Answering a CADA request: how to redact protected details before you disclose

Who must answer a CADA request, and how fast?

Book III of the CRPA, France’s freedom-of-information law, gives everyone a right of access to administrative documents, “without distinction of nationality or any need to justify an interest,” as the CADA (Commission d’accès aux documents administratifs, the independent access-to-documents commission) puts it. It covers documents produced or received in the course of a public-service mission by the State, local authorities, other public bodies and private bodies entrusted with such a mission (Article L300-2): a town hall, a département, an inter-municipal body, a social action center, a public establishment. The request goes to the body that holds the document; the CADA only steps in afterwards, if access is refused.

The deadline is short: one month from receipt of the request by the competent authority (Article R311-13). If nothing is said within that time, silence amounts to a refusal (Article R*311-12). An express refusal, full or partial, must be a written, reasoned decision that states the available remedies and time limits (Article L311-14). Medical files follow their own deadlines: eight days, or two months for information more than five years old, according to the CADA.

To meet the deadline, decide in advance who answers. Towns and inter-municipal bodies with 10,000 inhabitants or more, départements, regions, and public establishments or public-service bodies with at least 200 staff must appoint a person responsible for access to administrative documents, known as the PRADA (Article R330-2). The CADA’s guide for PRADAs stresses how brief the legal deadline is and recommends internal procedures: who finds the document, who decides on redactions, who signs the reply.

There is one narrow way out: the authority need not act on abusive requests, “in particular by their number or their repetitive or systematic nature” (Article L311-2). The CADA defines them as requests whose obvious purpose is to disrupt the public service, and expects the authority to invoke the point, preferably in writing. A request that is merely long to process does not qualify.

What must be redacted?

Article L311-6 of the CRPA reserves three categories of documents, or passages, for the person concerned:

• Protected secrets: anything whose disclosure would harm privacy, medical confidentiality or trade secrets, the latter covering processes, economic and financial information, and commercial or industrial strategies.
• Assessments: anything containing an assessment or value judgment about a named or easily identifiable natural person.
• Conduct: anything revealing a person’s conduct where disclosure could harm them.

Article L311-5 adds documents or passages that cannot be disclosed to anyone: Cabinet deliberations, national defense, State security, public safety and personal safety, ongoing court proceedings, criminal investigations, and other secrets protected by law. Those passages are redacted too.

Two reflexes prevent over-redaction. First, details reserved for the person concerned are disclosed to that person: if the requester is the subject of the document, do not hide what concerns them. Second, a name alone does not make a document secret. The practical guide published by the CADA and the CNIL (France’s data protection authority) is explicit: a person’s first and last name are not, in themselves, among the details protected as private life. What is protected is the information around the name.

The same guide lists examples of private-life details: date of birth and age, personal contact details (postal address, email address, phone number, including for public servants), assets and financial situation, income, taxes, bank accounts, disability status, working hours, political views and religious beliefs. Applied to the most common cases in local government:

Treat this table as a guide, not a scale: the CADA assesses each document, and its database of opinions on cada.fr lets you find cases close to yours. For re-identification by cross-referencing, which matters most when publishing, see re-identification risk.

Redact or refuse: when can the whole document be withheld?

Partial disclosure is the rule. Article L311-7 of the CRPA leaves no doubt: where a document contains non-disclosable details that can be redacted or severed, it is disclosed after those details are redacted or severed. Redacting means masking the passage inside the document; severing means removing a separable part, such as an annex or a page.

Withholding the whole document is the exception. In opinion no. 202305139 of September 21, 2023, the CADA recalls, citing the Conseil d’État (May 25, 1990; January 4, 1995, no. 117750; May 26, 2014, no. 342339), that a document may be refused in full only if partial redaction would strip it of intelligibility, meaning or any interest. The PRADA guide says the same: when the protected passages are too numerous for the document to keep any interest, it is not disclosable.

There is also a timing limit: the right of access applies only to finished documents, not to preparatory documents for a decision still being drafted (Article L311-2). And do not expect the commission to do the work: the PRADA guide notes that it does not redact the documents the authority sends it. The redaction is yours to do, and to do properly.

In what form should the document be disclosed?

The requester chooses, “within the limits of the authority’s technical capabilities” (Article L311-9):

On fees, Article R311-11 excludes staff costs for the time spent searching, copying and sending, and requires the requester to be told the total in advance, with prepayment possible. The cap of €0.18 per black-and-white A4 page comes from the order of October 1, 2001, still in force. Only the medium, the copying and the postage are chargeable, never the staff time.

The reply itself can stay simple. The PRADA guide offers a standard wording for partial disclosure: the document is enclosed, and the authority states that, under Articles L311-5 and L311-6, the document has been redacted of the details covered by the relevant secret (privacy, trade secrets, medical confidentiality). Stating the reason for each redaction avoids a CADA referral born of a simple misunderstanding.

