Actually, there are multiple instances one can use to whitleblow.
Any company above 50 employees should host such an instance as well.
Therefore you can chose where to whistleblow.
After whistleblowing you get an acknowledgement within seven days. After three months they have to report back what actions have been started about the topic.
The instances of the state have to additionally share all recieved tips to the public annually.
There is another instance for the EU hosted.
The exact national law may differ within EU countries. And I am not a law expert as well.
Anyhow you therefore have a channel to report any authority.
For EU citizens: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937
The states shall provide a secure and anonymous channel to enabling safe whistleblowing. A software for this is globaleaks.org
A state should provide a channel to anonymously blow the whistle. Then, this information is forwarded to the correct authorities.
This sounds awesome, but what authorities exactly are the correct ones? What happens when I want to report THE authorities?
Actually, there are multiple instances one can use to whitleblow. Any company above 50 employees should host such an instance as well. Therefore you can chose where to whistleblow.
After whistleblowing you get an acknowledgement within seven days. After three months they have to report back what actions have been started about the topic.
The instances of the state have to additionally share all recieved tips to the public annually. There is another instance for the EU hosted.
The exact national law may differ within EU countries. And I am not a law expert as well.
Anyhow you therefore have a channel to report any authority.