Faults and Pitfalls in Implementing the Right to be Forgotten
This paper identifies computing-related uncertainties and anti-patterns hindering the Right to be Forgotten (RTBF), proposes a two-phase approach to bridge the gap between legal requirements and technical implementation, and demonstrates its effectiveness by showing how it could have prevented 80% of GDPR RTBF violations while introducing the capability into Elasticsearch.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you have a digital diary that never forgets. Every time you post a photo, send an email, or buy something online, that information is copied, stored, and shared across the internet. For a long time, the computer world operated on the idea that "what's written is written forever."
Then, a new law called the Right to be Forgotten (RTBF) arrived. It's like a legal "undo" button. It says: "If I change my mind, or if this information is no longer relevant, I have the right to ask companies to delete my personal data."
The authors of this paper, a team of computer scientists and a lawyer, noticed a big problem: Computers are terrible at "forgetting."
Here is a simple breakdown of their findings and solutions, using everyday analogies.
The Problem: "Just Delete It" is a Trap
When companies first heard about the Right to be Forgotten, their reaction was, "Isn't that just deleting a file?"
The authors say this is like saying, "Isn't eating just for nutrition?" or "Isn't sex just for reproduction?" Sure, those are parts of the picture, but they miss the whole point. Deleting data isn't just about hitting a "delete" button. It's a complex legal and technical puzzle.
Because companies oversimplified it, they kept getting in trouble. In the first five years of the law (GDPR), regulators issued a fine or warning for a "forgetting failure" roughly every 9 days.
The Solution: A Two-Step Recipe
The authors propose a new way to build systems that can actually forget. They call it a Two-Phase Approach:
Phase 1: The Legal Map (Law-Driven Design)
First, they translate the confusing legal text into four clear computer tasks. Think of this as turning a vague recipe ("make it taste good") into specific steps ("chop 2 onions, boil for 10 minutes").
- The Door: You need a way for people to knock on the door and say, "Delete my data."
- The Judge: You need a system to decide if the request is valid. (Sometimes you can't delete data, like if it's needed for a court case or public safety).
- The Cleaner (Processing): You need to scrub the data from the computer's "working memory" (where it's being used right now).
- The Vault (Storage): You need to dig the data out of the deep storage, backups, and archives.
Phase 2: The Reality Check (Enforcement-Driven Refinement)
Laws are written in broad strokes, but real life is messy. The authors looked at thousands of real-world fines and mistakes made by companies over the last five years. They used this "scrapbook of failures" to fix their design.
- Example: They found that many companies failed because they made it too hard for people to ask for deletion (like requiring a physical signature for a digital request).
- Example: Others failed because they deleted the data from the main database but forgot to delete it from the backup tapes or the "trash can" logs.
The "Anti-Patterns": Bad Habits We Need to Break
The authors identified six common habits in computer design that act like "poison" for the Right to be Forgotten. They call these Anti-Patterns:
- Using Personal Data as Keys: Imagine a filing cabinet where the only way to open a drawer is to use the person's phone number as the key. If you delete the phone number, the whole cabinet breaks. Computers often use emails or IDs as "keys" to find data, making it impossible to delete the person without breaking the system.
- The "Blindfold" Trick (Anonymizing instead of Deleting): Some companies say, "We won't delete your data; we'll just blur your face so you can't be recognized." The authors say this is a trick. If the company still holds the "unblurred" key, they haven't really forgotten you. Plus, blurring isn't always permanent.
- The "No Labels" Problem: Imagine a warehouse full of boxes with no labels. If someone says, "Delete my stuff," how do you find it? Many companies don't tag their data with "who this belongs to," so when a deletion request comes, they can't find the specific data to delete.
- The "Shallow" Delete: This is like cleaning a room by just sweeping the dust under the rug. The data looks gone from the main screen, but it's still sitting in the "under-the-hood" logs, caches, and backups.
- The "Logbook" Trap: Companies keep detailed logs (diaries) of everything they do to prove they are following the rules. But if they write down every detail of a deletion request in a permanent log, they are accidentally keeping the very data they were supposed to delete.
- The "Security Gate" Overload: Some companies make it so hard to prove who you are (asking for a passport, a signature, and a blood sample) that people give up. The law says the process shouldn't be harder than just creating an account in the first place.
The Test Drive: Elasticsearch
To prove their idea works, the authors took a popular search engine software called Elasticsearch (used by many big companies) and tried to fix it.
They found that Elasticsearch was good at "hiding" data but bad at "erasing" it. It was like a library that moved books to the back shelf but didn't burn them. The authors built a "Cleansing Delete" tool. This tool:
- Forces the system to actually wipe the data from memory and disks.
- Checks the backups and logs to make sure nothing was left behind.
- Does this quickly enough that the computer doesn't slow down noticeably.
The Bottom Line
The paper concludes that you can't just "delete" your way out of the Right to be Forgotten. You have to redesign how computers think about data.
By treating "forgetting" as a serious, first-class operation—just as important as "saving" or "searching"—and by learning from the mistakes companies have already made, we can build systems that respect our right to disappear from the digital record when we choose to.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.