The EU General Data Protection Regulation (GDPR) requires anonymization of documents containing personal data, such as court decisions, for public use. Doing this manually is costly and time-consuming but can be automated by applying Natural Language Processing (NLP) methods. This paper introduces the ANOPPI tool developed for (semi-)automatic anonymization of Finnish texts. The tool can be used both as a web application and programmatically through a REST API. Evaluation shows that ANOPPI performs well with diferent types of documents, however, further improving the performance of the named entity recognition and disambiguation methods would enhance the usefulness of the software. The tool is being published as open source for public use by the Ministry of Justice in Finland. A use case of ANOPPI is to publish court decisions on the Web in the LawSampo semantic portal for human close reading and as Linked Open Data for data analysis in legal informatics.
Many texts and legal documents of interest to a wider audience, such as interviews of people and court decisions, contain sensitive personal data. This makes it dificult to publish and use them given the EU General Data Protection Regulation (GDPR)1, unless personal data contained is disguised, which is costly and time-consuming to do manually.
This paper presents the software architecture and first evaluation results of the ANOPPI
tool and web service2 for automatic and semi-automatic anonymization of Finnish documents,
extending our earlier short paper [
ANOPPI is the first anonymization tool developed for Finnish. The tool was developed for
automatic anonymization of court decisions [
This paper first introduces the ANOPPI tool and the underlying method for automatic anonymization from an end-user point of view (Section 2). We then present the underlying technical ideas of the tool starting with a description of the software architecture, language analysis component, and the workflow in Section 3. After this, first results of evaluating the performance of ANOPPI in fully automatic anonymization are presented. In conclusion, related works and future directions of development are discussed .
The web-based user interface (WUI) of ANOPPI is depicted in Fig. 1. It is an HTML5/JavaScript application implemented with React user interface library. NPM (Node package manager) modules redux and redux-observable are being used for handling the application state and asynchronous logic.
The general idea of the tool is to find automatically named entities in the document and mark them in diferent colors and using diferent symbols based on their type (person, place, organization, etc.). A numeric ID is used to identify mark and disambiguate entities; multiple occurrences of the same entity have the same ID. The marked document is shown on the left in Fig. 1. After finding the named entities and their occurrences in the text, the occurrences are replaced with referent identifiers. To assign a reasonable identifier for a given named entity its category must also be resolved. For example, we must be able to diferentiate towns and corporations so that an identifier can be correctly determined as either “town A” or “corporation A”. Categorical disambiguation is based on a scoring scheme that weighs the results obtained from the diferent named entity recognizers.
On the right hand side of Fig. 1, each entity found is listed in a table that can be used for editing the entities and for specifying how the entity label is replaced in the anonymized document. For example, wrongly identified entities can be deleted and missing new ones be inserted, their type can be changed, the replacement string can be edited, and so on. By clicking on a “preview” button the final result can be seen and finally saved with its original formatting.
The court orders to be anonymized are available in electronic format either as plain text,
XML, HTML, or DOCX files. Based on Natural Language Processing (NLP) tooling discussed in
[
ANOPPI is a web-based tool for automatic or semi-automatic anonymization. It comes in two versions: 1. Web application version that has a user interface and the anonymization is done with manual checks and editing performed by a human user. The interface was described in the previous section. 2. Standalone REST API version that can be used programmatically for automatic or semi-automatic anonymization.
The Web application version depicted in Fig. 2 consists of a WUI (ANOPPI Client on the left),
a back-end ANOPPI Server. The ANOPPI Server consists of language analysis components
(LAC) that perform named entity recognition (NER) and anonymization of the text. The NER
process is carried out by the Nelli Tagger Service [
The Web application version of the ANOPPI Server is implemented using Scala and Play
web framework3. The back-end uses the Nelli Tagger Service to find the mentions of named
entities in text when a new document is uploaded to ANOPPI. In addition, LAS (SeCo Lexical
Analysis Services) [
The Standalone REST API version is similar to Fig. 2 but does not include a user interface client nor stores any user data in a database. The API can be used programmatically for either automatic or semi-automatic anonymization. It takes as input the document and produces as output the annotated or anonymized document with a separate list of all the named entities found in the document. A public test instance of this API5 runs on the CSC Rahti container cloud. API documentation, based on Swagger, is available on the Web6 .
