Corporate responsibility and compliance:
transition to the industrial era

According to the annual AMRAE (Association pour le Management des Risques et des Assurances de l’Entreprise [French Association for Corporate Risk and Insurance Management]) survey on the operational and contractual risks of companies, “compliance“ has now gone largely beyond the management of traditional risks: competition, dominant position, cartel, termination of negotiations, established trade relationships, corruption, conflict of interest, etc. Inflation of national and foreign regulations (for contracts in the accounting period) places ever greater criminal and financial responsibilities on companies and their managers, who now have to invest more in the workplace, on environmental protection or, more recently, implement ethical standards along the whole supply chain. Digitalization plays an increasing role: it certainly facilitates supplier management and the duty of care, but it also triggers new supervision standards (personal data, cyber security, etc.) and potentially increases the risk of adverse media exposure.

Duty of care: everyone concerned, especially in-house counsels

Companies can no longer simply display their ethical principles “towards human rights and fundamental freedoms, health and safety of persons and the environment”: about 150 large French groups, and also indirectly applies to their subsidiaries, sub-contractors and suppliers must also ensure that these are duly implemented. Legal departments play a strategic role in the implementation of these new provisions: risk-mapping, regular evaluation procedures, the appropriate actions for risk mitigation or the prevention of serious infringements, warning mechanisms, etc. Beyond that, to assess intent: in case of a legal action, the legal department will be able, for example, to demonstrate the specificity and relevance of the clauses included in sub-contractor and supplier contracts.

”Regulatory turmoil requires support combining data protection, anti-trust, anti-fraud, anti-corruption and financial regulation.”

The key word: awareness

In terms of these obligations, legal departments clearly have a preventive role towards the various business units and support functions—as well as the duty to remind them. If not done yet, they will have to rethink their organization and their processes and develop internal skills, in particular through the creation of “Risk Manager” positions. The choice of external partners will also be critical to manage the organization of compliance implementation programs or even to monitor operational staff training. De Gaulle Fleurance & Associés’ cross-disciplinary approach towards cases has always proven suitable to efficiently handle matters of antitrust, fraud and corruption, protection of personal data and financial regulations; where needed, we cooperated with business partners: software engineering companies, IT consultants, auditors, organizational consultants, etc.

Data in compliance policies

2017 was the year of far-reaching cyber-attacks: Saint-Gobain estimated the impact of the malware NotPetya on its operating income to be €80 million, and several huge data leaks considerably dented the credibility of role players, especially of data intelligence experts. A study by the BVA group conducted in October 2017 showed that only one out of every four French person thinks that their personal data on the Internet are safe enough. Yet, trust is at the heart of economic development and every company.

The growing impact of cyber risks

The European Union’s objective with the GDPR, the corollary NIS [Network and Information Systems] legislation and e-Privacy texts is to provide citizens with greater control over data and to force companies to structure their mechanisms, by imposing financial sanctions (up to €20 million in fines or 4% of world-wide turnover). Not counting the publicity, which would be considerable in the case of, for example, personal service providers, public institutions or health industry champions. At this point in time, where 80% of cyber-attacks exploit negligent personal behaviors (unrestrained file sharing via private platforms, unsecured cloud storage, etc.), maturity where the chain of responsibility and cyber security are concerned remains very disparate across organizations—they simply must increase their governance and data management abilities with respect to automation, monitoring, anonymization or even encryption. It is no longer a matter of asking “whether” these processes must be initiated, but “how” to carry it out as efficiently as possible—including in anticipation of the next European Regulation on Privacy and electronic communication that will affect all electronically communicated data, content such as metadata, including non-personal data, whether stored or transmitted. In the era of big data, very few companies will be exempt.

