Module Learning Objective

create a form that collects useful information without unnecessary identification

1. Regulatory Concept & Core Standards

In this video we will work through a concrete decision: create a form that collects useful information without unnecessary identification. The aim is to explain the criterion used and apply it to a workplace situation. We will start with the concept, move to the procedure and finish with a case to solve. The demonstrations in this course use a generic platform and fictional data. Field names depend on the chosen product. The aim is to understand which settings to look for and how to verify the result, keeping technical administration rights separate from access to case content.

The form determines what information is requested but does not replace legal assessment. Bulgarian procedure requires identification and a registration form. Do not promise that every anonymous record initiates statutory proceedings. Additional fields beyond necessary particulars require a purpose. A small department or precise shift may indirectly reveal identity.

Apply the following rule: Article 9 provides that anonymous reports do not initiate proceedings under this Act. This does not mean risk information must be ignored under another applicable procedure. Under article 10, people who initially reported anonymously outside the Act’s procedure or disclosed anonymously, and are later identified and subjected to retaliation, may be protected if the statutory conditions are met. Do not promise that every anonymous message will be handled as a valid ZZLPSPOIN report.

2. Practical Implementation & Procedure

Compare fields with article 15 and the approved form. Check required data, instructions and secure contact. Assess the need for additional information and who sees it. Review languages, accessibility and error messages. Use fictional test data and do not remove a statutory particular merely for convenience. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

In the mock-up, the department field is mandatory and offers only two teams, each with one worker. Even without a name, the answer may reveal identity. The administrator makes the field optional and explains that users should provide only the context needed to assess the facts. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Does a form without a name field, by itself, guarantee that nobody can identify the reporting person? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Context, attachments and other fields may enable indirect identification. Configuration should reduce unnecessary information, and handling must protect those elements too, without promising absolute anonymity in every circumstance.

One mistake to avoid is: requiring personal details that are unnecessary to assess the report.

Now apply the national rule to a second decision. The form always requires a name and identity document, but the page advertises anonymity. How should this be corrected?

First apply the national regime and define what the channel actually offers. Where identity is unnecessary, do not require it for technical convenience. Where it is a condition for a particular status, explain that before submission. Correct the fields and public information together while preserving material already received.

National Legal Framework: ZZLPSPOIN (Whistleblower Protection Act), transposing Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law.