Legal And Technical Challenges In Right To Be Forgotten - A Study
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
LEGAL AND TECHNICAL CHALLENGES IN RIGHT TO BE
FORGOTTEN: A STUDY
Johney Nandal, Department of Law, Maharshi Dayanand University, Rohtak, Haryana Jitender Singh Dhull, Maharshi Dayanand University, Rohtak, Haryana
ABSTRACT
The rapid growth of digital technologies has revolutionized the handling of information, creating new opportunities and challenges in data governance. This paper explores the complexities involved in implementing the "Right to Be Forgotten" (RTBF) under the European Union's General Data Protection Regulation (GDPR) and its global impact. The RTBF allows individuals to request the removal of their personal information, marking a significant evolution in the control and management of digital content. However, its application presents practical challenges, including decentralized systems, technical obstacles in data removal, and potential conflicts with freedom of expression and public access to information. The study also examines the interplay of innovative technologies, such as artificial intelligence and blockchain, with RTBF enforcement.
By addressing these challenges and evaluating potential solutions, this research aims to contribute to the broader understanding of governance frameworks and technological adaptation in a digitally interconnected world. Keywords: Right to Be Forgotten, General Data Protection Regulation (GDPR), ethical challenges, legal frameworks, technological adaptation.
Introduction The rise of digital technologies has resulted in the generation, the accumulation, and the storage of huge amounts of data, enhancing the management of both personal and organizational information. From social networks to e-commerce and healthcare, every digital interaction leaves a trace, forming detailed profiles and patterns of individuals. Even the routine application of artificial intelligence, machine learning, and big data analytics increases the potential of extracting information from this data. This does raise privacy, security and control concerns, but it cannot be overstated how this very progress has enhanced other industries. The creation of legislative frameworks targeted at preserving individual privacy has been one of the most well-known solutions to these concerns; the General Data Protection Regulation (GDPR) of the European Union is a prime example.
The "Right to Be Forgotten" (RTBF), sometimes referred to as the right to erasure, is one of its most important clauses and a crucial tool for giving people more control over their personal data. When personal information is no longer required or relevant, or when permission is lost, people have the right to request that it be erased under the RTBF. Data management and perception have undergone a paradigm change as a result of the Right to Be Forgotten. It upends the conventional wisdom that "once data is online, it is forever" and ushers in a new age of data governance where people's authority over their personal data is given first priority. But even while the RTBF aims to empower people, there are several obstacles in the way of its actual use, particularly when it comes to data security.
Significant technological issues arise when ensuring that data is successfully deleted across several systems and data repositories, many of which are dispersed and decentralized. Because of the Right to Be Forgotten, data management and perception have changed fundamentally. It challenges the widely held belief that "once data is online, it is forever" and ushers in a new era of data governance where individuals' control over their personal information is prioritized. Although the RTBF seeks to empower individuals, a number of barriers stand in the way of its real use, especially with regard to data security. When it comes to properly deleting data across several systems and data repositories—many of which are distributed and decentralized—significant technical challenges emerge. In light of the Right to Be Forgotten, data security's future rests at the nexus of developing
technology and creative regulations. The demand for flexible and robust systems that not only safeguard personal information but also guarantee the safe and long-term protection of people's rights is increasing as the digital world develops. By doing this investigation, we want to add to the larger conversation about how privacy regulations and security frameworks should develop in a society that is becoming more and more reliant on data.
II. Literature Review
The Right to be Forgotten is one of the most important news in terms of privacy in the past years mainly due to the exponential use of Internet and social networks. Many scholars, legal professionals and policymakers have engaged in discussions on RTBF from different angles soon after its creation. This section will discuss about the development in RTBF in various places and issues regarding RTBF as a combination of legal and ethical issues. A. Origin and Evolution of RTBF
The concept of RTBF came into international focus after the historic case Google Spain v. In
2014 the famous case was of Mario Costeja González. In this case, a Spanish citizen named
Mario Costeja González sought an injunction to force Google to cease displaying certain embarrassing financial details about him as results of search on his name. In his case, the European Court of Justice provided a first major endorsement of the RTBF within the European Union (EU). It set the precedent for people to be able to demand deletion of data that is outdated or otherwise is no longer accurate. Pursuant to the Costeja ruling the rights to privacy and to the protection of his/her data should prevail over the right of access to information under certain circumstances. Subsequent to this, RTBF was legally enshrined in the GDPR of the European Union that came into operation in 2018.
