Right to be Forgotten

The Right to be Forgotten, formally the right to erasure under GDPR Article 17, grants EU residents the right to request deletion of their personal data when it is no longer necessary for its original purpose, consent is withdrawn, the individual objects to processing, or data was unlawfully processed.

Organizations must delete personal data upon valid erasure requests unless legal obligations, public interest, or legitimate overriding grounds require retention. The right applies to controllers and requires notification to data processors and third parties who received the data. Exceptions include compliance with legal obligations, exercise of freedom of expression, public health requirements, archiving purposes, and establishment or defense of legal claims.

The right to be forgotten creates fundamental conflict with public blockchain architecture. Blockchain immutability means on-chain data cannot be deleted or modified once recorded, making literal compliance impossible for personal data stored on public distributed ledgers. Solutions include storing only hashed or encrypted data on-chain with off-chain storage of actual personal information enabling deletion, using permissioned blockchains with data access controls, implementing cryptographic techniques rendering data inaccessible by destroying keys, or avoiding storage of personal data on-chain entirely. Regulatory guidance suggests rendering data permanently inaccessible may satisfy erasure obligations even if technical deletion is impossible, though legal interpretation continues evolving.