Two obligations sit on European courts at once, and they point in opposite directions.
Article 6 of the European Convention on Human Rights requires that judgments be pronounced publicly. It is a foundational protection against arbitrary justice: decisions made in the open can be scrutinized. The General Data Protection Regulation requires that processing of personal data be minimized. A published judgment contains a great deal of personal data about people who did not volunteer for publicity.
Judgment anonymization for court decisions is how those two obligations are reconciled, and in most European jurisdictions it is a standing duty attaching to every published decision rather than a project undertaken once. That distinction shapes everything about how it has to be done.
The guide to writing a court AI policy treats this as one of the workflows courts govern first. This article covers the practice.
Pseudonymization and anonymization are not the same
The terms are used interchangeably in ordinary speech and mean different things in law, which matters because the legal consequence differs.
Anonymization removes the possibility of identifying an individual, after which the data ceases to be personal data. Pseudonymization replaces identifiers with substitutes while identification remains possible with additional information, and the data generally remains personal data for whoever holds that information.
In EDPS v SRB (Case C-413/23 P), decided on 4 September 2025, the Court of Justice of the European Union held that sufficiently pseudonymized data may remain personal data for the original controller while being anonymous for a recipient who cannot reasonably re-identify the individuals concerned. That relativity has practical consequences for court publication: what the court holds and what the public receives may have different legal characters, and the analysis has to be done rather than assumed.
Most court practice is pseudonymization, replacing names with initials or designations, even where it is described as anonymization.
Courts should use the terms precisely in their own policy even where colloquial usage is looser, because the legal characterization determines what obligations continue to attach to the material the court retains. A policy describing the process as anonymization, applied to a workflow that is actually pseudonymization, misstates the court's own position on data it still holds.
Doing it at national volume
A national court system publishes thousands of decisions. Manual anonymization at that volume is not a staffing problem to be solved with more staff; it is a throughput ceiling.
This is why automated anonymization of court decisions has become an active field in European research and procurement rather than a curiosity. The task has properties that suit automation: the categories are largely defined, the text is structured, the volume is high, and the same names recur throughout a document.
It also has properties that resist it, which is why review remains necessary. Which parties are anonymized and which are not is a legal judgment that varies by jurisdiction and case type. Public figures acting in an official capacity are often named. Companies may be named where individuals are not. And identification frequently survives name removal.
Consistency across a series
An individual document anonymized correctly can still fail if the series around it is inconsistent.
The same person appearing in a first-instance decision, an appeal, and a related matter should carry the same designation throughout, or a reader can correlate across documents and re-identify. Courts that anonymize document by document, without a register linking designations, produce exactly that exposure.
The register itself then becomes sensitive material requiring its own protection, which is the practical form of the pseudonymization point above: the court holds the key, and holding it is what keeps the data personal for the court.
Re-identification from context
The failure that matters most is not a missed name.
A judgment may describe an unusual occupation in a small town, a rare medical condition, a specific date and location, or a distinctive sequence of events, none of which is a name and all of which together identify a person to anyone locally. Categorical detection will not find this, because nothing in it belongs to a protected category.
Addressing it requires a human reading for identifiability rather than for identifiers, which is a different task and a slower one. Courts that automate detection and skip this pass will publish documents that are technically compliant and practically identifying.
Some jurisdictions handle this by allowing the court to restrict publication of a decision entirely where anonymization cannot make it safe, which is a better answer than publishing a document that identifies through description.
The published recording is the same duty with a different mechanism
Courts increasingly publish more than text. Appellate and supreme courts put oral argument online as a standing transparency commitment, and courts that stream hearings keep the recordings afterward. The anonymization duty attaches to those the same way it attaches to a judgment, and most anonymization policies do not mention them at all.
What changes is the mechanism, and it changes per medium rather than once.
In video, the protected element is visual and it moves. Faces, and in some jurisdictions whole persons, have to be located in every frame and tracked as they turn, are occluded, and reappear. That is object detection and tracking rather than find-and-replace, and its failure mode is different too: a face missed for eight frames is a face published.
In audio, the protected element is spoken. A name said aloud, an address given in testimony, a date of birth read into the record. Removing it means muting or bleeping the passage, which requires locating it in a transcript first and then mapping back to the timestamp, and it interacts with speaker attribution because a voice can identify a protected person even where the words do not.
In documents, which is where exhibits and filings published alongside a decision sit, the protected element is text but frequently not machine-readable text. Scanned filings, handwritten annotations, and material in non-Latin scripts all need recognition before anything can be detected, and layout matters because a name in a header repeats on every page.
Two consequences a court should write into its policy. The designation register has to span media, so a person who is Individual A in the published judgment is consistently obscured in the recording of the hearing that produced it, and a reader cannot correlate across the two. And the unredacted original stays under custody rather than being overwritten, because the published version is a derivative and the court still holds the record.
Verification and audit
The published version is permanent in practice, because it is indexed, cached, and copied within hours.
That argues for verification before publication rather than monitoring after it, and for a record of what was done: what was detected, what was substituted, who reviewed, and on what basis a decision was published in the form it was. Where a failure is later discovered, that record establishes what happened.
The related process for request-driven records release is covered in AI redaction for court records and public release. Where decisions are also published in more than one language, the translation obligations interact, and are covered in AI translation of judgments and legal documents. For decisions referencing material obtained across borders, cross-border evidence exchange between courts covers the underlying instruments.
How VIDIZMO Redactor supports judgment anonymization
Redactor runs across all four media a court publishes, which matters because the alternative is a different tool per medium and a different audit trail for each.
For the judgment itself, detection covers personal data categories in documents with country-specific identifier recognition, which matters in a European context where national identifier formats differ. Optical character recognition handles scanned filings, and intelligent character recognition extends it to handwritten annotation. Substitution with neutral placeholders, designating a person as an individual rather than simply deleting the name, preserves the readability a judgment needs to remain intelligible.
For published recordings, object detection and tracking cover faces and persons across video frames, and audio redaction mutes or bleeps spoken personal data with speaker diarization to keep the attribution straight. Image redaction covers exhibits published as stills.
Two controls are worth knowing about specifically for this workload. Redaction codes attach the legal basis to each redaction decision, and the multi-layer architecture keeps those decisions on independently manageable layers, so a supervisor can verify the personal-data layer without re-reviewing the ones already approved, and the published output can show that something was withheld and on what basis without exposing what it was. That is the verification record this article asks for, produced as a by-product rather than assembled afterward. Detection confidence is configurable rather than fixed, which is what lets a court set a more cautious threshold for publication than it would for internal review.
Bulk processing handles a publication queue rather than a document, and the redacted copy is generated separately so the unredacted original stays intact.
Where it does not remove the obligation: it does not decide which parties should be anonymized, which is a legal determination, and it does not detect identification by description, which is the failure mode that matters most. The human pass reading for identifiability remains necessary.
Building the process
Decide the anonymization rules for your jurisdiction and case types, and write them down rather than relying on practice.
Maintain a designation register so a person carries one designation across related decisions and across media, and protect it. Automate detection and substitution for the categorical work. Add a deliberate human pass reading for identifiability from context. Verify before publication rather than monitoring after. And retain a record of what was done to each published decision.
Start your free Redactor trial to test detection and substitution on a sample of your own decisions.