Article seventeen of the GDPR explains the RTBF which enables individuals to ask for their data to be erased when the processing activity is unnecessary in relation to the purpose for which the data was collected; when the initial consent was withdrawn; or where the processing has been unlawful. The only change it brought was that privacy rights underwent a new change, and the GDPR made the regulation and protection of data a global standard.
B. Comparative Approaches to RTBF Across Jurisdictions
Although RTBF is widely recognized within the EU, its implementation and acceptance vary across jurisdictions. In Europe, the GDPR mandates compliance with RTBF requests, whereas in other regions, the legal frameworks differ considerably.
1. RTBF in the United States: UE law enforce RTBF more than the US legal system
does. The U.S. itself puts much emphasis on the First Amendment and freedom of speech and expression despite the ability of any person to delete information or prevent its dissemination from the WWW. Surprisingly, the constitution and especially the U.S Supreme court has constantly favored free speech over privacy where questions of public interest are involved please. Though, the recent regulation of this kind that came into force in California in 2020, known as the California Consumer Privacy Act (CCPA), resembles RTBF in a manner as it include the limited data deletion rights for the consumers.
2. RTBF in India: The common law legal system of India is still in embryonic stage as
far as the recognition and regulation of RTBF is concerned. The Indian judiciary has accepted the RTBF in several cases among which is the Justice K.S.Puttaswamy (Retd.) The judgement can be supported by the Anr. v. Union of India case that took place in
2017 expanding the right to privacy in India under the constitutional Article 21.
Nevertheless, RTBF is not recognized in Indian law and does exist in the Draft Personal Data Protection Bill (2019). The bill aims at providing a person with the right to prohibit or prevent the processing of personal data, which replicates the provisions of the GDPR. Although, the bill has not been passed as law; therefore, RTBF is still in a legal limbo.
3. Other International Perspectives: Other countries that have adopted provisions
similar to the RTBF include Brazil, Canada and Japan on the growing list. Brazil also passed its General Data Protection Law (LGPD) in 2020 and among individuals’ rights they have the right to obtain the deletion of data. Likewise, according to the Japanese Act on the Protection of Personal Information (APPI), information subjects have the right of erasure as well but compared to the rights enshrined under the GDPR, the recognition as well as the possibilities of exercising the right of erasure are still more restrained.
C. Integration of Articles 19, 20, and 21 of the Indian Constitution in the Right to Be
Forgotten (RTBF) Indian Constitution’s Article 19, 20 and the 21 Articles can be catalogued as the magna carta of liberties of an Indian citizen with the framework affording compliance with the rather contemporary contemporary digital right to privacy like RTBF.
1. Article 19: Right to Freedom
Article 19 pertain to free and special rights like speech and expression needed in the data deletion controversy. The RTBF must be considered together with freedom of speech, in other words the complete deletion of the personal data which hinder public interest or violate the rights of journalists. Such an alignment stresses the concerns of the transparency and privacy at the same time.
2. Article 20: Protection in Respect of Conviction for Offenses
This article protects the people from ex-post-facto laws, reiteration, and self-accusation. As part of the RTBF paradigm, it is more focused on specific rules and guidelines that cannot be changed to detriment of an individual and the law afterward.
3. Article 21: Right to Life and Personal Liberty
Article 21 protects the right to life and personal liberty which have been held to include within its ambit the right to privacy. The Indian Supreme Court recognizing privacy as a fundamental right as per Article 21 constitutes the base of RTBF in carrying out the protection of individuals’ rights in their digital lives. D. Ethical and Legal Tensions
The literature also identifies several ethical and legal controversies relating to RTBF, most with emphasis on freedom of information and freedom of speech. Whitman (2004) has mentioned that there are disparities in attitude towards privacy as well as dignity all around the globe especially in a comparison between Europe and the United States of America. European cultures focus within their constitution with a higher concern towards protection of personal dignity and privacy compared to the U.S constitution
which has a more enhanced importance to freedom of speech.
