Beyond the Black Box: Identifying Hidden Metadata and OCR Layers in Subject Access Requests

For the modern UK Data Protection Officer (DPO), the Subject Access Request (SAR) is no longer just a regulatory hurdle; it is a high-stakes forensic exercise. As the volume of unstructured data—emails, scanned PDFs, and CCTV footage—explodes, so does the risk of "False Redaction."

In July 2025, the Information Commissioner’s Office (ICO) issued refreshed guidance on disclosing documents to the public securely. This update wasn’t just a routine refresher; it was a direct response to a series of high-profile data breaches where organisations inadvertently disclosed sensitive personal data hidden within the "digital shadows" of their files.

If your team is still relying on basic PDF editors or—heaven forbid—drawing black rectangles in Microsoft Word, you are likely leaving a trail of "False Redactions" that could lead to a notification-grade breach.

The Anatomy of a False Redaction

A "False Redaction" occurs when information is visually obscured but remains digitally present within the file’s underlying code. In the eyes of the ICO, a redaction is only valid if it is irreversible.

Many standard tools perform "overlay-only" redaction. This creates a visual mask, but the data remains accessible through several common vulnerabilities:

1. The Metadata Shadow

Metadata is the "data about data" that travels with every file. While you may have redacted a name on page three of a PDF, the file’s properties might still contain the author’s name, the original file path (which often includes department or project names), and even a revision history that tracks exactly what was changed and by whom.

2. The Hidden OCR Layer

Optical Character Recognition (OCR) is essential for making scanned documents searchable. However, it creates a hidden text layer beneath the image. If you apply a black box to the visual image but fail to scrub the underlying OCR layer, a recipient can simply "Select All," copy the document, and paste the "redacted" text into a plain text editor to reveal every word.

3. Vector Graphics and Layering

Professional PDF editors often treat redactions as a new layer. Without "flattening" the document or using a tool that performs true data destruction at the code level, a tech-savvy recipient can use forensic software to simply "hide" the redaction layer, revealing the sensitive information beneath.

Why Legacy Tools are a Liability

The ICO’s 2025 guidance specifically warns against using ineffective techniques that leave information exposed. The danger of using "off-the-shelf" consumer software is the lack of a verifiable audit trail and the high margin for human error.

When managing a complex SAR under the 30-day statutory window of the UK GDPR, the pressure to "just get it sent" often leads to these technical oversights. This is why many DPOs are moving toward purpose-built automated redaction solutions that guarantee the permanent removal of both the visual and digital data layers.

The DPO’s Checklist for Defensible Disclosure

To ensure your organisation remains compliant with the Data Protection Act 2018 and the latest ICO standards, your redaction workflow must address the following:

• Sanitisation, Not Just Masking: Ensure your software "burns" the redaction into the file, destroying the underlying pixels or text characters.

• Forensic Metadata Scrubbing: Automatically strip all non-essential metadata, including GPS coordinates, author IDs, and hidden thumbnails.

• The "Copy-Paste" Test: Always attempt to copy text from your final redacted output. If you can select the text behind the black box, your redaction has failed.

• Accountability & Logging: Maintain a log of who performed the redaction, the legal exemption applied (e.g., Article 15(4) protecting the rights of others), and a timestamp for the final "data destruction" event.

Moving Toward "Security by Design"

The ICO has made it clear: ignorance of a file’s technical structure is no excuse for a data breach. As DPOs, we must ensure our teams are equipped with tools that understand the difference between a visual overlay and a forensic scrub.

By automating the identification of PII and the scrubbing of hidden layers, organisations can reduce the risk of accidental disclosure while significantly cutting the time spent on manual reviews. Taking a free trial of a specialist tool is often the first step in moving from a reactive "black box" approach to a proactive, defensible compliance strategy.

In the era of the Data (Use and Access) Act, the "Right of Access" is only getting more complex. Don't let a hidden metadata layer be the reason your next SAR response turns into an ICO enforcement notice.