Article 26 2.

Member States shall ensure that, where persons submitting substantiated concerns so request, the supervisory authority takes the necessary measures for the appropriate protection of the identity of that person and their personal information, which, if disclosed, would be harmful to that person.