Right to be Forgotten (RTBF) in one of the oldest and prominent of the legal data rights. While its legal intention is straight forward (for example, the GDPR describes it in just 417 words), the computing community has found it challenging to implement this in practice. For example, regulators have issued 205 RTBF violations in the first five years of GDPR i.e., an RTBF failure once every 9 days, on average. In this work, we identify the uncertainties and risks in supporting RTBF from a computing perspective. Then, to mitigate these challenges, we propose a two-phase approach that bridges an intrinsic dichotomy between law and computing. We demonstrate the effectiveness of our technique by showing how it could have fully avoided 80% of RTBF violations that occurred in the year-6 of GDPR. We also discover six long-standing practices of computing and data management that have become anti-patterns for RTBF. Finally, to ground our research, we introduce RTBF capability into Elasticsearch, a popular open-source search engine.
翻译:被遗忘权是最古老且最突出的法定数据权利之一。虽然其法律意图明确(例如,GDPR仅用417个词对其加以描述),但计算界发现其在实际中难以实施。例如,在GDPR实施的前五年内,监管机构已发布205起违反被遗忘权的案例,即平均每9天发生一次被遗忘权违规。本文从计算视角识别了支持被遗忘权过程中的不确定性和风险。为应对这些挑战,我们提出了一种两阶段方法,以弥合法律与计算之间的内在二分法。通过展示该方法本可完全避免GDPR实施第六年中80%的被遗忘权违规事件,我们证明了其有效性。此外,我们还发现了六项长期存在的计算与数据管理实践,这些实践已成为被遗忘权的反面模式。最后,为固化研究成果,我们将被遗忘权功能集成到流行的开源搜索引擎Elasticsearch中。