The Right to Be Forgotten in the Age of AI

The 'right to be forgotten'—enshrined in GDPR Article 17—grants individuals the ability to request deletion of their personal data under certain circumstances. This right emerged from the reasonable premise that people should not be perpetually defined by their digital past. But in an age of machine learning, the concept of data deletion has become far more complex.

When your data is used to train an AI model, it becomes entangled in the model's parameters in ways that cannot be simply reversed. The model has 'learned' from your data, but that learning is distributed across millions of mathematical weights, not stored in an identifiable location that can be deleted. In a meaningful sense, your data has been transformed into something else entirely.

This creates a fundamental tension. Can you exercise your right to be forgotten if doing so would require deleting or retraining an entire AI system? Current interpretations of GDPR generally do not require this—model weights are typically not considered personal data. But this interpretation may not adequately protect the interests the right to be forgotten was meant to serve.

Consider the implications. An AI system trained on your medical records might make inferences about people with similar characteristics—even after your records have been deleted from the training database. A facial recognition system might retain the ability to identify your features. The 'forgetting' is incomplete.

Some researchers are developing 'machine unlearning' techniques that would allow specific data contributions to be removed from trained models without full retraining. These methods show promise but remain imperfect and computationally expensive. They may eventually provide a technical path toward more meaningful data deletion rights.

In the meantime, we need regulatory frameworks that address AI training more directly. This might include stronger consent requirements before data is used for model training, mandatory disclosure about training data sources, and new rights related to AI systems that have learned from personal information. The right to be forgotten must evolve for an age when data lives on in algorithmic form.