Article 37 Appropriate protection for reports of breaches

1.   Where a person makes a report in good faith about alleged breaches of the legal acts referred to in Article 4(3) of the SSM Regulation by supervised entities or competent authorities, the report shall be treated as a protected report.

2.   All personal data concerning both the person who makes a protected report and the person who is allegedly responsible for a breach shall be protected in compliance with the applicable Union data protection framework.

3.   The ECB shall not reveal the identity of a person who has made a protected report without first obtaining that person’s explicit consent, unless such disclosure is required by a court order in the context of further investigations or subsequent judicial proceedings.