This post examines a common failure pattern in eDiscovery: files that appear redacted but still contain sensitive data. While no specific breach is cited, the scenario highlights how inadequate verification processes can lead to data exposure.
What Happened
Imagine your team is preparing documents for opposing counsel. A Social Security number is blacked out on a PDF, and it seems ready to go. Reviewers approve it.
However, the production includes more than just the visible page. Electronic documents can hold extracted text, metadata, and native files. A visual overlay hides text but doesn't remove the underlying data. Federal court redaction guidance warns that concealed personal identifiers can remain in hidden data. If the extracted-text file or native spreadsheet is sent with the original values intact, the redaction failed, even if the page appears compliant.
Timeline
This sequence illustrates a typical process, not a specific case.
- Intake. Documents are loaded, including emails, a spreadsheet with hidden rows, and a low-quality scanned attachment.
- Detection. Automated PII detection flags potential sensitive values. It might flag an unrelated number (false positive) or miss a number due to poor OCR (false negative).
- Review. Reviewers decide which flags to accept or reject, based on instructions that may not clearly define what to redact or retain.
- Redaction. Boxes are applied to rendered images.
- Export. The production is generated with PDFs or images, extracted text, metadata, load files, and possibly native files.
- Delivery. The team checks the appearance of pages but not the actual content received by the recipient.
The failure occurs at step 6 but originates in steps 2 and 4.
Which Controls Failed or Were Missing
No verification of the delivered package. The check was "does the page look redacted?" instead of "what exactly will the recipient receive?" Without inspecting the export, there was no control over text layers, metadata, load files, or native files.
Redaction treated as a visual act. Concealing content on a rendered image doesn't modify the native spreadsheet or extracted text. Treatment was applied to one representation, not all shared representations.
Over-reliance on automated detection. Detection identifies possible sensitive values but doesn't decide on redaction. Pattern-matching tools can produce false positives and, with poor OCR, false negatives. Human review and exception handling are essential.
No file-type-specific handling. Spreadsheets can have hidden worksheets, rows, columns, and formulas not visible in a PDF. Scans depend on OCR quality. Emails require review of the message and attachments. Texts and chats need enough context for defensible decisions. A single workflow doesn't cover these effectively.
Undefined redaction rules. Without clear instructions on what to redact, retain, or escalate, reviewers improvise.
No documented exceptions or sign-off. Without a record of corrections, unresolved questions, and approvals, the team can't show what was checked or by whom.
What the Relevant Standard Requires
Rule 5.2 of the Federal Rules of Civil Procedure governs privacy protections in federal court filings. It sets the expectation that personal identifiers are protected but isn't a universal redaction rule for every discovery production. Your obligations also come from protective orders, production agreements, client instructions, and other applicable rules. Confirming which govern your matter is the first step.
Rule 5.2 specifies what must be protected but not how to ensure protection survives export. This is a program design issue, addressed by the Generally Accepted Recordkeeping Principles. The Principle of Protection calls for safeguards for private, confidential, or privileged records. The Principle of Integrity requires assurance that records are authentic and reliable. A production with unredacted PII in an unchecked layer fails the first and undermines the second.
ISO 30300 emphasizes that records processes should be defined, controlled, and evidenced. A redaction workflow without rules, verification, and sign-off isn't a controlled process.
Lessons and Action Items for Your Team
1. Define the rules in writing before review starts. Have counsel specify what to redact, retain, or escalate, based on the protective order, production agreement, and client instructions. Don't assume Rule 5.2 covers everything.
2. Separate detection from redaction in your workflow. Treat automated flags as candidates. Require a paralegal or attorney to verify each one, as a number resembling an identifier might be unrelated.
3. Test with known values. Use authorized, artificial, or sanitized documents with known sensitive values. Compare tool output against an answer sheet. Record misses and false flags. Include a poor-quality scan.
4. Inspect the exported production, not the review screen. Generate a complete sample including every format you intend to deliver: PDFs or images, extracted text, metadata, load files, and native files. Then:
- Search the export for known test values.
- Check if concealed text can be selected or copied.
- Open spreadsheets and look for hidden worksheets, rows, columns, and formulas.
These checks help but don't replace matter-specific quality control.
5. Build file-type procedures. Write specific handling steps for spreadsheets, scans, emails with attachments, and chat data. Decide deliberately how native files are treated.
6. Document exceptions and sign-off. Track corrections, unresolved questions, and final approvals. Keep source evidence separate and unaltered while validating the copies to be shared.
7. Ask vendors to prove it on your documents. Support for a file type doesn't guarantee detection and redaction behave identically across formats. Have a reviewer run a realistic record from intake through export, and ask what happens to natives, OCR output, and audit history.
For a compliance officer, the test is simple. If you can't show what was checked in the delivered files, who checked it, and against which rules, you don't have a verified redaction. You have a redaction that looks right.
This article is general educational information, not legal advice. Confirm the requirements applicable to your matter with counsel.