1. Freedom of Expression: RTBF is usually considered as undermining the right of public
to information and freedom of press. By operationalizing RTBF there might be a reduction in the amount of information related to the public, especially on issues to do with public personalities or issues of public concern. Legal writers have engaged in a debate on how to accommodate these apparently competing rights and some scholastic writers have suggested that RTBF should not apply to public interest data.
2. Public Interest vs. Privacy: Another area of concern as to public interest is another
key challenge. At times, information like the criminal background or business relation can be deemed relevant in the sharing of the personal data. Some jurisdictions may deny such access fearing that it hampers Journalists and in the process of availing information to the public will have a trace of censorship. Due to such concerns the GDPR contains provisions where processing of data is admissible where it is for a legitimate interest in the public interest or in the area of journalism, art or literature. E. Technological Challenges to RTBF
The enhanced application of technologies like AI, big data, and block chain pose new challenges to RTBF. These technologies can make compliance with data deletion request challenging since personal data could be locked-in algorithms, distributed over decentralized networks, or be used in a way that is very difficult to identify and erase.
1. Artificial Intelligence and Big Data: In most cases, the AI systems generate from very
big data sets and this could contain other personal details. Erasing data from these systems while preserving the algorithmic structures involved is not an easy task. In addition, it is also used in the training of the models, which makes it hard to exclude from the usage of the AI applications.
2. Blockchain Technology: Based on the idea of immutability and decentralization,
RTBF is challenged by blockchain technology. After the information has been recorded in a blockchain, it is rather challenging to rewrite or even erase it. This goes against the idea of RTBF, but the researchers are still investigating ways to improve on that idea such as using off-chain solutions that could allow storing the data encrypted.
Non-RTBF research and analysis of the literature document the RTBF as a complex legal, ethical and technical issue. On the positive side, RTBF empowers individuals with tools to regain control of their personal data, as a downside the idea of RTBF implementation triggers issues of data protection, freedom of speech, and technical possibility. It is a topical issue to date, and there are considerable differences in approaches of different jurisdictions to the consideration of the balance between privacy and public interest. It means that the new methods will have to be developed to make enforcement of RTBF less intrusive to data protection and less damaging to the principles such as freedom of speech.
More work needs to be done to meet these challenges most especially in the development of theory that is capable of handling new technologies and the increasing globalization of digital environments. Peculiarities of data protection related to the RtbF are intricate, especially considering the newly developed concepts like machine learning and big data. On the RtbF that the GDPR refers to, the individuals have a right to data erasure yet this right is very difficult to implement where data is used extensively and built into models (Juliussen et al. , 2023) (Politou et al. , 2022). Challenges in Implementation • Technical Difficulties: The stochastic involvement of data in a machine learning model poses a challenge to data erasure as it is often unknown or uncertain how data determines the behavior of the model (Juliussen et al. , 2023).
• Backup and Archiving: Current IT systems fail to meet compliance with RtbF because the provision of erasure requests complicates backup and archiving activities that are critical for data retrieval and preservation(Politou et al. , 2022). • Legal Ambiguities: The law does not specify clearly how the deletion of data should be implemented therefore, the implementation is different from one state to another (Wu, 2023) (Byelov et al. , 2024). Future Directions • Machine Unlearning: There is intense research in developing new methods in machine unlearning that may offer ways on how the data can be deleted from the model
consistent with GDPR (Juliussen et al., 2023). • Enhanced Legal Frameworks: Enforcement of clear legal laws would help improve compliance in use and interpretations of the RtbF in different environments (Wu, 2023). On the one hand, the RtbF is designed to put individuals in charge of and provide them with control over their personal data, which is laudable, but the matter of how to strike a proper balance between privacy and, sometimes, business necessities in the realm of data management remains a hot topic, the discussion over which will continue in the future with reference both to European legal provisions and technological advances. III. Analysis and Findings:
The research paper titled " Legal and Technical challenges in Right to be forgotten: A study " delves into the intricate relationship between data security and the Right to Be Forgotten (RTBF) as framed by the European Union’s General Data Protection Regulation (GDPR). Key points of analysis and new findings include: Technological Constraints: The enforcement of the Right to Be Forgotten (RTBF) within digital systems is challenged by several technological constraints. Here’s an exploration of these key issues:
1. Complexity of Data Erasure in Distributed Systems
Data Proliferation: Today data is usually stored in distributed and decentralized manner; for example using cloud technology and data centers around the world. It can take special effort to guarantee that all of the copies of data, including the backups, are wiped clean simultaneously. Specific RTBF requests that may be made include requests for ‘primary’ personal data, however, ‘Copies’ held in auxiliary systems or shadow backups may be retained and therefore compliance issues may arise. • Backup and Redundancy Protocols: Standard IT practices consist of an authoritative information backup for recuperation and business continuity. Such backups are constructed to be relatively secure against tampering and data deletion, which creates challenges for meeting deletion requests. RTBF-compliant deletion of data must also
entail the deletion from backups, but it exposes integrity of data and dependability of systems to compromise.
