The concept of the Right to be ForgottenRTBF, also known as the right to erasure under Europe's General Data Protection Regulation (GDPR), gives individuals the power to request that technology companies permanently delete their personal data. This law emphasizes the fundamental right to privacy of individuals. However, as emerging technologies such as large language models (LLMs) and AI chatbots become commonplace, it is unclear how these technologies will fulfill this right. Notably, AI has yet to provide a direct data deletion or forgetting mechanism, leaving individuals seeking to remove their digital footprint in a bind.
A recent study by researchers from the Data61 Business Unit, Australia's National Science Service's unit specialising in artificial intelligence, robotics and cybersecurity, explored these impacts. The study highlights that advances in technology have gone beyond existing legal frameworks designed to protect individuals' privacy.
The RTBF is not the exclusive mechanism of the European GDPR, and similar provisions exist in various jurisdictions such as Canada's California Consumer Privacy Act (CCPA) and Japan's Personal Information Protection Act (APPI). The Personal Information Protection Law of the People's Republic of China (PIPL), which came into effect on November 1, 2021, provides for the right to erasure in certain circumstances, similar to the "right to be forgotten".
Originally, the RTBF clause was designed with internet search engines in mind, enabling companies such as Google and Microsoft to identify and remove specific data from their indexes. However, the operation of LLM and AI chatbots makes the situation very complicated.
According to Australian researchers, machine learning-based algorithms function differently than search engines, which complicates the process of identifying and erasing personal data. In addition, it is extremely challenging to understand what personal data contributes to the training of AI models and attribute this data to specific individuals.
In these complex models, insight into specific personal data can only be gained by examining the original training dataset or prompt model. However, companies that manage these AI services may choose not to disclose their training datasets. In addition, interacting with a chatbot does not guarantee that it will provide the accurate information the user seeks, as these systems can produce fictitious responses called "hallucinations."
The unique challenges of RTBF in the AI industry provide a platform for innovation and development. The researchers have proposed various ways to remove data from AI-trained models. These include "machine cancellation learning" techniques such as SISA methods, inductive graph cancellation learning, and approximate data deletion.
This progress, although initially triggered by legal requirements, can lead to more efficient models that provide better control and transparency over data usage. This can ultimately increase user trust and increase the reach of AI services.
Major players in the LLM industry, such as OpenAI, are also actively seeking RTBF compliance solutions. For example, OpenAI provides a form for users to request that their personal data be deleted from ChatGPT output. However, details of how these requests were handled remain undisclosed.
It is critical that legislators and AI practitioners collaborate to develop new guidelines for AI systems to meet privacy requirements. This will require a delicate balance to ensure that privacy is protected without stifling innovation.