De-Identification of Client Data Before Using AI

De-identification removes or changes client details so a person is no longer reasonably identifiable. Before using AI, assess the remaining details together and who can access them.

Removing a name leaves other clues behind. For a calculation question, a short invented example often lets you explain the problem without sending a client’s return.

What De-Identification Means

Under the Privacy Act, de-identified information is no longer about an identifiable or reasonably identifiable individual. The OAIC’s key concepts guidance makes that outcome the test, regardless of the technique used.

De-identification, also written deidentification, starts with direct identifiers such as names. You then assess whether the remaining information could identify someone, including when combined with other available information.

The OAIC describes anonymisation as another term used for similar processes. It does not establish a separate Australian legal safe harbour. Agree what “anonymised” means before relying on that label from an AI provider.

Replacing a name with a client number preserves a way to reconnect the record. Keep any matching list inside the practice. A coded record can still be personal information when the person remains reasonably identifiable.

The OAIC and CSIRO-Data61’s De-Identification Decision-Making Framework guides assessment of the data and its access environment. It supports judgement about a proposed disclosure, rather than a universal checklist that makes every dataset safe.

Confidentiality is a separate obligation. The TPB’s AI guidance requires client permission before disclosing information about their affairs to a third party, unless a legal duty applies. Whether AI use discloses information depends on its configuration and use.

Removing personal identifiers does not automatically settle that broader client-confidentiality question. The guide to TPB AI guidance explains the practice’s responsibilities when AI forms part of a tax service.

De-Identification Examples From Tax Files

Keep only the information needed to answer the question, then remove direct identifiers and assess the remaining clues. The following invented return extract shows the changes before a general explanation goes to AI.

The original-field descriptions stand in for identifiers. No actual name, Tax File Number (TFN), address or birth date appears in this example.

The resulting prompt could ask, “For a hypothetical salary of $100,000, explain how marginal income tax brackets apply.” It contains invented teaching figures and asks for an explanation, not a client’s final tax calculation.

Changing amounts changes the calculation. Keep the actual figures inside the practice for the client’s workpaper. Preserve any legally relevant threshold or eligibility condition when constructing a hypothetical question.

Use this sequence for a real file:

1. Define the question before copying information. Identify which facts affect the answer and leave unrelated pages inside the practice.
2. Make a separate working copy. Remove names and TFNs, then contact details, account numbers and references that reconnect the extract to a client.
3. Review indirect clues. Generalise an occupation or location only when that change preserves the question. Remove distinctive events and amounts that the question does not need.
4. Read the complete proposed prompt, including earlier conversation messages and attachments. A detail removed from one paragraph might still appear elsewhere.
5. Verify the prepared copy before release. Search for the identifiers you removed and assess whether someone could recognise the client from the remaining combination.

If a relevant fact would identify the client, use an approved arrangement that can lawfully handle that information. Do not quietly remove a fact that changes the tax answer.

When De-Identified Data Can Be Re-Identified

Re-identification happens when remaining details reconnect information to a person. The OAIC’s de-identification guidance assesses that risk in the particular release context, including what the recipient can obtain elsewhere.

Imagine an invented extract describing a specialist business owner in a small town who has recently sold a distinctive property. A public sale listing could connect the description and sale amount to that person.

Removing the owner’s name would leave that combination intact. A broader location might reduce the risk, but retaining the rare occupation and exact sale proceeds could still identify the owner.

Past prompts also change the context. One message might identify the town and another the unusual transaction. Review the conversation as a whole before adding another extract.

Access arrangements matter too. Identify who can read prompts, whether the provider retains them and whether connected services receive them. A statement that data is “de-identified” does not answer those questions.

For detailed datasets or information shared widely, obtain specialist de-identification advice. Use the smallest necessary extract while assessing the actual recipient and purpose. A spreadsheet with names removed has not automatically passed that assessment.

Tools That Help

Find-and-replace helps locate known identifiers, while permanent redaction removes selected content from a document. Neither tool decides whether a combination of remaining facts identifies your client.

In editable text, search for the client’s full name and spelling variations. Then search separately for identifiers such as email addresses and client references. Review each result because replacement can miss abbreviations or alter text needed for the question.

For PDFs, use a redaction function that removes content. Drawing a black rectangle over text can leave that text recoverable. A scanned page can also have a searchable text layer beneath its image.

Adobe Acrobat Pro’s redaction instructions distinguish selecting content from applying the redactions. Its separate sanitisation function removes hidden information, including metadata and comments. Save and inspect the resulting copy after applying both operations.

The redact PDF tool helps with removing selected areas in the browser. After using any PDF tool, review the output itself, including every page that will leave the practice.

Reopen the saved file and search for removed identifiers. Try selecting and copying text from redacted areas into a blank local document. Inspect document properties and any remaining attachments. These checks expose common failures but cannot establish that every remaining clue is safe.

If a search finds a removed name, the copy has failed. Return to the source copy and apply permanent removal before saving again. If the identity survives through context, replace the extract with a hypothetical question or keep it within an approved confidential arrangement.

Release only the reviewed copy. Keep the original and any matching list inside the practice, and record the purpose and recipient so the next staff member can understand the decision.