Paper 2026/937
Pseudonymization and reporters’ protection by design in the EU whistleblower directive
, NASK National Research Institute, NASK National Research InstituteAbstract
The EU Whistleblower Directive aims to create a framework where the persons reporting breaches of EU law are protected against retaliation. In contrast to GDPR, it is mainly based on trust assumptions and not on the concept of privacy and security by design. As we are explicitly dealing with problems of unlawful behavior, this is a critical issue. In this paper, we analyze the role of pseudonymization, the main technical tool promoted in the GDPR, within the Whistleblower Directive. To see the real impact of the Directive, we analyze how these issues are reflected in the national law in Germany and Poland. We show that the current law does not take advantage of the opportunities given by pseudonymization and does not create a clear legal framework that can be converted to problem-relevant technical requirements. Even worse, it allows the Member States to ban anonymous reports. On the other hand, we show that so far, no pseudonymization tool developed within official ID management frameworks addresses all threats to reporting systems.
Metadata
- Available format(s)
-
PDF
- Category
- Applications
- Publication info
- Published elsewhere. Journal of Cybersecurity
- DOI
- https://doi.org/10.1093/cybsec/tyaf028
- Keywords
- whistleblowerprotectionEU Directiveanonymitypseudonymity
- Contact author(s)
-
miroslaw kutylowski @ nask pl
gabriel wechta @ nask pl - History
- 2026-05-14: approved
- 2026-05-12: received
- See all versions
- Short URL
- https://ia.cr/2026/937
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2026/937,
author = {Mirosław Kutyłowski and Gabriel Wechta},
title = {Pseudonymization and reporters’ protection by design in the {EU} whistleblower directive},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/937},
year = {2026},
doi = {https://doi.org/10.1093/cybsec/tyaf028},
url = {https://eprint.iacr.org/2026/937}
}
