Removing Personally Identifiable Information (PII)

West Virginia Executive Branch
Privacy Policy: Minimum Necessary and Limited Use

Removing Personally Identifiable Information (PII)

Question:

Is there a way to remove personally identifiable information (PII) before sharing it with a third party?

Answer:

Have you ever needed to remove personally identifiable information (PII) from a document before you provide it to a third party? If so, it’s very important that the PII be removed properly. When removing – or redacting – PII, take the following steps:

• Make a photocopy of the document – you don’t want to redact the original.
• On the photocopy, use a black marker to conceal the PII that you want to redact. Be sure that the PII is totally covered with the black ink. A permanent marker is best.
• Photocopy the redacted document. Visually inspect this 2nd photocopy – you should be unable to make out any of the PII through either the front of the back of the document. This 2nd photocopy can be provided to the recipient.
• Save the 1st photocopy (with the black ink redaction) with the original, to show the redaction effort.

This process may seem a bit onerous, but it ensures that the PII cannot be recovered. If you don’t make the 2nd photocopy, it is occasionally possible for PII to be read from the back of the document.

Using a marker also prevents issues that are associated with white-out and other concealers. These products can often be “scratched off” to reveal the covered text. Additionally, these products can damage photocopiers if they are not allowed to dry properly before a copy is made.

If you often have to redact PII, keep a nice supply of thick black markers on hand for that job!

Note: Your agency/bureau/department/division may have specific requirements – always check your policies and procedures. If you have questions, contact your Privacy Officer.