The public API includes, for example, the following endpoints consumed by the ANOPPI Client:
POST /project Create a new project (document to be anonymized). The endpoint is consumed when uploading a new document to the web application. This function sends the document content to the tagger that finds mentions of named entities in the text. This tagged text is then returned back to the client.
POST /project/preview This endpoint is consumed by the client when previewing the
5The API can be found at https://nlp.ldf.fi/anoppi. 6Documentation: https://app.swaggerhub.com/apis-docs/apoksane/open-api_nlp_ldf_fi/1.0.0. anonymized version of the document. It replaces the selected named entities in the text with their referent identifiers.
POST /project/export This endpoint is consumed by the client when exporting the finished anonymized version of the document. This endpoint prepares the final anonymized version of the document and sends it back to the client.
POST /project/tag-entity-occurrences Find mentions of a specific entity in text. This endpoint is used when user manually selects a new named entity from the text to be anonymized.
GET /text/analyze Analyze text. This endpoint is invoked after selecting a new name (a surface form) from the document text. The function resolves the lemma and case of the surface form. The required morphological analysis is done by utilizing LAS.
In order to produce the automatically anonymized document, the ANOPPI server calls first for the Nelli Tagger Service to perform the NER process to find the named entities from the text. After obtaining the NER results, the anonymized version of the document can be produced using the anonymization component. The Nelli Tagger and anonymization process are presented in more detail in the following subsections. 3.2.1. Nelli Tagger Service The identification of named entities in Finnish language documents can be a challenging task. The documents can contain not only regular names but also unusual names and registry numbers that are often not picked up by rule or machine learning based NER tools. For example, for both types of NER tools it can be dificult to extract foreign person names when processing documents that are, for example, related to immigration or refugees. Similarly, typically the ready-made tools do not pick registry numbers such as car plates or insurance numbers.
To find the named entities the Nelli Tagger Service [
After performing NER, the results are disambiguated by scoring results of each NER method’s interpretation of the text, where the most popular interpretation wins. The results are then converted to JSON format that consists of a list of entities and their features, the original text
annotated with named entities using HTML span tags, as well as metadata about the run of
Nelli Tagger Service (e.g., timestamp, success or error codes). The Nelli Tagger Service’s API
is available as a REST API9. This service has been previously evaluated to perform with 86
% accuracy [
As Finnish is a highly inflected language the correct inflected form for the referent identifier has to be derived to enhance readability of the anonymized version of the text. For this reason, morphological analysis is being used to distinguish, for example, the case and possessive sufix of nouns. Turku Neural Parser [11] is used to perform morphological analysis of the original text and UralicNLP10 [12] to correctly inflect the referent identifiers to match the original text. Inflection is done using a finite state transducer (FST) model.
The flow diagram in Fig. 3 illustrates how the data is processed in the ANOPPI system during diferent steps of the anonymization process.
As presented in Fig. 3 the anonymization process starts from the left when the user uploads a new document to ANOPPI. Firstly, the document is loaded to the ANOPPI Server and the original document is stored in the database. Then the text is extracted from the document and sent to the Nelli Tagger Service. The service performs named entity recognition and named entity disambiguation (NED) on a document. Here, the Nelli Tagger Service aims to maximize recall in the named entity recognition phase because it is easier for the user of WUI to delete suggested entities than to manually pick new entities from the text, if LAC did not automatically recognize them. It is also possible to restrict anonymization to certain types of entities (for example only person names). Further fine-tuning can be done by whitelisting certain names and contexts, for example to keep names of the judges overt in court judgments.
Once the Tagger Service returns the entities to the server the annotated result is recorded into a database for later usage and sent to the client in HTML format. The user checks the results in the WUI and can correct and preview the result. Once the client is satisfied with the result, the client can export the anonymized document. As the original DOCX file was stored initially the anonymized document can be created by fetching the original file from the database and switching its content with the anonymized one, preserving the original layout of the file.
The database holds the records of the document and in case the same document is requested again, the document can be dug up from the database instead of reprocessing it again with the
LAC tagger component. However, old documents are scheduled to be deleted from the database after a configurable period of time.
To test the performance of the LACs in anonymization of persons we created a tailor-made test dataset that consists of text in Finnish with person names added in grammatically appropriate places. The names were handpicked from the Population Information System data with emphasis on selecting both common and rare names. Attention was paid to select names including both traditional Finnish names and foreign names as well as names with two parts and names with a common meaning, for example Karhu (bear). Investigation reports from Safety Investigation Authority of Finland (SIAF) were used as base text for the test data. These reports do not originally contain any names but only references to people in the form of pronouns and job titles that were replaced randomly by the selected names and their combinations.
