Whistleblower Data

Whistleblower Data Protection

Overview

The EU Whistleblowing Directive 2019/1937 (Directive on the protection of persons who report breaches of Union law) establishes mandatory internal reporting channels for organisations with 50 or more employees. The Directive creates a fundamental tension with GDPR: whistleblowing channels collect sensitive allegations about identified individuals (the accused), while simultaneously requiring confidentiality protection for the whistleblower. The data protection framework must balance the whistleblower's right to protection, the accused person's right to be informed and to defend themselves, and the organisation's obligation to investigate while complying with data minimisation, purpose limitation, and storage limitation principles.

This skill provides a data protection compliance framework for whistleblowing systems that satisfies both the Directive and GDPR requirements, incorporating guidance from CNIL, the Article 29 Working Party (WP117), and national transposition laws.

Legal Framework

EU Whistleblowing Directive 2019/1937

Scope: Applies to reporting of breaches of EU law in areas including public procurement, financial services, product safety, transport safety, environmental protection, food safety, public health, consumer protection, data protection, and competition law.

Organisational requirements:

• Organisations with 250+ employees: internal reporting channel operational since 17 December 2021
• Organisations with 50-249 employees: internal reporting channel required since 17 December 2023 (with possible national extensions)
• Public sector entities regardless of size

Key data protection provisions:

GDPR Intersection

Lawful basis for whistleblowing data processing:

• Art. 6(1)(c) legal obligation: The Directive (as transposed into national law) creates a legal obligation to operate the reporting channel
• Art. 6(1)(e) public interest: Investigation of reported breaches serves the public interest
• Art. 6(1)(f) legitimate interest: The organisation has a legitimate interest in investigating misconduct

Special category data: Whistleblowing reports may contain special category data (e.g., allegations of racial discrimination, health-related misconduct). Where special category data is processed:

• Art. 9(2)(b) employment obligations: Processing necessary for obligations in the field of employment law
• Art. 9(2)(g) substantial public interest: Where national law provides a basis for processing special category data in the public interest

Criminal offence data — Art. 10: Whistleblowing reports frequently contain allegations of criminal conduct. Art. 10 processing must be authorised by national law.

WP29 Opinion 1/2006 (WP117)

The Article 29 Working Party's Opinion on whistleblowing schemes, while pre-GDPR, established principles that remain relevant:

1. Proportionality: Whistleblowing schemes should be limited to serious matters (financial misconduct, health and safety, environmental violations) — not used for routine HR complaints
2. Confidentiality: The identity of the whistleblower must be kept confidential from the accused and from anyone not directly involved in the investigation
3. Anonymous reports: Organisations should not actively encourage anonymous reporting, but must be prepared to handle anonymous reports when received
4. Accused person's rights: The accused must be informed of the allegations as soon as doing so does not jeopardise the investigation
5. Retention: Reports and investigation data should be deleted within 2 months of completing the investigation, unless legal proceedings are initiated

National Transpositions

Data Protection Design for Whistleblowing Channels

Channel Architecture

The whistleblowing channel must be designed to enforce confidentiality by default:

Technical requirements:

Dedicated third-party platforms: Many organisations use specialised platforms (EQS Integrity Line, NAVEX Global EthicsPoint, WhistleB, Convercent) that provide:

• External hosting separated from the organisation's IT infrastructure
• Anonymous two-way communication channels
• Encryption and access controls by design
• Configurable retention and deletion
• Audit trail and compliance reporting

Anonymous Reporting

Directive position: Art. 6(2) leaves it to Member States to decide whether internal and external reporting channels must accept anonymous reports. Several Member States mandate acceptance of anonymous reports (France, Spain, Italy).

Data protection considerations for anonymous reports:

• The organisation must process the report based on its content, not the identity of the reporter
• If the anonymous reporter voluntarily identifies themselves during the investigation, confidentiality protections apply from that point
• Anonymous reports may be more difficult to investigate; the organisation should still conduct a reasonable investigation
• IP addresses and metadata that could identify the anonymous reporter must not be logged by the reporting system

Identity Protection

Whistleblower identity:

• The whistleblower's identity may only be disclosed to persons directly responsible for receiving and following up on reports
• Disclosure to the accused or to others (including management, HR, or legal counsel not involved in the investigation) requires the explicit consent of the whistleblower
• In the event of judicial proceedings, disclosure may be required by national procedural law — the whistleblower must be informed before disclosure

Accused person's identity:

• The accused person has Art. 14 GDPR rights (right to be informed) but these may be restricted under Art. 14(5)(b) (where informing would seriously impair the objectives of the processing) or Art. 23 (restriction to safeguard important objectives of general public interest)
• The accused must be informed as soon as doing so would no longer jeopardise the investigation (typically after evidence has been secured and witnesses have been interviewed)
• The accused must not be informed of the whistleblower's identity unless required by judicial order

Third parties mentioned in reports: Witnesses, bystanders, and others mentioned in reports have data protection rights. Their data must be:

• Minimised to what is relevant to the investigation
• Protected with the same confidentiality measures
• Deleted when no longer necessary for the investigation

Access Restrictions

Designated Persons Model