A firm’s first answer to this problem is always the same, and it is a reasonable one: before pasting, take the names out by hand. Nothing to buy, available immediately, and on paper it settles the matter. It is worth working out what it actually costs, because that part shows up later.
Twenty minutes, and they are not twenty minutes
On a forty-page pleading, manual substitution is a run of find-and-replace for every name, every tax code, every address, every amount, every identifying date. Then comes the reread for the values that appeared in another form, “Rossi”, “Mario Rossi”, “Mr Rossi”, “R.M.”, and the one for values inside tables and footnotes.
Call it twenty minutes, which is the optimistic estimate. The cost is not the number: it is that the twenty minutes are spent before the result arrives, at the point where the saving the tool promised has not shown up yet. That is why the rule breaks, and it always breaks in the evening.
The bill in money, worked out properly
Twenty minutes, said like that, frightens nobody. It becomes another thing once multiplied, and it is a sum any firm can redo with its own numbers in thirty seconds.
Take how many times a week somebody in the office would hand a document to a model if they could do it calmly: in a three-person firm that is easily five or six, because the occasions are a summary, a comparison of two versions, an outline, a translation, a piece of research. Five times twenty minutes is one hour forty a week, which is around seventy hours a year. At a conservative hourly rate that is thousands of euro of professional time spent on find-and-replace.
The number is not the interesting part, though, because those seventy hours do not get spent: they get avoided. Nobody does twenty minutes of manual cleanup five times a week: after the second time you either stop using the tool or stop cleaning up. The real cost of redacting by hand is not the time it takes, it is the use it prevents and the shortcut it makes inevitable.
What survives is what nobody looks for
Manual substitution fails in a characteristic way: it takes the names and leaves the rest. Docket numbers survive, and they identify a case in one step. IBANs survive, and they identify a person with no reasoning required. Land registry references survive. Dates of birth survive, and with a place of birth they are most of an Italian tax code.
And the file survives, which is the part nobody looks at: the author in the metadata, the folder path, the tracked changes in a .docx, the text layer under a scan. What still identifies a document after the names are gone is in the piece about metadata.
A firm’s rule lasts as long as it is convenient
An AI policy holds for as long as following it costs less than going round it. If anonymising by hand means twenty minutes and one more file lying around, the trainee at nine in the evening, with tomorrow’s filing, pastes the thing. Not out of carelessness: the rule is asking him to give up the one thing that gets him finished on time.
And this is the part that belongs to the partner, not to him: the firm is the controller, and people authorised to process data have to be instructed (Article 29 GDPRopens in a new tab). “I told them not to” describes an instruction, not a measure.
The difference between those two words matters more than it looks, because Article 32 asks for technical and organisational measures appropriate to the risk, and the two adjectives are not interchangeable. A written rule is an organisational measure, and it is necessary; but an organisational measure that asks people to be slower every single time is a measure that wears itself out. A technical measure that makes the compliant route also the quickest one needs reminding to nobody, which is what happens when cleanup goes from twenty minutes to thirty seconds. The written rule is still needed: it is what says what to do when the tool is not there.
And the bill for the mistake, when the mistake gets out
There is a second column in this sum, and it only shows up when something goes wrong. A tax code that slipped through into an outside service is not a typo: it is a disclosure of personal data to a recipient with no claim to it, and the definition of a breach in Article 4(12) GDPR covers exactly that.
From there the sequence is written down and it has deadlines. You assess the risk to the rights of the people involved; where the risk is not unlikely, you notify the supervisory authority within seventy-two hours (Article 33); where the risk is high, you tell the people themselves (Article 34). That last step is the heavy one: the person to tell is the client, and the message you have to send says their filing was sent to a third-party company to be summarised.
Alongside sit the Article 83 fines, the bar’s disciplinary proceedings, which start without any complaint, and a possible claim for damages. None of these lines appears in the twenty-minute estimate, and all three together cost more than the difference between doing it by hand and not doing it.
The automatic route, and how it gets paid for
A tool that does the job in thirty seconds changes what the rule means, because the compliant route becomes the convenient one. The condition is that the bill does not come back from another direction: if the tool charges per page, every large file reopens the same question, and for a three-hundred-page file the rational answer goes back to “I will do the first ten by hand”.
That is why Omissia is priced per seat and not per page, with as many pages as the work needs. The work happens on the firm’s own computer, every value found is shown before it is replaced, and the values with a check character, tax codes, VAT numbers and IBANs, are verified rather than guessed.