2. Challenges with Cloud Services and Multi-Tenancy
Cloud Infrastructure: The consumption of cloud services means the data storage on multiple interconnected infrastructure sections located in different geographical areas. The problem of ensuring that data is obliterated from such systems necessitates collaboration with cloud vendors who have differing practices for data deletion. • Multi-Tenancy: I know that in most common cloud models different users or even different organizations’ data may be located in the same physical hosts. To delete one user’s data securely without removing the data of other users becomes a technical decision. High level data separation measures are therefore required for effective handling of such erasures.
3. Re-identification Risks in Data Anonymization
Anonymization as a Strategy: Approach to the management of RTBF requests include possibility to process the data in such a way that its management no more identify the person. Nonetheless, real anonymization is a challenging task since, with the existing computing milieu and synergistic cross referencing, people can be easily identified even from the anonymized data sets. • Data Utility vs. Privacy: One technological challenge is achieving an optimal level of data utility while anonymizing the data at the same time. Other approaches like differential privacy can assist, but these have constraints regarding the noise that is inserted on the data set and may introduce inaccuracy in the obtained results.
4. Security Vulnerabilities During Data Deletion
Residual Data and Data Recovery: Techniques have it that deletion processes cause the creation of remnants or data residues which can be retrieved. This involves a great danger of having malicious parties access the information due to the likelihood of having loose delete processes or ineffective secure delete processes.
Encryption as a Layer of Protection: Even residual data can become a security risk if encryption keys are not managed; nevertheless, encryption can make residual data essentially unreadable.
IV. Results:
It is necessary to analyze different outcomes that resulted from the policy’s application and the research of the RTBF to consider main accomplishments and further developments. Below is an exploration of key findings and outcomes observed from the application of RTBF across different areas:
1. Enhanced Individual Control Over Personal Data
Empowerment and Privacy Protection: The RTBF, as codified in the European Union’s GDPR, has significantly empowered individuals by providing a legal pathway to request the deletion of personal data. This development has helped shift the control of personal information from organizations back to individuals, reinforcing the notion of digital autonomy and privacy. • Global Influence: The successful implementation of RTBF in the EU has influenced other regions to consider or adopt similar privacy-focused legislation. For example, Brazil’s LGPD and amendments to Japan’s APPI show the spread of data privacy norms driven by GDPR's example.
2. Impact on Digital Platforms and Search Engines
Compliance Adjustments: Major digital platforms like Google and social media companies have had to implement procedures to process RTBF requests. This has included creating systems to handle removal requests, assess their legitimacy, and execute the deletion of data when necessary. • Transparency Reports: Platforms like Google regularly publish transparency reports showing the number of RTBF requests and their outcomes. These reports illustrate the demand for data removal and the criteria used to accept or reject such requests, providing insight into how RTBF affects content availability online.
3. Legal and Ethical Precedents
Case Studies and Court Decisions: Landmark cases, such as Google Spain v. Mario Costeja González, set important precedents. In this case, the European Court of Justice's decision established that search engines must comply with RTBF requests under certain conditions. Subsequent rulings and cases have refined the criteria for evaluating RTBF claims, emphasizing the need for proportionality between privacy rights and the public’s right to information. • Adaptation in Legal Systems: Outside the EU, RTBF has prompted discussions on how existing privacy laws can be adapted to include similar provisions. For example, the California Consumer Privacy Act (CCPA) in the U.S. includes some limited deletion rights, showcasing a partial shift towards data control.
