I see your point very clearly. Is there a security issue? Presumably the ombudsperson would not be turning this information over and would have a duty to anonymize the information. Is it the case that inadequate protections exist at this point for someone who has come forward?
If you don't mind, I have one more question about this. Typically, I think it won't be the exploited person; it will be some form of human rights organization intermediary that would be doing this. What are the appropriate remedies to make sure that one can safely and confidently approach the ombudsperson's office? That should be an easy fix.