How do freelance translators protect confidential data?

As is the case with any business arrangement, trust is the foundation of every successful translation project. In my 16 years working in medical translation the thinking around confidentiality has been evolving. Approaches including simply having sensitive data redacted, to drop box delivery and later uploading to secure platforms have all featured as we have moved through the pre- and post-GDPR era. All these and more can contribute to a freelance translator’s strategy as they uphold their duty to take confidentiality seriously.

What does “confidential” really mean?
I have often begun the opening discussions with a potential new client dancing around what information needs to be shared and when. Can I give a quote without seeing the file? Is it enough just to know the wordcount and subject area? While it is natural to be wary of sharing private or sensitive company or personal data with someone you don’t know, it’s important to remember that everyone has to comply with data protection legislation. Under the GDPR, confidentiality broadly means protecting any data that can identify a person from being accessed by someone who is not entitled to see it. However, for a company, confidentiality may mean not disclosing any information that is not already in the public domain. In both cases, it is best to err on the side of caution and treat all information received with the same respect.

Standard practice among reputable professionals is not to share any information received from a client, whether written, verbal or implied. That covers casual chats with colleagues about what we’re working on, to not allowing anyone else to access documents kept on our computers – and, potentially, deleting those documents as agreed with clients at an appropriate time.

Secure tools and workflows
You might wonder how freelancers manage file security without the IT infrastructure that a large company has. There are plenty of tools available to allow us to handle confidentiality, from the simple to the high-tech.

Redacting personally-identifying data in a medical report is one of the simplest and most accessible strategies, and one that has been the norm for many years. When I work with private individuals looking to get their own medical records translated, I may receive documents with names, dates of birth and addresses included. Individuals are of course free to share their own data, but it’s my commitment to them that I won’t share it with any third party. I redact all such details when I send my translations to a revision partner to check, and I store all these projects in a password-protected sub-folder. Redaction can be done using some pdf readers, or even just a printer/scanner and a thick black marker.

There is also the question of how documents are managed after the translation is completed and delivered. Translators protected by professional indemnity policies may not be allowed to delete documents, or if they do they waive the coverage of their insurance company in the event of any dispute. And what about when repeat jobs come from the same customer? Once again, password-protection can be used, on an individual document basis or for a whole folder. My practice is also to periodically go through old projects and see which ones I really need to retain. If enough time has elapsed that the chances of legal action are vanishingly small and I have transferred all useful, non-confidential terminology to glossaries for future projects, I delete these files and free up space on my computer. If I have made a hard copy of a document, as I might for redaction or to get a closer look at an unclear pdf, I destroy these immediately after use, and the shredded paper goes into the compost bin to be eaten by worms. And they are not giving up your secrets.

For file receipt and delivery, confidentiality can be enhanced by using end-to-end encrypted e-mail clients and secure cloud-based file sharing. It goes without saying that regularly updating virus protection software is essential.

Non-disclosure agreements
While the solutions above are useful for protecting personal data of individuals, a strengthened approach may be required with business partners. Before any work begins, professional freelance translators may offer or agree to sign a Non-Disclosure Agreement (NDA) to formalise the commitment that sensitive content won’t be shared or discussed and the translator understands their legal obligation to protect your data. An NDA additionally provides a framework for recourse if things go wrong, but I would argue that the willingness of a professional to sign one means they are aware of their responsibilities and take them seriously. It acts as a guarantee of trust that is the underlying assurance that discretion is of paramount importance to this partnership.

Responsible working practices
Working with a freelancer will often mean fewer eyes on your documents, which can be viewed as a positive in terms of confidentiality. Documents won’t be casually passed around a team, or left lying by a printer (yes, I’ve seen it happen in an office environment, back in the early 2000s). Dealing directly with the person doing the work means accountability and transparency, and when a translator works with a reviser this would be done with a client’s express knowledge and permission. While the popular image of freelance life may be one of carefree folk with laptops in coffee shops or on beaches, the reality is that a responsible professional would never work on sensitive documents in a public space where anyone could look over their shoulder. Likewise, while freelancers enjoying breaking up the isolation of working alone by meeting with colleagues, the intricacies of projects are not freely discussed and clients are not named. After all, why would we risk losing that hard-won client over a moment’s indiscretion?