Companies are henceforth solely responsible

Under the GDPR, the rights of individuals are reconfirmed (consent is emphasized) and individuals also acquire new rights (portability, to be forgotten, class actions, etc.) that are to be implemented. Privacy protection must be considered right from the start when systems and practices are designed (privacy by design and privacy by default); for many companies, a specific register must be kept and a DPO (Data Protection Officer) must be appointed. France has for a long time had orga­nizations (CNIL, ANSSI (Agence nationale de la sécurité des systèmes d’information [French national cyber­security agency])) enforcing a plethora of good practices, and the country’s legal arsenal in respect of cybersecurity is particularly advanced. But many companies that were, up until now, hardly concerned by the regulations, have not implemented any precautionary steps.Three out of four French companies will therefore not be ready by May 25, 2018. While the larger companies, which were already compliant with the French Data Protection Act, had already made the necessary changes and developments, 70 % of ETIs (Entreprise de taille intermédiaire [medium-sized companies]) admit that they have not initiated steps towards compliance. Negotiations and litigation can be expected, because monitoring starts on May 26, 2018—companies must at least be compliant with the previous legal system, and must be able to provide proof that they are mak­ing a real effort to reach the new standards... The fact is that in France, the Data Protection III bill presented on December 13, 2017 does not leave companies much time to comply.

“The assistance of efficient lawyers makes it possible to anticipate the impact on your business, to ensure the legal compliance of your projects and to optimize your competitiveness.”

Identifying risks...

Today, it is just as crucial to be insured against cyber-attacks as against the risk of fire. Fraud and cyber insurance policies cover “Fraude au Président” (international wire transfers attemps), ransomware (ransoming via data encryption), distributed denial of service (DoS or DDoS), data leaks (data breach) or even defacement of a website; generally regarding three aspects: damage to assets (risk of operating losses), civil liability and crisis management. It is essential to outline the scope and the guarantees offered by the insurance coverage depending on the company’s business activities, because hacks would not have the same impact on an airline as they would on an e-commerce or a health data operator. Recommendations that we have implemented in French and international groups this year include: investment in efficient structures for physical and computerized access management; the implementation of stress tests and scenarios including crisis communication and activity resumption plans; subscription to dedicated insurance; the drafting/revision of cyber security clauses in sub-contractor and operation contracts, etc. At the turn of 2018, several dangers are already identifiable. Requests for personal access (Subject Access Requests) launched en masse by campaigners may disrupt SMEs who are under-equipped to deal with such flows; or the connected infrastructures of “smart cities” may be exposed to cyber-attacks and chaos via proximity apps or connected health, transport or law enforcement devices (IoT [Internet of Things]).

…and seizing opportunities

These impacts encourage organizations to consider a compliance strategy, on very short notice and on the longer term, not to be viewed as a constraint, but rather as a vehicle for growth. Our goal is to make a contribution so that this new privacy-by-design standard can be regarded as a strategic tool (securing production structures) and a future profit center (benefitting from credibility and customer loyalty).

Digitization or transformation of the economic model?

Digitization refers to the conversion of analogue data into digital form. Digitalization refers to the adoption/increase in use of digital technology by an organization. Does either of them always guarantee success? A number of pure players, the standard bearers of disruption, suffered severe setbacks. Others continued their metamorphosis: Google launched into automobiles, a start-up in domotics joined a world leader in the automation of the open­ing and closing of houses and build­ings, etc. At a point in time when digitalization is often considered as the only/easy fuel for growth, a study entitled “Histoire d’incompréhension: les dirigeants de PME et ETI face au digital [A story of misunderstanding: SME and ETI managers faced with digitalization]” by Bpifrance Le Lab, rightly points out that a company’s development plan cannot be reduced to the mere digitization of tools and services and that it will fail as long as only one in four managers include their ope­rational teams in the process.

This new way of creating value re-examines three dimensions of the business model: the customer, the organization and its partners. Uber, which uses algorithms to determine the route and the price, has proven the relevance of the integration of user data, and almost all goods and services can take inspiration from them to multiply their service angles and to improve efficiency—a humanistic goal which sometimes goes against the interests of companies deprived of their business intelligence in the name of open data. And let us not forget the lesson in humility inherent in the concept of uberization, since the icon itself saw the Court of Justice of the European Union rejecting its shrewd positioning as a computerized services provider to classify it as a taxi operator. Law evolves in a world that is constantly on the move. Effort, R&D and the legal consolidation of the two ensure sustained agility.

