Home / Personal data, the mandatory caution

What calls for particular caution before having a document processed

Identity, health and personal-situation data are protected categories, and a secret must never pass through a conversation, even briefly.

A working file often mixes several types of information without anyone paying attention: a name, a date of birth, a health condition, a password pasted at the bottom of the page so as not to forget it. Before having this file processed by an artificial intelligence tool, some of this information calls for a caution the rest does not.

Four categories that change the rule

A person's identity, name, date of birth, address, identifies them directly. Their state of health, a diagnosis, a treatment, a situation of dependency, falls under what the CNIL calls sensitive data, regardless of how it is phrased: describing a care need in softer, more clinical language still describes the same condition, and how sensitive a fact is does not depend on the words chosen to say it. Only two things take it out of the category, and only one is within your reach: removing the information from the document, or anonymising it irreversibly, which requires that no one, anywhere, still holds the means to trace it back to the person. Leaving the category is not the only route, in any case. The regulation forbids collecting and using it, then lists five cases where it allows this anyway, including the person's express consent and the public interest in matters of health. These cases exist, and an organisation that ignores them gives up something it has the right to do: they are set out at the address at the end of this lesson, and are settled with your data protection officer, not with this course. A person's personal situation, age, household composition, resources, does not always identify them alone, but combining several of these fields in the same document often narrows the possibilities down to a single person, even when no field taken alone would be enough. A business or access secret, an API key, a password, an authentication token, is not personal data but follows the same rule of caution: a conversation window keeps a trace of what is pasted into it, so a secret that passes through it, even briefly, must be treated as already compromised.

Replacing a name is not enough

Replacing a name with a reference number gives the impression that the document becomes safe to send. That is only true if no correspondence table anywhere still links that number to the person. As long as such a table exists somewhere in the organisation, the document remains personal data, whatever it looks like on the surface. The practical rule fits in one sentence: reduce one identifying detail at a time, rather than judging the document as a whole, and remove whatever is not strictly necessary for the task entrusted to the tool.

The two wordings below are made up for the demonstration, they describe no one. The first is an example of what must not be sent.

À éviter : « Le dossier de la personne suivie, née le 4 mars 1958, domiciliée avenue de la Gare, avec un diagnostic d'insuffisance cardiaque, doit être réactualisé. »
Moins exposé : « Le dossier du bénéficiaire référence 4, tranche d'âge 65 à 75 ans, doit être réactualisé. »
Ce qui reste vrai de la seconde : tant qu'un tableau relie quelque part la référence 4 à un nom, elle porte encore une donnée personnelle.

A secret follows a different path but the same caution. It is not corrected, it is removed from the conversation entirely and kept wherever passwords are kept, in a password manager rather than in the text exchanged with the tool, and certainly not tucked into a corner of a document or an email. If a secret has already been pasted, the only action that repairs the exposure is to revoke it at the source and generate a new one, on the service that issued it. The next lesson spells out what the organisation account guarantees once this initial sorting is done, and what it does not guarantee.