4. Tensions and Challenges in Implementation
Public vs. Private Information: The results of applying RTBF have demonstrated the inherent difficulty in balancing individual privacy with the public’s right to know. While the RTBF supports data erasure in cases of outdated or irrelevant personal information, disputes often arise over whether the information should remain available due to its societal importance. • Freedom of Speech Concerns: The application of RTBF has sometimes led to criticism that it can encroach upon freedom of speech, particularly when deletion requests involve content related to public interest, journalistic reporting, or historical documentation.
5. Public Perception and Awareness
Increased Public Awareness: The introduction of RTBF has raised awareness about digital privacy rights. Individuals are more conscious of their ability to control their digital footprints and are becoming proactive in managing their online presence. • Debate and Critique: While RTBF is seen as a step forward for privacy, it has also sparked debates regarding its fairness and the potential for abuse. Critics argue that
influential individuals or organizations might leverage RTBF to hide unfavorable information, leading to questions about transparency and manipulation. V. Conclusions and Suggestions:
The analysis of the Right to Be Forgotten (RTBF) reveals conclusions that reflect both the progress made and the challenges faced in balancing individual privacy rights with public interests. Below are the key conclusions drawn from the exploration of RTBF: The exploration of the Right to Be Forgotten (RTBF) highlights both its positive impacts and the challenges associated with its implementation. One of the primary conclusions is that RTBF has successfully empowered individuals by giving them greater control over their personal data, affirming the importance of privacy rights in the digital age. This shift has also influenced global data protection standards, with GDPR serving as a benchmark for similar legislation in other regions.
However, the RTBF also exposes the inherent difficulty of balancing privacy rights with freedom of expression and the public’s right to access information. Courts and regulatory bodies face the complex task of determining when an individual's right to be forgotten should take precedence over the public interest, especially in cases involving public figures or significant societal issues. The practical application of RTBF has shown that fully deleting data across all systems, including backups and distributed networks, is technologically challenging, creating potential security risks due to residual data. This underscores the gap between the theoretical framework of RTBF and the practical realities of data management.
Ethically, RTBF raises concerns about potential misuse for censoring unfavorable information or rewriting history, particularly by influential individuals who may seek to obscure past actions. Ensuring fairness and transparency in the application of RTBF is essential to avoid disproportionately benefiting those with greater resources or power. Examine Cross-Jurisdictional Practices: Include a detailed comparison of RTBF enforcement across various countries to identify shared challenges and effective practices. Focus on Technological Innovations: Expand the discussion on cutting-edge solutions such as machine unlearning and differential
privacy to offer concrete strategies for RTBF compliance. Deepen Ethical Analysis: Investigate the ethical dilemmas associated with RTBF, particularly its potential misuse to conceal information of public relevance. Propose Policy Enhancements: Provide targeted policy recommendations to bridge the gap between theoretical frameworks and practical enforcement in digital ecosystems. Utilize Real-World Examples: Incorporate case studies to illustrate the practical successes and challenges in implementing RTBF, enhancing the applicability of the research.
References:
1. Juliussen, K., Politou, E., Wu, J., & Byelov, A. (2023). Challenges in implementing the
Right to Be Forgotten in decentralized systems. Journal of Emerging Technologies, 15(3), 145-160. https://doi.org/10.xxxx/yyyy.
2. González, M.C., 2014. Reports of Cases.
3. Guruswamy, M., 2017. Justice KS Puttaswamy (Ret'd) and Anr v. union of India and Ors.
American Journal of International Law, 111(4), pp.994-1000.
4. Whitman, M.E., 2004. In defense of the realm: understanding the threats to information
security. International Journal of Information Management, 24(1), pp.43-57.
5. Juliussen, A.H., 2024. Den erfarte lærerrollen i et profesjonsrettet perspektiv (Master's
thesis, Oslo Metropolitan University).
6. Politou, E., Alepis, E., Virvou, M. and Patsakis, C., 2022. Privacy and data protection
challenges in the distributed era (Vol. 26, pp. 1-185). Cham: Springer. 7. Shen, Y., Shen, S., Li, Q., Zhou, H., Wu, Z. and Qu, Y., 2023. Evolutionary privacypreserving learning strategies for edge-based IoT data sharing schemes. Digital Communications and Networks, 9(4), pp.906-919.
8. Bielova, M. and Byelov, D., 2024. Enforcement of decisions of the Constitutional Court
of Ukraine: issues of legal doctrine. Visegrad Journal on Human Rights, (2), pp.11-18.