Article
Anonymous whistleblowing – and can digital solutions reduce the problems with it?
The EU Whistleblowing Directive as a trigger
With the clock ticking towards the deadline for implementing the EU Whistleblowing Directive1,
the issues around its implementation and the surprising delay of Member States to take action have become one of
the hot legal topics of summer.
Recent surveys indicate that only a few of the Member States (including Ireland, Netherlands, Czech Republic, Romania
and Sweden) have published a draft bill of national implementing law, while countries like Austria, Luxemburg and
Cyprus have not even started, and others like Germany and Spain are in their very preliminary stages of implementation2 (for a closer look at CEE/SEE countries, our survey is available here).
The open topics for implementing the Whistleblowing Directive may vary from country to country depending on the local environment, but one topic appears to be particularly relevant for the CEE/SEE region – anonymous reports.
For some of the CEE/SEE countries which are traditionally more conservative in the area of whistleblowing3, the question of whether the state and businesses should consider reports (alleging corruption or other significant wrongdoings) by parties who decide to remain anonymous, has indeed been subject to intense public discussions.
As an example, Bulgaria is one of the countries which, with very few exceptions, has a traditionally negative approach
towards anonymous reports. They are viewed mainly as a tool for false accusations and veiled pressure on the
accused party. Taking a similar approach, Romania’s implementing bill excludes anonymous reporting.
This article elaborates on the pros and cons of anonymous reports, the approach undertaken in the Whistleblowing Directive in contrast to Bulgarian legislation which traditionally prohibits anonymous reporting – and options to balance anonymity through digital tools.
We will also touch upon the possible ways of preserving anonymity through the current trends of digitalisation and available digital tools.
Why are anonymous reports important?
Clearly, the main purpose of the Whistleblowing Directive and the entire EU initiative for ensuring minimum standards and protections for whistleblowers, is to encourage the reporting of wrongdoing at all levels of internal (private and inter-company) and external (public) relations. While the benefit of whistleblowing seems to be widely accepted within the EU community, the Whistleblowing Directive was preceded by some interesting surveys identifying why levels of reporting wrongdoing are low in the EU.
The European Commission carried out an open public consultation, the results of which showed the following reasons:
- fear of legal consequences (80% of individual respondents);
- fear of financial consequences (78% of individual respondents);
- fear of a bad reputation (45% of individual respondents)4; and
- 20% of employees would blow the whistle only anonymously.
Evident from the above, the stress of whistleblowing and the fear of retaliation and negative consequences are the main factors preventing people from reporting in the EU5. In this respect, assuring potential whistleblowers that they can report anonymously may be an efficient measure for facilitating reports.
Anonymous reporting, however, has its recognised disadvantages. First, anonymous reporting can generally make investigations more difficult to substantiate and resolve. Second, the anonymous whistleblower may not be informed of the progress and outcome of the investigation (which is a main element of the new rules under the Whistleblowing Directive to ensure the active participation of the whistleblower in the entire investigation). Third and foremost –
anonymity might reduce the feeling of personal liability, therefore encouraging false reporting.
Thus, finding a non-biased and objective approach to anonymous reporting was one of the main topics discussed in the preparatory stages of the Whistleblowing Directive.
Anonymity as per the Whistleblowing Directive
During the adoption process of the Whistleblowing Directive, various EU Committees (including the Committee on Culture and Education, Committee on Civil Liberties, Justice and Home Affairs) and stakeholders submitted their opinions and opted for a more favourable approach to anonymous reporting. There were even proposals that the Whistleblowing Directive should introduce separate clauses to regulate anonymous reports as well as measures to guarantee the anonymity and confidentiality of the whistleblowers, e.g. through implementation of anonymity settings,
cryptographic settings to the channels, etc.6
However, the impact assessment of the Whistleblowing Directive also outlined that only less than half of the EU-member states have allowed the possibility of anonymous reporting in their current legislations7.
Whereas, in some Member States anonymous reporting was limited only to certain sectors (e.g. in Austria anonymous reporting is permissible for reporting corruption and white collar crimes) or allowed for designated vulnerable groups (e.g. in France women, young employees, employees with low wages may report only anonymously). Based on the review conducted on whistleblowing, it appeared that countries took very different approaches as to the admissibility
of anonymous reports, and it remains unclear if the advantages outweigh the disadvantages.
To that end, the European legislator took the balanced approach not to regulate in a definitive way the subject of anonymous reports in the Whistleblowing Directive. It opted instead to introduce high standards for the protection of the confidentiality of the identity of the whistleblower.
In its final text, the Directive neither specifies how companies should treat anonymous reports nor does it affect the power of Member States to determine whether anonymous reports should be accepted or not.
The adopted approach in the Whistleblowing Directive to leave anonymous reports to the discretion of the Member States will likely lead to different legal regulation and differing treatment of anonymous reports, depending on the specifics of national legislation and local culture of reporting.
Curiosity may kill the cat – or anonymous reports as per the current Bulgarian legislation
Against the above background and discretion for Member States under the Whistleblowing Directive, Bulgaria is one of the SEE countries which takes a traditionally restrictive approach towards anonymous reports.
There is thus far no implementing legislation of the Whistleblowing Directive in Bulgaria (not even a publicly available draft or open discussions). Currently, whistleblowing in Bulgaria is partially regulated under scattered sector-specific rules, such as:
- reporting breaches by administrative bodies and state officials that affect state or public interests (e.g. abuse of power, corruption, mismanagement of state or municipal property, etc.);
- reporting information on money laundering and/ or proceeds of criminal activity – through internal channels and externally to the State Agency for National Security;
- reporting of cartel infringements before the Bulgarian Competition Commission, etc.
