks;
• an exhaustive list of the suppliers and subcontractors which have an established commercial relationship with the Company, organised by subsidiary, by service and by geographical sector, as well as publication of key indicators in relation to the suppliers and subcontractors (including the volume of subcontracted activities, the difficult nature of the subcontracted tasks, and the dependency of the corporate on these activities); 
• procedures for assessing subcontractors on the basis of specific risks identified by the risk mapping; 
• a whistleblowing mechanism, after consultation with the trade unions;
• adequate measures relating to the prevention of undeclared work by subcontractors, safety and psycho-social risks within the group, its subsidiaries and subcontractors and suppliers, and harassment; and 
• an effective system to monitor the implementation of the vigilance measures, including the allocated resources and the set objectives.

In addition to the requested amendments to the vigilance plan, the trade union also requested the Court to order the Company to proceed to the effective implementation of measures relating to the fight against harassment, undocumented work, and illegal subcontracting. The trade union requested the Court to order precise and concrete measures to be taken by the business, including the immediate termination of contracts with subcontractors or service providers which use undeclared work. 

The final oral hearing took place on 19 September 2023.

The decision rendered by the Paris Judicial Court on 5 December 2023

Summary of the Court’s findings 

In its landmark decision dated 5 December 2023, the Court upheld part of the trade union’s claims against the Company, ordering the latter to:

• supplement its vigilance plan with a risk mapping identifying, analysing and prioritising risks;
• implement procedures for assessing subcontractors, on the basis of specific risks identified by the risk mapping;
• supplement its vigilance plan with a whistleblowing mechanism, after consultation with the trade unions; and
• publish an effective system to monitor the implementation of the vigilance measures. 

However, the Court dismissed certain claims made by the trade union, namely the trade union’s requests to have the Company: 

• publish the exhaustive list of suppliers and subcontractors; and
• implement measures relating to the prevention of undeclared work by subcontractors, safety and psycho-social risks within the group, its subsidiaries and subcontractors and suppliers, and harassment.

Key points 

The key points of the decision of 5 December 2023 are as follows: 

• For the first time, the Court has set out its expectations with respect to: (i) the risk mapping in the field of human rights and environment; (ii) the procedure for the assessment of subcontractors; and (iii) the monitoring programme of the vigilance measures to assess their efficiency. 

Risk mapping: In its decision, the Court provided a very detailed analysis of the risk mapping published by the Company, which is partly reproduced in the decision itself. 

The Court made several criticisms of the risk mapping conducted by the Company, both on the contents and format of the risk mapping. 

On the contents of the risk mapping, the Court noted in particular that: 

• The risk mapping described the risks at a very high level of generality. In the Court’s view, the risk mapping did not enable a determination of which specific risk factors linked to the Company’s activity and organisation contribute to breaching the corporate’s “protected values”. 
• The risk mapping did not sufficiently highlight the Company’s priority focuses; it should enable the Company to set reasonable priorities for action.
• The risk mapping should take specific risk factors which are listed (non-exhaustively) as follows: “the sector and nature of the business, its location, the type of commercial relationship and the legal framework underpinning it, the size, structure or resources of subsidiaries or partners, as well as the material conditions under which the service is produced or carried out”.
• The manner in which the most serious risks were ranked was also criticized. The Court noted that the Company “decided to rank the risks according to their seriousness, as they remain after the application of the measures already applied by the Group. The effect of this approach is to put the practical implications of the Group's activities into perspective and, as a result, to level all "net" risks at a low level”. The Court also noted a lack of consistency with the vigilance measures included in the vigilance plan.

On the format of the risk mapping, the Court noted that “there is nothing to prevent the parent company and principal from having access, confidentially, to a detailed cartography enriched with figures for each operational unit”. However, the published version of the vigilance plan must “enable the public and stakeholders to know the precise identification of the risks that the activity poses to human rights, health and safety and the environment”. 

The Court criticized in particular the lack of prioritisation of the risks by the Company’s risk mapping and noted in particular that “the risk mapping does not provide any information, even in summary form, about the factors linked to the activity or organisation that may actually give rise to the risks. Ranking risks at a very general level, while already incorporating the effects of existing measures, does not make it possible to identify the actions that should be introduced or reinforced as a priority”.

The findings of the Court appear to be critical, having regards to the extracts of the risk mapping reproduced in the decision, which show that the Company had: (i) a detailed methodology identifying risks within the group, its suppliers, partners and subcontractors, and its entities in France and abroad, and listing the risks identified for each category; and (ii) a hierarchy established according to a criterion of 'criticality' of the risk. The Company also raised that the risk mapping had been done in cooperation with the trade unions, without question being raised by the claimant.

