Anonymity and confidentiality are not the same

In an anonymous report, the person's identity is not known. In an identified report, the identity is known but must remain confidential and accessible only under the conditions permitted by law.

What the EU framework provides

Directive (EU) 2019/1937 requires the identity of reporting persons to remain confidential. It allows Member States to determine whether private and public entities and competent authorities must accept and follow up anonymous reports. The organisation must therefore confirm the applicable national rule and clearly explain the options it provides.

The operational challenge

Without a contact channel, it can be difficult to clarify facts. A follow-up code makes continued communication possible without requiring the reporting person to reveal their identity.

How code-based follow-up works

  1. The person submits a report without creating an account.
  2. The system provides a unique code.
  3. The person keeps the code and returns to the follow-up page.
  4. The team can request clarification through the case.
  5. Replies remain associated with the case without a personal login.

Configuration safeguards

  • Do not request personal data that is not necessary.
  • Explain the effects of choosing anonymous or identified reporting.
  • Define who may access the identity when it is known.
  • Prepare messages that do not expose information to third parties.
  • Train the team not to attempt to infer a person's identity improperly.

The organisation's policy should align with the form's technical configuration and the internal handling procedure.

Official source: Directive (EU) 2019/1937 — EUR-Lex. The national transposition law must be checked for the country concerned. This content does not replace legal advice.