# Standards and Regulatory References — Whistleblower Data Protection

## Primary Legislation

### EU Whistleblowing Directive 2019/1937
- Art. 6: Conditions for protection — reporting persons must have reasonable grounds.
- Art. 8-9: Internal reporting channels — organisations with 50+ employees.
- Art. 16: Processing of personal data — confidentiality, data minimisation, GDPR compliance.
- Art. 17: Record-keeping — reports stored no longer than necessary and proportionate.
- Art. 18: Retention — comply with confidentiality requirements.
- Art. 19-21: Protection measures — prohibition of retaliation.

### GDPR
- Art. 6(1)(c): Legal obligation — operating the channel required by Directive.
- Art. 6(1)(e): Public interest — investigating reported breaches.
- Art. 9: Special category data — allegations may include sensitive data.
- Art. 10: Criminal offence data — allegations of criminal conduct.
- Art. 14: Right to be informed — accused person's rights, subject to Art. 14(5) restrictions.
- Art. 23: Restrictions — to safeguard investigation integrity.
- Art. 35: DPIA required — vulnerable data subjects, criminal data, significant consequences.

### WP29 Opinion 1/2006 (WP117)
- Whistleblowing limited to serious matters.
- Anonymous reports accepted but not actively encouraged.
- Accused person informed as soon as investigation is not prejudiced.
- Retention: 2 months post-investigation closure.

## National Transpositions

| Jurisdiction | Law | Key Provisions |
|-------------|-----|----------------|
| France | Loi Waserman (2022-401) | CNIL framework; 2-month retention; mandatory DPIA |
| Germany | HinSchG (2023) | Art. 10 confidentiality; 3-year retention; DPO involvement |
| Italy | D.Lgs. 24/2023 | Garante guidelines; mandatory DPIA; data use restriction |
| Netherlands | Wet bescherming klokkenluiders (2023) | Enhanced identity protection; external channel |
| Spain | Ley 2/2023 | Anonymous reports accepted; 3-month retention |

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| CNIL | SAN-2020-015 | EUR 100,000 | Reports retained 5 years — excessive |
| Garante | 2022-0178 | Restricted | IT staff had access to report content |
| AEPD | PS/00123/2023 | EUR 150,000 | Whistleblower identity disclosed to accused |
| BfDI | 2023 Audit | Corrective measures | No anonymous reporting capability |
| AP (NL) | 2023 Investigation | Warning | No DPIA for whistleblowing channel |