The Corporate at the heart of transformation

Many industrial operators greatly disrupt their structures, their business activities and their teams. De Gaulle Fleurance & Associés positions themselves in support of those involved in transformational projects (whether strategic or operational), to help ensure that complex transformational projects create value. The primary issue for consideration is certainly the future of individuals. As part of our mission to assist companies in difficulty, we handle the moderniza­tion of industrial facilities and the empowerment of employees with great care: investing in partial automation may guarantee a refocusing on human skills, avoid outsourcing or even allow relocalization, all by overhauling the assets and perpetuating the company’s profitability.

According to the Cegos’ annual survey on social climate and the quality of work-life, the positive and negative ef­fects of digitalization found a balance. The industrial digitalization under way at many of our clients’ companies (addi­tive manufacturing, connected traceability tools, enhanced reality, auto­mations, etc.) has boosted reorganization—mobilizing labor law experts to deal with its effects (specialization/staff reductions, restructuring of res­ponsibilities, development/training prospects). Assets of industries of the past, human resource management and social dialogue still remain two key aspects in the success of the industries of the future.

Growth and transformation demand that the control of the structure be maintained, throughout possible pri­vatizations, changes in governance, mergers and other acquisitions. Funding is one of the main accelera­tors of development. This year has seen a strong increase in the range of funding possibilities, with the first ever fundraising in crypto-currency (ICO[Initial Coin Offering]) and via crowd-funding. Its development caught a number of banking operators by surprise, forcing them to quickly incorporate direct financing capacities, technological partnerships or even repurchases.

In the private equity market, we supported operations that aim not only to finance the maintaining and return on business, but also—as explained Olivier Millet, president of Afic in L’Usine nouvelle magazine at the end of 2017—a change in the average size of unlisted French businesses. Stepping up from fiduciary responsibility to societal and economic ambition, “gather financing from committed and long-term inves­tors” actually allows buying or investing, to set ETIs free from their geographical and industrial boundaries.

The matters dealt with this year demonstrated the recomposition of the elec­tricity value chain. On the one hand, the sharp increase in the number of self-consumption and self-production projects is supported by technological progress and a favorable regulatory environment. On the other hand, the marketing of electricity storage capacities has started to change the playing field in the network economy, thanks to the decreasing volatility of wholesale prices and the increasingly effective management of the irregu­larity of wind and photovoltaic energy. Lastly, technological innovation and digitalization once again turn out to be the trump cards in the transformation of the sector by offering new solutions (offshore wind farms, smart meters, IoT, production regulation authorized by big data consumption analysis, etc.) and new needs (mixed funding, smart grids and blockchains which improve the flow of production and energy purchasing, etc.). As many brand-new perspectives to structure and capitalize on—which require an excellent understanding of the underlying and a good dose of entrepreneurial spirit to be among the first to turn a profit from the energy transition.

Teams ready to listen

Partners, coworkers, legal experts and staff, enriched by their differences and their synergies, daily contribute to offer services seeking to achieve excellence and tangible results, at the core of a relationship of trust. Consistently and creatively, relying on the diversity of their initial training and their previous and current experiences, they explore the law to elaborate innovative solutions, manage turmoil, make time an asset, and help you take efficient and appropriate decisions. 42 partners and 66 associates join forces to serve you. They are supported by 41 employees (Secretary-General, Assistants, Business Development, Communication, Accounting, Documentation, Billing, IT, General Services) who provide a complementary and essential dialogue for your satisfaction: information, accessibility, etc. We are also always seeking to adjust our fee policies and our invoicing methods in line with your requests.

Opportunities for sharing

We organize or sponsor numerous events and meetings allowing us to establish and nurture the relation­ship with all our clients and partners: breakfasts and conferences, news-feeds on social networks, etc. Our customer data management tool (CRM), in compliance with regulations applicable to personal data, allows us to manage these activities, and the platform https://preferences.dgfla.com/ gives you the opportunity to specify your subjects of interest, so as to always receive the information and offers that are most useful to you. Our teams, but also our clients and our partners, regularly meet at our company head offices in Paris. In 2018, in the interest of our continuing growth and for the convenience of visitors as well as the members of our law firm, we are setting up a LexLab in our offices: a new space that encourages synergy and opens new perspectives to receive, organize, imagine, test and produce together.

