From Whistle to Echo: Data Leaks in Web-Based Whistleblowing Channels

Whistleblowing refers to reporting misconduct to responsible authorities. With accelerating digitalization and the European Union’s new whistleblower directive, large numbers of whistleblowing channels and company web pages that act as gateways to these services have been deployed. At the same time, on modern websites rife with third-party services such as web analytics, this development introduces privacy challenges. In the current study, we analyze websites of 15 Finnish companies and the whistleblowing services they employ in order to assess whether they inadvertently reveal identifying personal data to the employee’s company and third parties. Results indicate there is reason for serious concern about the privacy of whistleblowers who report wrongdoings online.