How about we start treating these sorts of freeform data with the highest security and privacy they deserve? If it might contain HIPAA data, treat it as you would HIPAA data. If it might contain military secrets, treat it as you would under top secret clearance. If it might contain personal data, treat it as you would under GDPR. When it's always on for a huge portion of the population, treat it like it's likely enough to contain data that should be held under a really high standard. Don't treat it under the average case standard.
If your users are usually saying "Hello, i am unhappy I spent two hours on hold" but a few thousand data points say "hello, my name is john doe. I have HIV, I live at 123 Main Street and my social security number is 987654321" treat the whole dataset as the latter case. Maybe we should even pass regulations along those lines.
If your users are usually saying "Hello, i am unhappy I spent two hours on hold" but a few thousand data points say "hello, my name is john doe. I have HIV, I live at 123 Main Street and my social security number is 987654321" treat the whole dataset as the latter case. Maybe we should even pass regulations along those lines.