Whistleblowing: the whistleblower’s confidentiality must extend beyond the reporting platform

A secure digital reporting channel is not enough if the procedures followed by those handling the report allow the whistleblower to be identified. In Resolution No. 344 of 9 September 2026, ANAC sanctioned the three members of a company’s whistleblowing management body, emphasizing the need to protect the whistleblower’s identity throughout the investigation, including at the preliminary stage.

The case and the authority’s decision

The case concerns a report submitted through the company’s reporting platform regarding alleged contractual irregularities. In order to verify the allegations, the Whistleblowing Management Body interviewed members of the small working group involved, disclosing details about the existence of the report, the contract concerned and the supporting documentation attached to it.

According to ANAC, this information, combined with contextual details already known to those interviewed, made it possible to identify the whistleblower. The way in which the investigation was conducted therefore undermined the protection initially afforded by the encrypted platform. The Authority consequently imposed a fine of €15,000 on each of the three members for breach of the confidentiality obligation laid down in Article 12 of Legislative Decree No. 24/2023.

Confidential information

The key point of the resolution is that confidentiality protection extends beyond the whistleblower’s name. It covers any information from which the whistleblower’s identity may be inferred, even indirectly. In the absence of the whistleblower’s express consent, such information may not be disclosed to anyone other than those competent to receive or follow up on reports and expressly authorised to process the relevant personal data.

The Authority emphasises that the decisive factor is whether the information disclosed is capable of identifying the whistleblower. Even instructing interviewees to keep the information they have learned confidential is insufficient, as this does not prevent them from independently inferring who submitted the report.

Key considerations and practical guidance
The resolution highlights the need to complement the platform’s technological safeguards with practical measures to protect confidentiality throughout the investigation. Fact-finding activities must be planned with due regard to the composition of the working group, the existing knowledge of those involved and the risk that individual details, when pieced together, may reveal the whistleblower’s identity.

For those responsible for handling reports, this means assessing in advance what information may be disclosed and how interviews should be conducted, adopting investigative methods that preserve confidentiality. A secure reporting channel is therefore an essential safeguard, but its protection must be maintained throughout the process by those responsible for handling the report.