Assessment of subcontractors: The Court also decided to grant the request of the trade union to have the Company establish assessment procedures for its subcontractors. 

The Court noted that, although concrete assessment procedures exist (including an outsourced assessment, internal operational controls and an automated document control system), “it cannot be verified that they are strategically oriented towards understanding the risks that need to be addressed as a priority”. 

On this basis, and considering that the risk mapping “does not specify the precise risk factors or their prioritisation”, the assessment procedure of the Company’s subcontractors was considered to be insufficient. 

Monitoring programme: The Court ordered the Company to publish a “real system to monitor” (réel dispositif de suivi) the implementation of the vigilance measures. 

While noting that the vigilance plan contains a table of key indicators, the Court found that “beyond external communication on the recognition of its corporate social responsibility policy”, the vigilance plan “does not provide a useful measure of the effectiveness of the measures taken, nor does it serve as a useful assessment to guide action in terms of vigilance”. However, the Court did not provide guidelines as to its expectations in relation to the effective monitoring of the vigilance plan.

In particular, the Court noted that “the report succinctly and randomly presents some of the measures included in the vigilance plan, with an analysis focusing on just two specific subjects. Furthermore, even though some measures are reported separately, (…), the vigilance plan report makes no reference to them, even in summary form”.

• The Court has refused to order the Company to take precise and concrete measures requested by the trade union to prevent human rights violations. 

The trade union had requested the integration of measures in the company’s vigilance plan to prevent: (i) health and security risks in relation to the use of subcontracting in certain subsidiaries; (ii) psycho-social risks; and (iii) harassment. 

The Court recalled the purpose of the Duty of Vigilance Law and noted the high standards that it has set. In particular, it noted that based on the Duty of Vigilance Law, “appropriate actions to mitigate risks or prevent serious harm cannot be limited to general statements of intent but must address the risks identified, with priority given to those for which the risks of harm to people and the environment have been deemed the most critical in the mapping. Even if the measures are reasonable, they must be sufficiently specific to be effective in preventing the most serious risks and limiting the impact of the other risks identified”.

On this basis, the Court noted that the part of measures contained in the vigilance plan are general and not specific, and that the risk factors and the objectives of the vigilance plan are not integrated in a hierarchized risk mapping. As such, the Court considered that the measures cannot be considered as “appropriate” measures within the meaning of the Duty of Vigilance Law. 

However, the Court also noted that the claims of the trade union tend to request an injunction against the Company to take precise and concrete measures. 

The Court noted that judges do not have the power under the Duty of Vigilance Law to order the company to take precise and concrete measures, as it cannot step into the shoes of the company and its stakeholders. The Court mentioned that judges only have the power to have companies integrate in their vigilance plans the appropriate actions to mitigate and prevent serious risks.

In this respect, the Court’s decision mentions that the Duty of Vigilance Law:

“does not give the judge the power to order the company to take specific appropriate measures, but simply aims to "ensure compliance" by the parent company/contractor "with the obligations set out in I", including the obligation to include in the plan "appropriate measures to mitigate risks or prevent serious harm. 

The law thus introduces judicial control over the inclusion in the plan of concrete, appropriate and effective measures consistent with risk mapping. 

In the event of a breach of this obligation, it gives the court the power to order the company to draw up, as part of the self-regulation process, safeguard measures that the company must define in association with the stakeholders, as well as additional, more concrete and effective actions linked, where appropriate, to an identified risk. 

However, this provision should not lead the judge to take the place of the company and its stakeholders in requiring them to introduce precise and detailed measures”.

By way of example, having regard to the request to terminate contracts as soon as a subcontractor uses illegal workforce, the Court noted that “determining whether it is more virtuous to terminate [a] subcontract as soon as […] breach is observed or more effective to provide for a system of penalties with formal notice is a strategic discussion that goes well beyond the judge’s remit. On the contrary, it relates to an analysis of the risk factors that must be carried out in association with the company and the stakeholders in order to reasonably develop an effective measure to avoid or limit the risk”.

For these reasons, the requests of the trade union seeking to have the Court order the Company to comply with precise and concrete measures were dismissed. 

On a side note, it is also worth noting that: 

• The Court did not address the civil liability regime arising from the Duty of Vigilance Law, which fell outside the scope of the dispute as no compensation claim was brought by the trade union;
• The Court refused to judge that corporates should publish the exhaustive list of suppliers and subcontractors. 

The Court noted that “the list of partners with an established commercial relationship may cover thousands of companies and fluctuate over time” and that “it has not been demonstrated to what extent their identification at the date the plan is drawn up and published would be necessary for its implementation and assessment”.

• The Court noted that the whistleblowing mechanism in relation to the Duty of Vigilance Law should be implemented in cooperation with the trade unions.

