Right to be forgotten
The right, enshrined in Article 17 of the GDPR, to obtain the deletion of one's personal data, tested by the absorption of data into AI models.
On May 13, 2014, in Google Spain (C-131/12), the EU Court of Justice required a search engine to delist information about a private individual. Article 17 of the GDPR, applicable since May 25, 2018, turned that right to be forgotten into a right to erasure, which the controller honors in principle within one month. The right assumes the data sits in an identifiable place that can be found and then destroyed. AI breaks that assumption: a model absorbs the data and spreads it across millions of parameters, where it becomes inseparable from the rest. Erasure, designed to be absolute and binary, turns into approximate and unverifiable forgetting, and the right to disappear shrinks to a right to attenuation. The durable answer moves upstream, to data minimization: the best protection against an erasure request is never to have absorbed the data in the first place.
Textbook case: a policyholder requests the erasure of their data from a pricing model; the insurer can technically neither reliably remove them nor prove their disappearance, which leaves it exposed to a sanction.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.