Yuliia Zahoruiko
· Published
A false name on a report exposes an innocent colleague #
A whistleblowing channel lets reporters give their name if they want to. It cannot check that the name is theirs. Anyone can type a colleague’s name, work email and phone number into a form, an email or a voicemail, and the report arrives signed by that colleague.
We know of no published enforcement case built on this. It is a scenario. Case handlers should plan for it anyway, because it costs the person who does it almost nothing.
How it plays out #
Anna wants to hurt Ben. She files a report accusing their manager of falsifying expenses and signs it with Ben’s name and work email.
The handler sees a named, confidential report and does what feels correct. They write to Ben at his work address to confirm receipt and ask for details. Ben has never heard of the report, so he asks a colleague what it means, or forwards it to IT as suspected phishing. Now other people know a report exists, and they believe Ben made it.
Even without that email, a name in a case file travels. It is in the notes shared with the investigator and behind the questions the investigator asks. The manager works out who “complained” and starts treating Ben accordingly.
If the report is false, Ben is in a worse position. Article 23(2) of Directive 2019/1937 requires Member States to penalise reporting persons who knowingly report false information, and to provide for compensation of the damage it causes. The signature on the report points at Ben.
Ben fits neither role #
The Directive’s protections are written for two people. The reporting person gets confidentiality of identity (Article 16) and protection from retaliation. The person concerned, the one the report is about, gets the presumption of innocence and protection of identity while the investigation runs (Article 22). Ben was cast as the reporter without being one. Few whistleblowing procedures say what to do with him.
Confirm through the channel first #
The safeguard costs a genuine reporter nothing.
- Treat the name as a claim. Record what the reporter typed, and act on it only once it is confirmed.
- Ask the first questions in the channel’s own secure inbox. The reply reaches whoever submitted the report. If that was Ben, he confirms. If it was Anna, Ben is never involved.
- Never contact a named reporter about the report through work email, phone or chat, or in person, unless they have asked for that through the channel.
Before an investigator interviews the named reporter or the organisation puts protective measures in place, the confirmation should be in the case file. If it turns out the report was filed in someone else’s name, that becomes part of the investigation: knowingly false information, and possibly harassment of the colleague who was named.
In EthicsPortal, reporter contact details in the case file are labelled as given by the reporter and not verified, and the case handler manual includes the rule above. Other routes by which reporters get exposed are in how whistleblowers actually get identified.