Metadata Risks in Legal Documents and How to Remove Them

Aug 7

11 min read

Document metadata risk is the exposure that arises when a legal document carries information that its author did not intend the recipient to see. A letter, contract, pleading, spreadsheet or presentation is rarely just the visible text. Beneath the page there may be a record of who created and edited it, when and for how long, what earlier wording was deleted, what comments colleagues made, which template it was built from, which other files it links to, and in some cases where on the firm's network it was stored. Each of these items is capable of revealing confidential strategy, client identity or internal disagreement to a counterparty, a court or the press.

The risk is not theoretical, and it is not confined to unusual software. It follows directly from the way that ordinary document formats are designed. Word processors are built to support collaboration and recovery, so they preserve revision histories, comments and previous states. Spreadsheets are built to support calculation, so they retain formulae, hidden rows, hidden sheets and linked data. Portable document files are built for fidelity, so they carry author fields, creation tools and sometimes the text beneath an image or a black box. An attorney-at-law who understands these features can use them to advantage; one who does not may disclose a matter's confidences with a single click on the send button.

This article explains the principal categories of hidden data, the professional duties engaged, and a practical procedure for preventing inadvertent disclosure. It names no product, because the principles apply to all of them, though the exact menus and settings differ between applications and versions. Practitioners should confirm the behaviour of their own tools by testing them on non-confidential sample documents, and should consult the rules of their regulator on confidentiality and on the handling of inadvertently disclosed material.

What document metadata is

Metadata is commonly described as data about data. In the legal setting it is useful to distinguish between two groups. The first is system or descriptive metadata, which records facts about the file: author, last modified by, creation and modification dates, total editing time, title, subject, keywords, company, template and application version. The second is embedded content that is not visible in the ordinary view of the document but is nonetheless stored within it: tracked changes, comments, hidden text, deleted text retained in the file, version histories, document variables and embedded objects.

The distinction matters because the remedies differ. Descriptive metadata can usually be viewed in the properties panel and cleared through a supported function. Embedded content may require a different procedure, such as accepting or rejecting changes, deleting comments and removing hidden text before an inspection function is run. It is also important to remember that metadata is generated automatically, so the creation of a document does not require any conscious act of disclosure by its author.

The principal categories of hidden data

Tracked changes and revision history

When track changes is enabled, the file preserves insertions and deletions along with the identity of the reviewer and the time. If the tracked changes are not accepted or rejected before the document is sent, the recipient can read every deleted sentence. In a negotiation, this can reveal the fall-back position the firm abandoned, the client's instructions as they evolved, or an internal comment on the weakness of a clause. A file that has had its tracked changes switched off in the display but not resolved is still carrying them.

Comments and annotations

Comments written for internal review, such as a note that a clause is unfavourable to the client or that a point should be raised with a partner, remain in the file unless deleted. Replies within comment threads and resolved comments may also be retained. Margin comments in a presentation, notes pages in a slide deck and cell notes in a spreadsheet are further examples.

Hidden text and formatting tricks

Text formatted as hidden, text coloured to match the background, text reduced to a negligible size, and text placed outside the printable area may all survive in the file. They are sometimes used legitimately, for instance for drafting prompts, but they present an obvious risk if not removed.

Document properties and personal information

Author names, usernames, the name of the organisation, the names of recent editors and the file path can disclose who worked on a document, whether it was produced by a colleague at another firm, or where in the network it resided. A file path that includes a client name or matter number may identify a client that the recipient was never meant to know about. In a document derived from a template or from another client's file, residual properties may carry the earlier client's details.

Fast save remnants and earlier versions

Some applications retain earlier versions of a document within the file to support recovery, or store the history of saved versions. If a firm reuses a precedent that contains remnants of a previous client's text, or sends a file with a version history intact, the earlier content may be recoverable.

Embedded objects, links and fields

A spreadsheet embedded in a document may carry the entire workbook, including sheets and cells not displayed. Linked files can reveal network locations and other file names. Fields and cross-references may contain data that is not visible in the rendered text. Images may carry their own metadata, including the device used and, for photographs, location information.

Spreadsheet-specific data

Hidden rows, hidden columns, hidden sheets, defined names, formulae, data validation lists, filtered-out data and pivot table caches may all contain information that is not visible in the printed view. Hiding is not deleting. A schedule of fees sent to a client as a spreadsheet may contain the firm's internal cost assumptions in a hidden column.

