Protecting the person being reported on

The Directive protects the accused too, not just the reporter

Almost everything else in this knowledge base is about protecting the reporter — their anonymity, their confidentiality, their protection from retaliation. The Directive separately protects the person a report is actually about. Art. 5(10) calls this the "person concerned": "a natural or legal person who is referred to in the report or public disclosure as a person to whom the breach is attributed or with whom that person is associated." A case can be handled diligently for the reporter and still be handled badly for the person concerned — they're a distinct set of obligations, not a footnote to the reporter's.

What they're actually entitled to

Art. 22(1) requires Member States to ensure persons concerned "fully enjoy the right to an effective remedy and to a fair trial, as well as the presumption of innocence and the rights of defence, including the right to be heard and the right to access their file." In plain terms: a report is an allegation, not a finding. The person it names hasn't been found to have done anything as far as the process is concerned unless and until an investigation actually establishes that, and they're entitled to a genuine opportunity to respond before a conclusion is reached — not told about a finding after the fact as a formality.

Why "right to be heard" doesn't mean "told immediately"

The right to be heard is about being given a real chance to respond before a conclusion is drawn — it isn't a guarantee of being informed the moment a report lands. Telling the person concerned too early can compromise the investigation before it's had a chance to gather evidence independently, or increase the risk of exactly the kind of retaliation towards the reporter the Directive is trying to prevent. Deciding when to bring them into the process is itself part of running the investigation well — see investigating a report well — not something to default to at the earliest possible moment.

Confidentiality cuts both ways

It's easy to read "channel confidentiality" as being only about the reporter, but Art. 9(1)(a)'s security requirement is broader than that: channels must be operated so that "the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected, and prevents access thereto by non-authorised staff members." The person concerned is exactly that third party. The same deliberately small, designated group discussed in designating who handles reports is the boundary around who should know someone has been named in an open, unresolved report — not just who submitted it. An accusation that turns out unsubstantiated but was informally shared beyond that group has already done real damage to someone the process itself presumes innocent.

What happens when the allegation isn't substantiated

An unsubstantiated finding is a legitimate, ordinary outcome of a diligent investigation, not a failure of the process — see writing Art. 5(13)-compliant feedback for why a clearly reasoned negative outcome is still real feedback. The quieter responsibility that comes with it: not treating the person concerned any differently once they've been cleared, and applying the same retention and access discipline to their side of the record as to the reporter's — see choosing a retention policy for how that record's lifespan is decided.

How Provoxis fits into this

Provoxis doesn't run a separate process for the person concerned — the same mechanics that protect a reporter's confidentiality apply symmetrically to anyone named in a report. Case access is limited to the same designated handlers, whatever the case is about; investigation notes are internal-only, never visible to the reporter and never automatically shared with the person concerned either; and every access to the case is captured in the same audit trail. There's no separate weaker boundary around "the accused's" side of a case — it's the same boundary, applied to both people the case actually involves.

Legal basis

• Art. 5(10), Directive (EU) 2019/1937 — the definition of "person concerned."
• Art. 22(1) — the presumption of innocence and rights of defence, including the right to be heard and the right to access their file.
• Art. 9(1)(a) — the channel-confidentiality requirement, which extends to "any third party mentioned in the report," not only the reporter.