Confidentiality and legal protection, explained

Two different protections, often confused

"Confidentiality" and "legal protection" get talked about as one thing, but the Directive treats them as two separate guarantees, in two different articles, doing two different jobs: Article 16 controls who's allowed to know a reporter's identity; Article 21 controls whether the act of reporting can be used against them in a legal proceeding. A channel — or a company — can get one right and the other wrong.

The confidentiality duty: who's allowed to know

Article 16(1) is direct: a reporter's identity can't be disclosed to anyone beyond the authorised staff members competent to receive or follow up on reports, without that reporter's explicit consent. Not "kept reasonably private" — restricted to a specific, named category of people, by default.

Trade secrets carry their own version of the same duty: Article 16(4) requires a competent authority that receives a report containing trade secrets not to use or disclose them beyond what's necessary for proper follow-up. Confidentiality isn't just about the reporter's name — it extends to sensitive material the report itself might contain.

When confidentiality can be lifted — and what has to happen first

Article 16(2) allows disclosure of a reporter's identity where it's a necessary and proportionate obligation under Union or national law — in the context of an investigation by a national authority, or judicial proceedings. That's not a loophole a company can invoke at will; it's specifically tied to a legal process already underway. Even then, Article 16(3) requires appropriate safeguards, and the reporter should be told in writing before the disclosure happens — unless telling them in advance would jeopardise the investigation or proceedings it's part of.

The liability shield: reporting itself can't be held against you

Separately from confidentiality, Article 21 protects a reporter from a category of legal consequence that predates the Directive entirely: being sued or prosecuted for the act of reporting. Two specific protections:

• Acquiring or accessing the information. Article 21(3) protects a reporter from liability for how they got hold of the information they reported or disclosed — provided getting it didn't itself amount to a separate, self-standing criminal offence. Reading a document you weren't sent but had legitimate access to isn't penalised just because it led to a report; breaking into a system to get it would be a different matter entirely, outside this protection.
• Being sued over the report itself. Article 21(7) shields a reporter from liability in legal proceedings for defamation, breach of copyright, breach of secrecy, breach of data protection rules, disclosure of trade secrets, or compensation claims under private, public, or collective labour law — where those proceedings are brought because of the report. A reporter can rely on having made a protected report to seek dismissal of such a case outright.

Both protections share the same precondition as the rest of the Directive's protections: the reporter needs reasonable grounds to believe the information was true and that reporting it was necessary to reveal the breach (Art. 6(1)) — not certainty, but a genuine, reasonable belief, not a guess or a deliberately false claim.

What the shield doesn't cover

Article 21(4) draws a clear boundary: liability for acts or omissions unrelated to the reporting or public disclosure itself is governed by ordinary law, same as it always was. The shield protects the report — it doesn't retroactively immunise unrelated misconduct just because the same person also happened to raise a report at some point.

Legal basis

• Art. 16(1), Directive (EU) 2019/1937 — identity restricted to authorised staff, without the reporter's explicit consent.
• Art. 16(2)–(3) — the narrow exception for investigations or judicial proceedings, and the safeguards and advance-notice duty that come with it.
• Art. 16(4) — the parallel duty covering trade secrets contained in a report.
• Art. 6(1) — the "reasonable grounds to believe" precondition shared across the Directive's protections.
• Art. 21(3) — the exemption from liability for acquiring or accessing the reported information.
• Art. 21(4) — the limit: unrelated acts or omissions stay governed by ordinary law.
• Art. 21(7) — the exemption from liability in legal proceedings brought because of the report itself (defamation, copyright, secrecy, data protection, trade secrets, labour law).