Presentation-specific data

Speaker notes, hidden slides, off-slide content and embedded charts with underlying data are commonly overlooked. A presentation that has been adapted from one client engagement for another may retain material from the earlier engagement in the notes or in the data behind a chart.

Portable document files

PDF files carry document information fields, such as author and the application that created them, and may include the original text beneath a scanned image or a redaction box. The most dangerous error in this area is the application of a black rectangle over text without removing the underlying content, so that the text can be selected and copied or revealed by simple manipulation of the file.

Email

Email carries its own header information, including routing details and the client software used, and attachments carry the metadata described above. Auto-complete errors, hidden blind copy recipients and forwarded chains containing earlier correspondence are common causes of inadvertent disclosure that are not metadata in the strict sense but are subject to the same preventative disciplines.

Why the risk matters: professional duties

The duty of confidentiality is the starting point. An attorney-at-law must protect client information, and disclosing it by negligence is a breach just as surely as disclosing it on purpose. Legal professional privilege may also be at risk, since a communication that contains privileged material and is sent to the other side in error may lead to arguments that privilege has been waived, or at least to the cost and difficulty of securing its return. The courts of many common law jurisdictions have developed principles on inadvertent disclosure that allow a party to seek the return of privileged material mistakenly supplied, but the outcome depends on the circumstances and the speed of the response. Practitioners should consult the law of their own jurisdiction.

Competence is also engaged. Many professional codes require lawyers to maintain technological competence appropriate to the work they do, or at least to take reasonable steps to understand the risks of the tools they use. Ignorance of how track changes works is unlikely to be a persuasive explanation to a client who has lost a negotiating position.

The recipient's position is equally important. Practitioners who receive a document containing evident metadata, such as tracked changes that reveal the other side's internal discussions, face an ethical question. The rules differ. Some regulators require the recipient to notify the sender and refrain from reading further when it is obvious that the material was sent by mistake. Others treat the matter as one of general conduct and fairness. A practitioner who finds privileged material in a received document should stop, seek guidance under the rules of the regulator, and not use the material pending that guidance.

Data protection law is a further consideration. Personal data embedded in metadata, such as the names of individuals who edited the file, or personal data in hidden sheets, is processed and disclosed within the meaning of data protection legislation, which may bring notification and security obligations where the disclosure is unauthorised.

A summary of risks and remedies

Hidden item	Typical risk	Remedy before sending
Tracked changes	Reveals deleted wording, earlier positions and reviewer identities	Accept or reject every change, switch off tracking, then inspect
Comments	Exposes internal advice and strategy	Delete all comments, including resolved ones and replies
Hidden text	Discloses drafting notes or prior content	Search for and delete hidden text; run the inspection function
Document properties	Reveals author, firm, client names and file paths	Clear properties through the inspection function and check the result
Earlier versions	Allows recovery of superseded text	Save as a new file, or copy content into a clean document
Embedded objects	Carries whole workbooks or files	Replace with a static copy of what the recipient needs
Hidden spreadsheet content	Reveals hidden sheets, rows, formulae and cost assumptions	Delete, not hide; paste values to a new workbook
Presentation notes and hidden slides	Discloses speaker notes and prior engagement content	Remove notes and hidden slides; check chart data
PDF fields and underlying text	Reveals author fields and text beneath redaction boxes	Use true redaction that removes content, then clear properties
Image data	Exposes device and location details	Strip image metadata or export a fresh image

A procedure for removing metadata

A reliable procedure combines human review, built-in inspection tools and verification. It should be applied to every document that leaves the firm, in proportion to the sensitivity of the matter.

Step one: decide the format to be sent

Ask whether the recipient needs an editable file or whether a fixed copy will do. For a final executed agreement, correspondence, or a document sent for information only, a portable document file generated from a clean source is generally safer than an editable file. If an editable file is required, for example for a counterparty to mark up, the clean-up must be more thorough.

Step two: resolve and clear the visible markup

Accept or reject all tracked changes, delete all comments, and turn off change tracking. Review the document in a mode that shows all markup, and confirm that nothing remains. Search for hidden text, drafting notes, bracketed prompts and placeholders.

Step three: run the inspection function

Most mainstream applications include a document inspection or sanitising function that scans for properties, comments, hidden content, headers and footers, embedded items and custom data, and offers to remove them. Run it on a copy and review the report. Do not rely on it as the sole control, since it may not detect everything, and since removed items cannot always be restored.

Step four: save as a new file

After the clean-up, save the document under a new name, and use a function that produces a fresh file, not an incremental save of the old one. For high sensitivity documents, copy the visible text into a new blank document using a plain-text paste, apply the firm's template and reformat. This removes most residual data but requires care, and the result must be proofread.

