Faults and Pitfalls in Implementing the Right to be Forgotten

2026-05-26

AI Summary

Existing computing systems struggle to effectively support the Right to Be Forgotten (RTBF), frequently resulting in violations of regulations such as the GDPR. This work identifies critical uncertainties and risks inherent in RTBF implementation and proposes a two-phase approach that integrates legal compliance analysis with system design. The authors implement the first systematic RTBF solution in the open-source search engine Elasticsearch, uncovering six persistent data management anti-patterns. Their solution demonstrates significant practical impact, potentially preventing approximately 80% of RTBF-related GDPR violations observed in the regulation’s sixth year, thereby substantially enhancing both regulatory compliance and the feasibility of real-world deployment.

Abstract

Right to be Forgotten (RTBF) in one of the oldest and prominent of the legal data rights. While its legal intention is straight forward (for example, the GDPR describes it in just 417 words), the computing community has found it challenging to implement this in practice. For example, regulators have issued 205 RTBF violations in the first five years of GDPR i.e., an RTBF failure once every 9 days, on average. In this work, we identify the uncertainties and risks in supporting RTBF from a computing perspective. Then, to mitigate these challenges, we propose a two-phase approach that bridges an intrinsic dichotomy between law and computing. We demonstrate the effectiveness of our technique by showing how it could have fully avoided 80% of RTBF violations that occurred in the year-6 of GDPR. We also discover six long-standing practices of computing and data management that have become anti-patterns for RTBF. Finally, to ground our research, we introduce RTBF capability into Elasticsearch, a popular open-source search engine.

Problem

• Right to be Forgotten
• GDPR
• data deletion
• compliance violations
• data management

Innovation

• Right to be Forgotten
• GDPR compliance
• law-computing dichotomy
• data deletion anti-patterns
• Elasticsearch integration