Right to Erasure

A data subject can request deletion when one of six specific conditions is met:

• Consent Withdrawal: The data was processed based on consent, and the subject withdraws it.
• Legitimate Interest Override: The subject objects to processing, and the controller has no overriding legitimate grounds.
• Unlawful Processing: The personal data was processed illegally.
• Legal Obligation: A Union or Member State law requires deletion.
• Purpose Fulfillment: The data is no longer necessary for the original collection purpose.
• Child Data: The data was collected in relation to an information society service offered to a child.

The right to erasure is limited when processing is necessary for:

• Freedom of Expression: Exercising the right to freedom of expression and information.
• Legal Compliance: Complying with a legal obligation requiring processing.
• Public Interest: Performing a task carried out in the public interest or exercising official authority.
• Public Health: Reasons of public interest in the area of public health.
• Archiving & Research: Archiving purposes in the public interest, scientific or historical research, or statistical purposes, where erasure would render impossible or seriously impair the achievement of those objectives.
• Legal Defense: The establishment, exercise, or defense of legal claims.

Fulfilling erasure requests in machine learning pipelines presents unique challenges:

• Full Retraining: The most definitive method involves removing the subject's data from the training set and retraining the model from scratch, which is computationally prohibitive for large foundation models.
• Machine Unlearning: Emerging techniques like SISA (Sharded, Isolated, Sliced, Aggregated) training partition data into shards, allowing retraining of only the affected sub-model rather than the entire system.
• Exact Unlearning: Algorithms that directly subtract the influence of specific data points from model weights without retraining, though this remains an active research area with no production-grade guarantees.

The controller has cascading responsibilities once an erasure request is validated:

• Recipient Notification: The controller must communicate the erasure to any third party to whom the data was disclosed, unless this proves impossible or involves disproportionate effort.
• Public Disclosure: If the controller made the personal data public, they must take reasonable steps, including technical measures, to inform other controllers processing the data that the subject has requested erasure of any links, copies, or replication.
• Verification of Identity: Before acting, the controller must verify the identity of the requester using reasonable means, especially in automated systems where direct human interaction is absent.

Erasure extends beyond stored training data to the model's generated outputs:

• Memorization Risk: Large language models can memorize and regurgitate verbatim training data, including personal information. Erasure requests may require output filtering or model editing to prevent future generation.
• Inference-Based Data: Even if a name is deleted, a model might still infer sensitive attributes from non-personal data combinations. True erasure requires addressing these indirect associations.
• Cached & Derived Data: All backups, logs, embeddings, and feature vectors derived from the original data must also be identified and deleted, requiring comprehensive data lineage tracking.

The right to erasure is intrinsically linked to the principle of data minimization under Article 5(1)(c) of the GDPR:

• Proactive Compliance: Systems designed with data minimization in mind—collecting only what is adequate, relevant, and limited to what is necessary—reduce the surface area for erasure requests.
• Retention Schedules: Automated deletion policies based on predefined retention periods prevent data from persisting indefinitely, making erasure requests less frequent and less complex.
• Pseudonymization: Storing data in a pseudonymized form, where the key is held separately, can simplify erasure by allowing the controller to delete the linking key rather than hunting through distributed datasets.

The technical process of removing the influence of specific training data from a model without full retraining. Exact unlearning aims to make the model behave as if the deleted data was never seen, while approximate unlearning reduces influence to a statistically negligible level. Key approaches include:

• SISA (Sharded, Isolated, Sliced, Aggregated): Training data is partitioned into shards, and only affected shards are retrained
• Gradient-based scrubbing: Reversing parameter updates associated with target data
• Certified removal: Providing mathematical guarantees that deleted data cannot be reconstructed from model weights

This is the core technical enabler for Right to Erasure compliance in AI systems.

A documented, verifiable trail describing the origin, custody, and transformations of every data point in a training dataset. Without robust provenance tracking, organizations cannot identify which model checkpoints contain a requesting individual's data. Essential components include:

• Lineage metadata: Recording ingestion timestamps, source systems, and transformation logic
• Attribution mapping: Linking specific training examples to their original data subjects
• Immutable audit logs: Cryptographically signed records proving data handling history

Provenance is the prerequisite for targeted deletion—you cannot erase what you cannot locate.

The legal foundation for the Right to Erasure in EU law, establishing that data subjects can request deletion when:

• Personal data is no longer necessary for the original purpose
• The data subject withdraws consent and no other legal basis exists
• The data was unlawfully processed
• A legal obligation requires erasure under EU or member state law

For AI systems, Article 17 extends to derived models and embeddings that encode personal data. Controllers must communicate erasure requests to any third parties who received the data, creating cascading compliance obligations across the AI supply chain.

A foundational privacy principle requiring that personal data collection be adequate, relevant, and limited to what is necessary for specified purposes. In AI training contexts, this means:

• Avoiding indiscriminate scraping of personal data for foundation model pre-training
• Implementing purpose-bound datasets rather than monolithic data lakes
• Designing architectures where personal data is never persisted in training pipelines when avoidable

Strong data minimization practices reduce the surface area of erasure requests—less unnecessary data stored means fewer deletion obligations when requests arrive.

A mathematical framework that provides formal privacy guarantees by injecting calibrated noise into training processes. When properly implemented, differential privacy ensures that the presence or absence of any single individual's data is statistically indistinguishable in the model's outputs. Key parameters:

• Epsilon (ε): The privacy budget—lower values mean stronger privacy
• Delta (δ): The probability of catastrophic privacy failure

While differential privacy does not eliminate the need for erasure mechanisms, it provides a defense-in-depth layer. Models trained with strong DP guarantees inherently limit memorization of individual records, making residual data less reconstructable after deletion.

The technical infrastructure enabling organizations to receive, verify, and fulfill individual rights requests at scale. For Right to Erasure specifically, automation must handle:

• Identity verification: Confirming the requester is the actual data subject
• Data discovery: Scanning all storage systems, backups, logs, and model artifacts for the individual's data
• Cascading deletion: Propagating erasure instructions to downstream processors and third parties
• Verification reporting: Generating auditable proof that deletion was completed within regulatory timeframes (typically 30 days under GDPR)

Manual processes cannot scale to the volume of requests large AI deployments generate.