It is up to the group parent company “to establish that it has endeavoured to build, in cooperation with representative trade union organisations, a whistleblowing mechanism adapted to the various stages of its value chain”.

The fact that the whistleblowing mechanism implemented further the French anticorruption legislation was specifically adapted in light of the Duty of Vigilance Law is seen as insufficient. 

• The Court did not appear to specifically respond to the argument of the Company according to which the trade union’s request was creating confusion between the Company group's obligations under the French Labour Code (in particular subcontracting and outsourcing) and those under the Duty of Vigilance Law. 

The Company had interestingly raised the argument that the trade union was using the Duty of Vigilance Law to attempt to supplement the numerous French legal obligations in the area of health and safety, whereas – according to the Company – the objective of the Duty of Vigilance Law was mainly to develop actions in particular in countries where the law did not present the same requirements.

The Court did not respond to this argument in its decision. 

• On certain aspects, the decision may appear to slightly differ from the approach taken by previous decisions rendered in the Uganda case. 

The 5 December 2023 decision appears to differ slightly on certain aspects from the decisions of 28 February 2023 in the Uganda case: 

• The Duty of Vigilance Law is said to be inspired by the UN and OECD principles. 

As an introduction to its decision of 5 December 2023, the Paris Judicial Court noted that the Duty of Vigilance Law’s grounds (motifs) and parliamentary works are “based on the United Nations principles on business and human rights adopted unanimously by the United Nations Human Rights Council in June 2011 and the Organisation for Economic Co-operation and Development (OECD) guidelines for multinational enterprises”.

In its decision of 28 February 2023, the Court had held that the Duty of Vigilance Law provides for general obligations, without precise limitations, and does not directly refer to guiding principles or international norms. 

• The fact that the trade union did not challenge the risk mapping conducted by the Company when the vigilance plan was being drawn up is considered to be irrelevant.

In its decisions of 28 February 2023, the Court had noted that the Duty of Vigilance Law requires the vigilance plan to be developed through a collaborative process with the company’s stakeholders, to ensure its efficiency.

In its decision of 5 December 2023, the same court acknowledged that the vigilance plan is to be set up through a collaborative process, but also noted that the lack of challenges or criticisms raised during this process should not prevent stakeholders to further send formal notices to improve the vigilance plan. Interestingly, formal notices are seen by the Court as being part of the “amicable phase” aiming at elaborating the vigilance plan.

• The update of the vigilance plan throughout time is not considered to be a hurdle to the review of the trade union’s claims. 

In its decision of 5 December 2023, the Court appeared to be reviewing the last version of the vigilance plan produced in the proceedings by the Company (the corporate’s annual report of 2021, published in March 2022), rather than the earlier version of the vigilance plan that prompted the last formal notice and writ of summons served by the trade union on the Company in 2021. 

In its decisions of 28 February 2023, the Court had, however, noted that the NGO’s claims were inadmissible to the extent that their requests were initially brought against a vigilance plan dated 2018, while the criticisms made by the NGOs on the date of the hearing concerned a vigilance plan dated 2021. The same procedural hurdle had been raised in previous cases, leading the court to declare the claim inadmissible.

The decision did not explicit whether the Company’s vigilance plan was substantially updated between 2021 and 2022. 

It must be noted that the current case was attributed to the Chamber 1/4 of the Paris Judicial Court, which is a different Chamber to the ones that had ruled in the Uganda case. In addition, when ruling on the Uganda case, the Paris Judicial Court ruled over procedural claims, and not on the merits as it did on 5 December 2023. 

Possible next steps 

The decision of 5 December 2023 is immediately enforceable. 

However, on a practical point, the decision did not provide for a timeframe within which the Company must comply with the order. Also, the decision did not set a penalty payment pending the establishment of the Company’s amended vigilance plan, although the trade union had requested the payment of a daily penalty of €50,000 for each day of delay in the compliance with the court order. 

The decision may be appealed by either party before the Paris Court of Appeal. Should that be the case, an appeal decision of the Paris Court of Appeal would be expected within approximately 12-24 months. At a later stage, a further appeal to the French Supreme Court (Cour de cassation) may be possible. 

In its comments, the Company noted that the implementing decree provided for in the 2017 Duty of Vigilance Law has not been published yet and that corporates are therefore subject to great legal uncertainty pending the adoption of the CSDDD.

Further reading 

For further materials on business and human rights:

• see our blog post: EU CSDDD: lessons learnt from the French Duty of Vigilance law;
• listen to our podcast (in French) on the results and lessons to be learned from the last six years of application of the French law on the duty of vigilance; 
• see our Business & Human Rights webpage.