Who may know who made the report?

Identity remains within a small circle of handlers

The identity of a reporter is in principle known only to the person who receives and handles the report: a designated official or a small team within the organisation. Outside that circle, the identity is not shared — not with a manager, not with colleagues, not with the person about whom the report is made — unless the reporter explicitly consents to this or there is a legal obligation to share the information, for example in criminal proceedings. This confidentiality obligation applies to everyone involved in the handling, even if that person is not the final responsible party.

This principle applies in both the Netherlands and Germany, because both countries have transposed the European whistleblower directive into national legislation. The weight given to this protection does vary in practice: in Germany, breaching the confidentiality of the reporter's identity carries a fine up to an amount specified in the law itself, as one of the more serious infringements alongside retaliation and obstruction of reporting. In the Netherlands, the House for Whistleblowers currently has no power to impose fines for this, but failure to protect the identity of a reporter is one of three grounds on which future sanctioning power is provided.

Article 16 of the directive requires confidentiality

The confidentiality obligation regarding the reporter's identity stems from Article 16 of Directive (EU) 2019/1937, which has been transposed in the Netherlands into the Whistleblower Protection Act and in Germany into the Hinweisgeberschutzgesetz. Both laws thus follow the same European basis, with their own implementation of supervision: in the Netherlands, sanctioning power is still in legislative preparation, in Germany the fine for breaching confidentiality is already included in § 40 HinSchG.