It would be difficult to sketch a picture of a typical lawyer or staff, since it is precisely from its diversity that De Gaulle Fleurance & Associés draws its creativity. We are aware that our advantage, our legal creativity, relies on a type of freshness which is by definition not lasting, but also on talent nurtured by experience. Commitment and integration are therefore strategic issues and we strive to create the conditions for a fruitful and lasting professional experience. In terms of both recruitment and career management, our difference is based on differences.

Every lawyer is an “intrapreneur”

Regardless of them being or not part of the Millennials generation, our lawyers are seeking structural modularity and meaning in practicing their profession. Everyone’s participation in our law firm’s project facilitates its implementation. Each lawyer is considered an “intra­preneur“ [internal entrepreneur] in the firm, hence the creation of “Lex Do It“ this year, our call for development projects open to lawyers of all ranks. Agile and specific, this action framework calls for creative contributions from volunteers, ensures steady competence building and the visible assumption of responsibility by everyone, and generates sustainable development of the activity. The absence of departments and the regular rearrangement of teams ensure interaction with various Partners and Seniors, and allow practice in various industries and with different clients. While moving up the ranks, lawyers are offered opportunities for individual and group development—managed by the Secretary-General and an Of Counsel lawyer who is also a university professor. Our internal legal training program is supplemented by offering the opportunity for business coaching: management of customer relation­ships, management and team-work, languages, communication, etc. All members of the company under­go annual performance reviews and discussions to guide their internal value and employability.

HR at the core of the structure

Male/female equality and attention to conditions striving for a balance between professional and personal life form part of the objectives of our human resources management. There are plenty of opportunities for friendly get-togethers and social acti­vities, in particular, seven annual internal events, a Team Building committee and a Softball team. Asked about his career, one of our lawyers responded with a smile: “I joined De Gaulle Fleurance & Associés as an intern. Now, ten years later, I am a Partner. I have seen young law­yers cutting their teeth here, and then pursuing a career elsewhere, only to return... I can testify that a partnership contract, in the full sense of the word, and the promise of internal growth as well as wide-ranging training, is a reality here.”

For us, the concept of commitment goes far beyond just the performance of a legal service. We are involved in our business community and in a number of converging actions with the intention to make sustainable development and the social responsibility of companies a reality.

Controlling environmental impact

Recycling and cutting down on the consumption of consumables, stationery and paper helped save 117 trees in 2017. Since 2009, we encourage travel by train, and provide a bicycle parking facility. Starting in 2011, gradually moving towards paperless invoicing. Since 2015, issuing re-usable isothermal mugs, accepted by coffee machines, to each new company member.

Skills promotion policy

Transparent skills/ranks grid, annual interviews, including for lawyers, individual and group training courses, mentoring system and referents for all profiles.

Investment in academic and public debates

Our lawyers, including several Professors and PhDs, participate in numerous think tanks and networks that contribute to the advancement of legal thinking in France and abroad: events and publications of the IBA and INTA, the Agora des Directeurs Juridiques (French forum for general counsels), CEPS [Centre d'Étude et de Prospective Stratégique], Barcelona ABS Conference, etc. They also contribute to the training of students at schools such as ESSEC and HEAD, as well as at several universities (Paris I, II, V, VII, XII, Nancy, Saint-Etienne, Strasbourg, Lyon, Evry, etc.). In partnership with the Institut des Assurances [Institute of Insurance] at Paris Sorbonne, we created an annual prize to reward a “Rising Talent in Insurance Law” about to enter the business world. In particular, we support the Sciences Po Law School.

Stakeholders in a shared world

We participate and contribute financially to the “Virades de l’espoir” running races organized by the association Vaincre la Mucoviscidose (fighting cystic fibrosis) to raise the necessary funds to finance medical research and patient care.

Lastly, we are committed to diversity and, in particular, breaking the glass ceiling: 16 of our 42 partners are female; many of our lawyers are involved in mentoring networks; we are the official sponsors of the racing driver Inès Tait­tinger (the only female competitor in the 2016 “24 Hours Le Mans” race); the ambassador for the second part of our advertising campaign in the national press in 2017 was a resolute young woman, who intended to represent a member of our team as well as a client or business partner.