Research
Research: what identifies a client, and what our tests found
Two kinds of evidence. What published privacy standards say identifies a person, quoted from the rule itself, and what happened when we ran real documents through PiBye, including the parts that did not go our way.
What we found redacting 50,000 real documents
We ran 50,119 real public documents through PiBye's detector and checked every redacted copy with regexes written independently of it. They found 84,037 number- and pattern-shaped identifiers; 24 were still readable afterwards, in 22 documents. Every survivor was number-shaped, mostly statute citations shaped like a SIN. The bigger defect was the opposite one: ordinary words treated as names, which we then cut by 52 percent.
What counts as identifying information in a client document?
Two kinds of detail identify a person. Direct identifiers point to one person on their own: name, street address, email, phone, and ID numbers such as a SIN, passport or account number. Quasi-identifiers identify in combination: date of birth, postal or ZIP code, city, employer, occupation, income. Published standards remove the first kind outright and reduce the second, because a rare job plus a small place can name someone without a name.
Pseudonymized vs anonymized: which is your AI-ready copy?
If you can put the real names back, it is pseudonymized, not anonymized. Pseudonymization replaces identifiers with stand-ins and keeps a key; anonymization must be irreversible. The EDPB says pseudonymised data that can be attributed to a person with additional information is still information about an identifiable person, and the ICO says pseudonymous data is still personal data. So a copy with [PERSON_001] tokens is still personal information for you.
Is a postal code personal information?
A full Canadian postal code works like an address. Statistics Canada puts the average at about 19 households, and Canada Post says an urban code can mean one side of a street between two intersections, or a single building. Ontario's privacy commissioner lists postal codes as location quasi-identifiers. Remove the full code from client documents. Keeping only the first three characters (the FSA) is a closer call, but it still reveals the area and usually the city.
Should you redact ZIP codes? The 3-digit rule and why it fails
For a client document going to an AI, redact the whole ZIP code. HIPAA's Safe Harbor lets you keep the first three digits only where every ZIP sharing them holds more than 20,000 people, according to current Census data; otherwise they become 000. Applying that correctly needs an up-to-date population table, and even a valid 3-digit prefix reveals the region and often the city. NIST's research summary shows why ZIP matters: with birth date and sex, a 5-digit ZIP made most Americans unique.
Should you redact dates of birth before sharing a document?
Yes, redact the full date. US federal court rules let filers include only "the year of the individual's birth", and HIPAA Safe Harbor removes "all elements of dates (except year)" tied to a person, with ages over 89 grouped as 90 or older. A full birth date is one of the three details, with ZIP code and sex, that made most Americans unique in NIST's summary of re-identification research. If the task turns on age, share the year or the age instead.