Case study 4: Protection case note containing personal data
Scenario
A caseworker asks whether they can paste a protection case note into a free online AI tool to “make it shorter for the file.”
Fictional case note excerpt: “Client A., female, age 17, resides at Shelter Line 3. Phone: 555-0142. Reported assault on [date]. Perpetrator described as…”
Your task (8 minutes)
- Classify the data in the excerpt.
- Green, amber, or red for pasting into a free public AI tool?
- What safer alternatives exist?
- What if the caseworker already pasted it?
Model answer
Data classification: Personal and sensitive protection data. Likely special category under many data-protection frameworks.
Decision: Red. Do not paste into unapproved public tools.
Safer alternatives:
- Use an organization-approved tool with a data-processing agreement, if policy allows
- Summarize manually without identifiers
- Use internal templates approved by protection and privacy leads
If already pasted: Stop use, report to privacy/protection lead same day, follow incident procedure. Do not copy AI output back into the case file without review.
Common errors
- “I’ll remove the name” while leaving phone or shelter line
- Assuming deletion from chat erases vendor-side retention
- Treating shortening as low risk when re-identification is possible
Principle taught
Data minimization and approved tools: Protection data rarely belongs in public AI tools. Policy and incident routes override convenience.