Eventually the test data contained 152 added names and name combinations from which ANOPPI identified and anonymized 136 (89,5 %) correctly. In total, ANOPPI identified 141 names or name combinations from the test data, but five of them were false positive words. A total of 16 names remained unidentified. However, most of the unidentified names were located in parts of the text where names are not common which would not be an issue with real data.
In addition to evaluating the performance of the LAC, the ANOPPI tool as a whole has been evaluated by measuring and comparing the time it takes to anonymize a court decision both semi-automatically using the WUI and manually using only word processor software. The results obtained in this manner so far show that on average it takes about half the time to anonymize a court order using ANOPPI as compared to manual anonymization. ANOPPI makes some mistakes especially by confusing person names with place names and vice versa and spotting and correcting all of these incorrect categories using the WUI slows down the process. Moreover, in order to verify the correctness of the anonymization result a human expert still has to get acquainted with the content of the document regardless of the anonymization being automatic.
Automatic or semi-automatic anonymization and pseudonymization11 methods are already in
use in several European judicial systems [13]. For example, in Denmark an anonymization
tool for court orders was implemented using solely manually crafted grammar rules to find
the named entities in the texts [14]. Recent projects similar to ours focusing on automatic
anonymization of court orders using ML methods possibly in combination with rule-based ones
have been conducted for example in Poland, Austria, Germany, Latvia and France12. Regarding
the NER/NEL services embedded in ANOPPI there are lots of related research surveyed in [
Evaluation of ANOPPI shows promising results in locating the names of persons, organizations, places, and diferent types of identifiers of specific form. Still, it is dificult to build a general solution for anonymization as the suficiency of de-identification varies in each case. The category-based selection of named entities used in the current model is not suficient if for example names of small companies should be anonymized but large ones should not. Another issue in the ANOPPI project is the lack of task-specific training data as we are not able to store and make use of real production data in order to continuously train ML models due to restrictions imposed by the GDPR. That is why we ended up using a general NER model for Finnish language along with configurable case-based rules.
The ANOPPI service is currently in pilot testing in the Ministry of Justice of Finland for anonymization of Finnish court decisions in order to make them available on the Web and for data analysis in the forth-coming public LawSampo data service and portal for publishing and studying Finnish legislation and case law. Future work focuses on further improving the performance of the named entity recognition algorithm and including identification of new 11See https://tietosuoja.fi/en/pseudonymised-and-anonymised-data for the diference between the notions of anonymization and pseudonymization.
12Based on webinar presentations at: https://ec.europa.eu/info/policies/justice-and-fundamental-rights/ digitalisation-justice/conferences-and-events_en#webinarsontheuseofartificialintelligenceinthejusticefield entity types such as rare diseases or unique job titles that make re-identification of people straightforward.
Acknowledgments This work is part of Finnish AI special funding program by the Ministry of Finance, for experiments that promote productivity. CSC – IT Center for Science, Finland provided computational resources. dency Treebank, Language Resources and Evaluation 48 (2014) 493–531. doi:10.1007/ s10579-013-9244-1, open access. [11] J. Kanerva, F. Ginter, N. Miekka, A. Leino, T. Salakoski, Turku neural parser pipeline: An end-to-end system for the conll 2018 shared task, in: Proceedings of the CoNLL 2018 Shared Task: Multilingual Parsing from Raw Text to Universal Dependencies, Association for Computational Linguistics, 2018. [12] M. Hämäläinen, UralicNLP: An NLP library for uralic languages, Journal of Open Source
Software 4 (2019) 1345. doi: 10.21105/joss.01345. [13] M. van Opijnen, G. Peruginelli, E. Kefali, M. Palmirani, On-Line Publication of Court Decisions in the EU: Report of the Policy Group of the Project ’Building on the European Case Law Identifier’, 2017. Available at SSRN: https://ssrn.com/abstract=3088495. [14] C. Povlsen, B. Jongejan, D. H. Hansen, B. K. Simonsen, Anonymization of court orders, in: 11th Iberian Conference on Information Systems and Technologies (CISTI), IEEE, Las Palmas, Spain, 2016. doi:10.1109/CISTI.2016.7521611.