Step five: handle spreadsheets and presentations separately

Unhide all rows, columns and sheets so that nothing is overlooked, then decide whether each should be deleted. Copy the figures required and paste them as values into a new workbook. In presentations, clear notes pages, remove hidden slides, and check the data behind charts.

Step six: redact properly

Where portions of a document must be withheld, use a function that removes the underlying text and image data, and not one that merely draws a box. After applying redaction, save a new file, then test it: try to select and copy the redacted area, search for a redacted word, and view the file with a text extraction tool. Redaction that fails these tests is not redaction.

Step seven: check the final file

Open the file that will be sent, not the one that was worked on. Inspect its properties, and search it for names, matter numbers and terms that should not appear. For significant disclosures, have a second person perform the check. Then check the email: the recipients, the blind copy field, the subject line, the body text and any earlier messages in the chain.

Worked example of a controlled release

Consider a firm that has negotiated a commercial agreement for a client. The final draft has passed through several hands, and carries tracked changes from the partner, comments from an associate, and a template that originated in another matter. The firm intends to send the agreed version to the counterparty for signature. The controlled approach is as follows. The associate accepts the agreed changes and deletes all comments. The partner reviews the clean text. The document is exported as a fixed-format file from the clean source for signature, and a separate editable copy is held on the file. The firm checks the properties of the exported file, confirms that the author field shows only the firm's neutral name, and sends it to the counterparty from a message that has been checked for recipients. The editable file, with its history, remains internal. This approach costs a few minutes and removes the principal risks.

Policy, training and culture

Individual vigilance is not sufficient. Firms should adopt a written policy on document metadata that is proportionate to their size. It should state which formats are used for external transmission, require a standard clean-up before release, designate who is responsible for checking sensitive documents, and set out the steps to take after an inadvertent disclosure.

Training. Include metadata in induction for all fee earners and support staff, using sample files that demonstrate what a recipient could see.
Templates. Maintain clean templates, reviewed regularly, so that previous clients' details are not carried forward. Do not create new matters by copying the previous matter's file.
Default settings. Where the software permits, configure the firm's applications to remove personal information on save, to prompt before sending documents with tracked changes or comments, and to apply neutral properties.
Technical controls. Consider tools that scan outgoing email for metadata and prompt the sender, or that automatically convert attachments to fixed formats. Evaluate such tools carefully for security and data handling.
Separation of drafts. Keep internal working drafts and external versions in separate folders and name them clearly, so that a working draft is not attached by mistake.
Remote working. Apply the same standards to documents prepared on personal or home devices, and avoid personal storage services for client material unless the firm has approved them.

Responding to an inadvertent disclosure

Despite precautions, errors occur. A response plan limits the damage.

Establish the facts quickly: what was sent, to whom, when, and what hidden content it contained.
Contact the recipient promptly, by telephone and in writing, identify the document as sent in error, and ask that it not be read further, be deleted and be confirmed as deleted. Consider the rules on inadvertent disclosure and the recipient's likely obligations.
Inform the client, since the client's confidentiality or privilege may be affected, and record the advice given.
Consider whether notification to the regulator, the insurer or a data protection authority is required.
Where privilege is at issue, take legal advice on seeking the return or non-use of the material, and act without delay, since delay may be treated as acquiescence.
Record the incident, identify the cause, and revise the policy and training accordingly.

Practical next steps

Test the firm's own applications: create a sample document with tracked changes, comments, hidden text and unusual properties, and see what a recipient can discover.
Adopt a written metadata policy that states the approved format for external documents and the required clean-up steps.
Configure application defaults to remove personal information and to warn about markup before sending.
Replace copied matter files with clean templates for new matters.
Establish a second-person check for sensitive disclosures such as disclosure bundles, settlement proposals and documents for the court.
Train staff on redaction, and prohibit the use of drawn boxes in place of true redaction.
Document a response plan for inadvertent disclosure and identify the person responsible for acting on it.
Review the rules of the regulator on inadvertent disclosure and on technological competence, and record the position in the firm's compliance manual.

How practice management software supports the work

Controlled document handling is easier when matters, versions and approvals are managed in one place and not scattered across email and personal folders. A practice management platform such as Legalytech keeps documents within the matter record, retains version history internally, and shares material with clients through a portal and with counterparties through managed routes, which reduces the occasions on which working files are attached to messages and supports a consistent clean-up routine.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.