When people think about what leaves a firm, they think about the client. The client, though, is one part of the file, and often not the most sensitive one: the same document holds the witness being called, the court-appointed expert, the child whose custody is at issue, the doctor who signed a report, the other side with their address.
These people have one thing in common. They signed nothing with you, they never read your privacy notice and, almost always, they do not know your firm exists.
The client’s notice does not cover the others
The notice your client received concerns the processing of their data. It is not an authorisation to process a third party’s data, and it does not become one because that third party appears in a document the client brought in. For people outside the relationship the firm is still the controller, and the legal basis has to be found elsewhere, usually in the exercise of the right of defence.
That basis covers processing that is necessary for the defence. It covers obtaining a medical report, calling a witness, filing an expert opinion. It does not cover, without some further reasoning, sending the same document to an AI supplier for a summary: that is additional processing, with a different purpose and a different recipient, and it is exactly the step where the question “was it necessary” has an uncomfortable answer.
Who is in a case file, in the order they get forgotten
Before deciding what to remove it helps to know who is there, because the list is longer than memory returns. An average civil file almost always holds: the client and their family; the other side, with address and tax code; opposing counsel, who is a proper noun like the rest; the witnesses named, with addresses; the court-appointed expert and the party experts; the doctors who signed reports; the employer and colleagues named in an employment claim; the school in a family case; the bank, with the account number; and the public officials who signed an administrative act.
The order is not arbitrary: it is roughly the order in which these names get forgotten when a document is cleaned by hand. You remember the client and the other side because they are the title of the case; you do not remember the doctor in a footnote, and not out of carelessness: in the reader’s head that is not a person, it is a source.
Some of that data is a special category
More files contain health data than people expect: personal injury, medical liability, employment claims involving unfitness for work, separations with psychological reports, social security. Health data meansArticle 9 GDPRopens in a new tab, which is a prohibition on processing unless one of the conditions in paragraph 2 applies.
In proceedings involving children, everything that identifies them is added, and in a filing that is almost always more than the name: the school, the municipality, the date of birth, the parents’ names. Removing the child’s name and leaving the parents’ names is a substitution that protects nothing.
The third party can ask, and the answer has to be written down
One part of this usually comes last and is in fact the most concrete: those people have rights against you, and they can exercise them. Article 15 GDPR gives anyone the right to know whether a controller is processing data about them, what it is, for what purpose and, the limb that matters here, which recipients it has been disclosed to. No contractual relationship is needed: it is enough that their data is in your hands.
The question that follows is not theoretical. “Has the document I appear in been sent to third parties?” has two possible answers: no, or yes with the supplier’s name, the purpose, the retention period and, where the supplier sits outside the Union, the Chapter V instrument the transfer rests on. The second answer is only available if somebody wrote those things into the record of processing beforehand. Not having written them does not make the answer easier, it makes it impossible.
Then there is Article 14, which covers data not obtained from the data subject and requires, in principle, informing them. In litigation an exemption often applies (telling the other side’s witness would compromise the defence), but the exemption has to be argued, not assumed, and it covers processing necessary for the case. It does not stretch by itself to cover sending a document out to have it summarised.
Why automatic substitution helps more here than anywhere
The practical difference between removing the client’s data and removing everybody’s is memory. You remember the client; you do not remember the expert appointed on page thirty-one, the doctor cited in a footnote, the address of a witness who appears exactly once.
A program reading the document does not have that asymmetry: it finds the twenty-eighth occurrence with the same attention as the first, and it lines them all up to be reviewed. That is why this part of the job is better read by a machine and decided by a person, which is how Omissia is built: it proposes, shows where, and waits for confirmation.
The list of what has to come out of a filing is in the piece about the values.