Voice reports and anonymisation, explained simply

Why offer oral reporting at all

Article 9(2) of the Directive lets internal channels take reports in writing, orally, or both, and where a channel takes oral reports, they have to be possible "by telephone or through other voice messaging systems." Several national laws make an oral route mandatory: the Netherlands requires one, and Italy's regulator ANAC expects both written and oral reporting. Even where it's optional, some people will say what they won't write down. Whatever route you take (a staffed phone line, a voicemail box, in-browser recording), the goal is the same: a reporter has to be able to give their account out loud, not just type it.

The decision every channel operator actually faces

Supporting voice reporting isn't just "turn on a microphone." A raw voice recording is itself identifying data — GDPR Art. 4(14) defines biometric data as personal data resulting from processing of physical or behavioural characteristics capable of identifying a person, and a voice falls squarely within that. Anyone offering voice reporting has to decide what happens to the recording, and the common approaches trade off against each other:

• Keep the raw audio. The simplest option, and the most common by default — but it's also the biggest privacy gap. A raw recording sitting in storage is something that could identify the reporter from the voice alone, for as long as it's kept, whether or not a name is attached to the report elsewhere.
• Transcribe it and discard the audio. This removes the voice itself as an identifying signal, but it loses tone, hesitation, and emphasis that can matter to how an account is actually understood — and it usually introduces a human transcriber (in-house or a third-party service) who hears the raw recording at least once before it's converted.
• Anonymise the audio itself. More technically involved than either of the above, but it's the only option that keeps the recording — tone, pauses, emphasis and all — while breaking the link back to who's speaking. This is the approach Provoxis takes.

Every recording gets anonymised — not just the anonymous ones

The detail that surprises people about doing this well: voice anonymisation shouldn't depend on whether a reporter chose to report anonymously or under their own name. The reasoning is about the recording itself, not the reporter's stated preference — an identified reporter's raw voice sitting in storage for years is still something that could later be used to identify them from the recording alone, independent of whether their name is attached to the report elsewhere. Provoxis runs every recording through the same process, unconditionally, regardless of how the reporter chose to submit.

How Provoxis's shift actually works

Provoxis processes every recording using established, open-source signal-processing tools, run in-house rather than through a third-party API. Three things happen to every recording, deliberately:

• Pitch is shifted by a randomised amount, not a single fixed factor. A constant shift would itself be a risk: if that one transform ever became known, applying its inverse would recover something close to the original voice. Randomising per recording closes that off.
• Formants are shifted, not preserved. Formants are the resonances of someone's specific vocal tract — the part of a voice that identifies who is speaking, separately from pitch. Shifting pitch alone while leaving formants untouched would still sound recognisably like the same person; shifting both is what actually breaks re-identification.
• Tempo is left alone. Naively resampling audio to change pitch changes speed too, which is both a giveaway and an accessibility problem. Pitch and formants are shifted without speeding up or slowing down the recording.

What happens to the original recording

The raw upload is held only transiently — in temporary storage for the duration of the anonymisation job — and deleted immediately once the anonymised version is safely stored. It's never written to the permanent case record, and no role, including Provoxis staff, can access it once processing completes. If the job fails, the raw file is still deleted once retries are exhausted rather than left sitting in storage indefinitely. The anonymised recording is the only version anyone — handler or reporter — ever hears back.

Because the anonymisation happens in-house rather than through a third-party voice-processing API, it also doesn't add a sub-processor to your data-processing agreement — one less vendor for a company's own DPO to track and disclose, and one less place a raw recording could sit outside your own control.

Legal basis

• Art. 9(2), Directive (EU) 2019/1937 — reporting in writing, orally, or both; oral reporting by telephone or other voice messaging systems.
• Art. 4(14), GDPR — the definition of biometric data as personal data resulting from processing of physical or behavioural characteristics capable of identifying a person, which a raw, unshifted voice recording can fall within.