What happens after a refusal or no answer?

A requester facing a refusal, express or implicit, can refer the matter to the CADA. This step is mandatory before any action in the administrative court: referral to the commission “is a mandatory prerequisite” to litigation (Article L342-1). The full timeline:

The CADA notes that a referral made before the authority’s month has run out is inadmissible, and it offers an online referral form. For the authority, the opinion is a chance to correct an over-broad redaction: disclosing a properly redacted document within the following month beats waiting for the court.

Why is redaction not enough for online publication?

This is the point most often missed. Since the Digital Republic Act of October 7, 2016, public bodies must publish online, where they exist electronically, “the documents they disclose” under the access procedures, together with their updated versions (Article L312-1-1(1)). The duty does not apply to local authorities with fewer than 3,500 inhabitants or to legal entities with fewer than 50 full-time-equivalent staff (Article D312-1-1-1). In other cases, a document disclosed on request is meant to go online.

Publication follows a stricter rule than disclosure. Article L312-1-2 requires two separate treatments:

• details covered by Articles L311-5 and L311-6 are redacted, as for disclosure;
• personal data, unless a statute provides otherwise or the people concerned agree, may be made public only after processing that makes it impossible to identify those people.

A decree, adopted after an opinion of the CNIL, lists categories of documents that may be published without that processing (Article D312-1-3). Outside that list, a staff member’s name left readable in the requester’s copy should in principle disappear from the published version, along with whatever would point back to the person: a unique role in the authority, a worksite address, the date and place of an incident. When that applies, plan for two copies: one redacted for the requester, one anonymized for publication. The difference between the two levels is covered in pseudonymization or redaction: which to choose and anonymization vs. pseudonymization under the GDPR.

Why is a black box not a redaction?

Because it hides the text on screen without removing it from the file. A drawn rectangle or an annotation placed over a PDF leaves the words on the page: copy and paste, search or text extraction brings them back. Variations on the same trap:

• Black highlighting in Word, or a shape over the text: the text is intact, and changing the color reveals it.
• A Word file “cleaned” by hand: comments, tracked changes, hidden text and document properties (author, organization) stay in the file.
• A blacked-out scan: if the PDF went through OCR, an invisible text layer still carries the words beneath the image.

The test is simple: open the copy, search for a redacted name with Ctrl+F (⌘F on a Mac), then select all the text and paste it into an editor. If the name appears, the redaction failed. More detail and further checks: why a black box on a PDF leaves the text readable, how to check an anonymized PDF and removing PDF metadata.

How do you handle a CADA request with AnonymFiles?

AnonymFiles is a local anonymizer: it detects and redacts the personal data in a whole folder on the computer, without sending anything online. For a CADA request, the method takes six steps.

1. Gather the requested documents. Drop the folder into the app: text or scanned PDFs (read by local OCR), Word files, .eml or .msg emails with their attachments, spreadsheets, presentations, subfolders included.
2. Let detection do the heavy lifting. Names, organizations, addresses, emails, phone numbers, IBANs and French identifiers (ID card, passport, license plate…) are found and replaced with labels. The same person keeps the same label across every document, whether written “Mme Vasseur” or “Claire Vasseur.”
3. Adjust to the CRPA. A staff member who signs in an official capacity stays disclosable: one click on “Never redact” keeps the name readable in that document or across the folder. Conversely, select in the original the passages detection cannot qualify: an assessment of a staff member, a description of conduct, a health detail, the detailed pricing of a bid. On a PDF or scan, draw a zone over a handwritten note or a photo.
4. Review every document. The copy is shown next to the original; nothing is exported until you approve it, document by document. A poorly read scanned page is flagged and needs explicit confirmation.
5. Export “To send to someone.” You get one redacted PDF, Word file or spreadsheet per document, under a neutral name. In the PDF, the redacted text is deleted from the file and replaced by a labeled black block, such as [PERSONNE_1]; metadata is removed. In the Word file, with its layout kept, comments, tracked changes, properties and embedded images are removed. Before export, a check rereads every file and blocks the document if any original value is still there.
6. Keep a record. A neutral processing report can accompany the export (items masked by type, dated approvals, file fingerprints), and the local audit log records preparations, approvals and exports, without any masked value. Useful if the requester or the CADA disputes a redaction.

For online publication, go over the copy again with the re-identification risk indicator: it flags quasi-identifiers left in clear (full date, unique role, precise location, land parcel number). It helps the review; it does not guarantee anonymity. Other uses in public bodies, from council decisions to residents’ letters given to an AI: AnonymFiles for the public sector. Step by step: how it works; per-seat pricing: pricing.