10. A system, comprising: a data processing apparatus; and a computer storage medium encoded with a computer program, the program comprising instructions that when executed by the data processing apparatus cause the data processing apparatus to perform operations comprising: receiving an electronic document data collection generated from a first set of documents, the document data collection including a first set of fixed phrases extracted from the first set of documents, wherein each fixed phrase is a phrase of one or more terms that is determined to not present a personal information exposure risk, and wherein access to the document data collection for examination by a human reviewer is precluded; receiving, by the data processing apparatus, a second set of documents, the second set of documents including documents that are each a personal document of a user that has personal information of the user and for which the user has provided permission to use the document for processing of the fixed phrases extracted from the first set of documents; extracting candidate phrases from the second set of documents, each candidate phrase being a phrase of one or more terms; identifying fixed phrases extracted from the first set of documents that match candidate phrases extracted from the second set of documents; generating, from the document data collection, a redacted document data collection in which each fixed phrase that does not match a candidate phrase is redacted, and each fixed phrase that does match a candidate phrase is not redacted; and providing access to the redacted document data collection for examination by the human reviewer.
10. A system, comprising: a data processing apparatus; and a computer storage medium encoded with a computer program, the program comprising instructions that when executed by the data processing apparatus cause the data processing apparatus to perform operations comprising: receiving an electronic document data collection generated from a first set of documents, the document data collection including a first set of fixed phrases extracted from the first set of documents, wherein each fixed phrase is a phrase of one or more terms that is determined to not present a personal information exposure risk, and wherein access to the document data collection for examination by a human reviewer is precluded; receiving, by the data processing apparatus, a second set of documents, the second set of documents including documents that are each a personal document of a user that has personal information of the user and for which the user has provided permission to use the document for processing of the fixed phrases extracted from the first set of documents; extracting candidate phrases from the second set of documents, each candidate phrase being a phrase of one or more terms; identifying fixed phrases extracted from the first set of documents that match candidate phrases extracted from the second set of documents; generating, from the document data collection, a redacted document data collection in which each fixed phrase that does not match a candidate phrase is redacted, and each fixed phrase that does match a candidate phrase is not redacted; and providing access to the redacted document data collection for examination by the human reviewer. 17. The system of claim 10 , the operations further comprising generating the electronic document data collection from the first set of documents, the generating the electronic document data collection comprising: extracting candidate fixed phrases from the first set of documents, each candidate fixed phrase being a phrase of one or more terms; for each candidate fixed phrase, determining whether the candidate fixed phrase presents a personal information exposure risk; and selecting only the candidate fixed phrases that are determined not to present a personal information exposure risk as the fixed phrases.