Systemic Failures Across Global Outsourcing Chain: Whistleblower Escalates Action Involving Google, Cognizant, Teleperformance and Concentrix

A whistleblower who has previously submitted formal complaints to the Comissão Nacional de Proteção de Dados, the Public Prosecutor's Office, and the European Data Protection Board regarding Google, Cognizant, Teleperformance and Concentrix, has initiated coordinated legal and regulatory action concerning alleged systemic failures in data protection compliance, whistleblower protections, and corporate accountability.

The action relates to Global Data Breaches potentially affecting millions of users across more than 30 jurisdictions. Due to ongoing obstruction and lack of transparency, the full scale cannot yet be definitively quantified, but is considered significant.

Systemic Issues Across a Global Outsourcing Chain

The concerns extend beyond a single entity and relate to a broader operational chain involving:

Google
Teleperformance
Concentrix
Cognizant

The whistleblower alleges that failures within this interconnected ecosystem raise systemic compliance risks, rather than isolated incidents.

Notably, Teleperformance previously initiated summary proceedings in an attempt to silence the whistleblower. Those proceedings were rejected by the court.

Systemic Obstruction and Breakdown in Accountability

Recent correspondence with Google, Cognizant and Concentrix reveals what the whistleblower characterizes as a systemic obstruction pattern.

In particular:

-the response to the whistleblower's Article 15 GDPR requests, originally submitted in March 2025, remains incomplete nearly one year later;
-disclosed materials contain extensive redactions without individualized legal justification, contrary to GDPR transparency requirements;
-no document-by-document legal basis has been provided for those redactions;
-the Data Protection Officer has asserted that the SAR response is complete, despite the absence of requested materials relating to whistleblower-related processing;
-the Chief Compliance function has referred back to the same SAR process, while separately asserting that whistleblowing matters fall outside its scope;
-formal responses have been issued without identifying any responsible individual or accountable function, despite explicit requests.

The whistleblower considers this position internally contradictory and legally unsustainable, resulting in a circular situation where:

-whistleblower-related data is excluded from the SAR on the basis that it falls outside scope, while
-access to that same information is denied outside the SAR by reference back to the SAR process.

This pattern is characterized as a constructive refusal of access under Article 12(4) GDPR, and as evidence of a broader systemic obstruction pattern affecting both data subject rights and whistleblower protections.

Whistleblower Channels and Legal Compliance

Under Directive (EU) 2019/1937 and its implementation in Portugal through Law 93/2021, organizations are required to maintain accessible, transparent, and effective internal reporting channels, including for former employees.

The whistleblower asserts that:

-the information provided does not meet the required level of clarity or accessibility;
-the practical ability to submit a fully informed report is undermined by incomplete and inconsistent disclosures;
-the separation between whistleblower obligations and GDPR obligations is being mischaracterized to avoid scrutiny.

Parallel Legal and Regulatory Action

The matter is advancing on multiple fronts simultaneously, including:

-further regulatory complaints before the Comissão Nacional de Proteção de Dados;
-escalation to the European Data Protection Board and US regulators for central coordination across jurisdictions;
-judicial proceedings seeking full enforcement of GDPR rights and disclosure obligations;
-continued engagement with the Public Prosecutor's Office.

Market Context

Google, Cognizant, Teleperformace and Concentrix are all publicly listed companies. The issues raised may have implications for investor transparency, corporate governance, and regulatory exposure across multiple jurisdictions.

Public Interest and Next Steps

Given the cross-border nature of the alleged breaches and their potential scale, the whistleblower intends to pursue:

-coordinated EU-level enforcement across more than 30 jurisdictions;
-further public interest disclosures where appropriate;
-continued legal action to ensure accountability and compliance across the involved entities.

Further updates will follow as proceedings develop.

Pç do Marquês de Pombal 14, 1250-162 Lisboa
Sofia Goncalves

Cambridge Samuel is an independent advocacy platform and not a law firm. Individuals are encouraged to seek qualified legal counsel. All disclosures are made in the public interest and in protection of fundamental rights under EU and Portuguese law.

This release was published on openPR.