Distinguishing anonymity from confidentiality

1. Regulatory Concept & Core Standards

In this video we will work through a concrete decision: explain the difference between not knowing an identity and protecting a known identity. The aim is to explain the criterion used and apply it to a workplace situation. We will start with the concept, move to the procedure and finish with a case to solve. Trust in a channel depends on what happens after someone reports. Protection concerns identity, information and working conditions. This course develops concrete measures to reduce exposure and recognise signs of retaliation while respecting the rights of the person concerned by a report.

Anonymity means identity is unknown; confidentiality protects known or ascertainable identity against unlawful disclosure. Omitting a name does not remove indirect clues. In Bulgaria, anonymous reports do not initiate proceedings under the Act. Article 10 provides possible protection after identification and retaliation if its conditions are met.

Apply the following rule: Article 9 provides that anonymous reports do not initiate proceedings under this Act. This does not mean risk information must be ignored under another applicable procedure. Under article 10, people who initially reported anonymously outside the Act’s procedure or disclosed anonymously, and are later identified and subjected to retaliation, may be protected if the statutory conditions are met. Do not promise that every anonymous message will be handled as a valid ZZLPSPOIN report.

2. Practical Implementation & Procedure

Assess direct identifiers, context and metadata. Use case references in work communications. Where appropriate, separate identifying details from information needed for analysis. Do not promise that identity can never be disclosed. The law provides for situations arising from legal obligations or judicial decisions and rules on informing the reporting person, with statutory exceptions. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An unnamed report says the event occurred in a meeting with only two participants and includes a presentation bearing its author's name. The team recognises that formal anonymity does not prevent identification. It limits sharing and prepares a description without unnecessary clues. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Can an anonymous report require the same confidentiality precautions as an identified report? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

Yes. Its contents may identify the author or third parties. Handling must consider that possibility and restrict access. An empty name field does not remove the duty to protect information.

One mistake to avoid is: presenting anonymity as an absolute impossibility of identification in every circumstance.

Now apply the national rule to a second decision. The form always requires a name and identity document, but the page advertises anonymity. How should this be corrected?

First apply the national regime and define what the channel actually offers. Where identity is unnecessary, do not require it for technical convenience. Where it is a condition for a particular status, explain that before submission. Correct the fields and public information together while preserving material already received.