Formalizing Data Deletion in the Context of the Right to Be Forgotten

Abstract

The right of an individual to request the deletion of their personal data by an entity that might be storing it – referred to as the right to be forgotten – has been explicitly recognized, legislated, and exercised in several jurisdictions across the world, including the European Union, Argentina, and California. However, much of the discussion surrounding this right offers only an intuitive notion of what it means for it to be fulfilled – of what it means for such personal data to be deleted. In this work, we provide a formal definitional framework for the right to be forgotten using tools and paradigms from cryptography. In particular, we provide a precise definition of what could be (or should be) expected from an entity that collects individuals’ data when a request is made of it to delete some of this data. Our framework captures most, though not all, relevant aspects of typical systems involved in data processing. While it cannot be viewed as expressing the statements of current laws (especially since these are rather vague in this respect), our work offers technically precise definitions that represent possibilities for what the law could reasonably expect, and alternatives for what future versions of the law could explicitly require. Finally, with the goal of demonstrating the applicability of our framework and definitions, we consider various natural and simple scenarios where the right to be forgotten comes up. For each of these scenarios, we highlight the pitfalls that arise even in genuine attempts at implementing systems offering deletion guarantees, and also describe technological solutions that provably satisfy our definitions. These solutions bring together techniques built by various communities.

Deletion-Compliance in the Absence of Privacy

“…The present work continues this vein of research in the context of the "right to be forgotten", that was recently pioneered by Garg, Goldwasser, and Vasudevan [GGV20]. They have defined a notion of deletion-compliance that sets formal guidelines for service providers -that we will hereby refer to as data-collectors -to satisfy in order to comply with data deletion requests in accordance with the law.…”

“…Deletion-compliance is not in itself a formal representation of a law, but rather a sufficient criteria to comply with the spirit of the law. In the formalism of [GGV20], a data-collector X interacts with two other entities: the deletion-requester Y that represents the set of users that request deletion of their data, and the environment Z that represents other users and any other entity. Interactions with the data-collector are described via a protocol π to which is associated a corresponding deletion protocol π D .…”

“…This forces strict privacy of the data entrusted to the collector. This property was endorsed by the authors of [GGV20]: they argue that a data-collector that discloses information from its users loses control over that information and thus the ability to delete every copy. However, one can see from the definition that leakage of a single bit of information to the environment -whether Y is silent or not -is sufficient to distinguish the real and ideal executions.…”

Coded Machine Unlearning

“…For example, the work in [16] presents a statistical formulation of data deletion from machine learning similar to differential privacy and describes a method to achieve deletion in linear and logistic regression scenarios. A formulation of data deletion problems using cryptographic notations is presented in [17] with a brief discussion on deletion in ML models. Other works on statistical unlearning are also presented in [18]- [21].…”

P2T: Pay to Transport

“…Third-party services can use data both for legitimate and non-legitimate purposes, and an aggressive sharing of data increases the probability of non-legitimate uses. Examples of non-legitimate uses are unfair prices or insurance premiums, stigmatization of people and, in the worst case, the unfair punishment of people in non-honest states [ 4 ]. Furthermore, any service that stores data centrally is potentially the target of malicious attacks.…”