Most of these reporting procedures prohibit anonymous whistleblowing and public bodies do not investigate any anonymous reports. The motive of the Bulgarian legislator to take this approach is to avoid a flood of the
public bodies with false or insignificant reports, which might lead to uncertainty in civil and administrative
relations and ruin the reputation of the accused individual. As result of this approach, the number of people reporting wrongdoings in Bulgaria appears to be significantly lower than other European countries.
A survey conducted by the Bulgarian Institute for Legal Initiatives Foundation in 2018 shows that Bulgarian citizens are not very willing to report corruption – the main reason for this is the lack of trust in institutions.8
Another survey conducted by the Bulgarian Institute for Legal Initiatives Foundation in 2021 revealed that 73% of survey participants believe that it should be possible to submit anonymous reports in cases of corruption or conflict of interest in the workplace. As per this survey nearly two-thirds of respondents said they would be afraid to report it to the competent authorities if they witnessed corruption9.
To that end and if the main factor for the resilience of people to report wrongdoings remains the fear of negative consonances, during the public discussions on the implementation of the Whistleblowing Directive, the Bulgarian legislator may need to re-assess whether the risks posed to the administration by anonymous reports are greater than the lack of working whistleblowing channels in the country.
In countries such as Bulgaria which lack the culture of whistleblowing, implementing the Whistleblowing
Directive without the option for anonymity may ultimately prove unproductive.
Moreover, as widely discussed in surveys by different NGOs and stakeholders10, with the development of digital solutions, it is no longer the case that anonymous whistleblowing automatically leads to the abovementioned concerns.
There are available practices and solutions which may still allow accountability of the person who would misuse the reporting channel.
Can digitalisation facilitate anonymity?
Practical experience has led to several examples for the balanced introduction of anonymous reporting which may outweigh some of the raised concerns, i.e.:
- anonymous reports allowed only in certain legal and economic sectors, where the risks of wrongdoing are higher
- only accepting anonymous reports which already contain sufficient information to constitute a wrongdoing;
- appointing an intermediary third party, in charge of investigating whistleblowing reports and follow-up with anonymous whistle-blowers; and
- setting requirements for available digital channels that allow for confidentiality or anonymity of theidentity of the whistle-blower.
Out of the above, the efficiency and flexibility provided by the usage of digital tools appears to be the most
efficient and easily accessible solution for both – private and public bodies. In the first instance, digital
channels offer advantages over traditional channels of reporting (e.g. post or telephone channels where
an anonymous whistleblower may never be tracked). Whereas with a digital channel, anonymity may be protected during the entire investigation, while the identity of the whistleblower may still be revealed if necessary.
Furthermore, as result of the Whistleblowing Directive, a number of digital whistleblowing platforms on the market have developed functionalities and features that ensure the anonymity of the whistleblower, such as:
- providing a secure web platform to an entirely outsourced service that receives, assesses, investigates and follows up on the whistleblower reports;
- functionalities to conduct investigations without collecting data that could be used to identify the reporter (e.g. mitigation of a leaked IP address and meta data by using encrypted access to the case files through a personal incident number and password);
- confidential and secured two-way communication with relevant investigators and further information on the progress and outcome of the investigation;
- provision of robust digital security measures to ensure the confidentiality of the identity of the whistleblower and the data collected (e.g. end-to-end encryption in transmission and in storage, secure multi-factor authentication of the relevant authorised persons, required to investigate the claims); and
- implementation of a new ISO 37002 standard (expected by August 2021) which provides higher threshold for confidentiality.
The above may secure the complete anonymity of the whistleblower from the persons receiving the report and still allow the IT service provider the possibility of identifying the whistleblower if there is a strong suspicion of fraudulent activity.
To that end, whistleblowing digital tools may provide the necessary environment to ensure a high level of confidentiality of whistleblowers and outweigh the concerns of the legislator related to anonymous reports.
Effective protection for the identity of whistleblowers through digital tools may encourage and enable individuals to come forward and overcome their fear of retaliation – which based on available evidence remains as significant barrier.
Particularly in countries which lack an existing whistleblowing culture – such as Bulgaria, the development of modern technologies and safeguards could be the way forward to a functional whistleblowing environment.
1 Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the “EU Whistleblowing Directive”)
2 See https://www.whistleblowingmonitor.eu/
3 Only 11 EU-member states offer the possibility to anonymously make a disclosure
https://www.transparency.nl/wp-content/uploads/2019/04/Mapping-the-EU-on-Whistleblower-Protection-TI-NL.pdf
4 Summary results of the public consultation on whistleblower protection. https://ec.europa.eu/info/sites/default/
files/annex_13.pdf https://ec.europa.eu/info/sites/default/files/annex_13.pdf
5 Paul Latimer and AJ Brown, 2008, p.774; UNODC, 2015, p.50. See also, for example, a French survey that found that 20 per cent of workers would blow the whistle only anonymously (Harris Interactive, “Lanceurs d’alerte”: quelle perception de la part des salariés? 2015, p.9)
6 Such an approach is already taken in the Union competition law in the procedure for reporting of breaches of
competition law and State aid rules through an anonymous whistleblower tool. https://ec.europa.eu/commission/presscorner/detail/en/IP_17_591
7 https://ec.europa.eu/info/sites/default/files/1-11_annexes.pdf
8 Survey by Bulgarian Institute for Legal Initiatives Foundation
