The controller shall ensure that it is able to receive confidential reports of violations of data protection law which have occurred in its area of responsibility.