ABSTRACT
Europe’s proposed reforms risk shrinking data rights when they should be strengthening them. Imagine a woman who, in 2016, posts on a health forum about a medication that is not working for her. She posts under a pseudonym, believing it will keep her anonymous, because she wants advice from people who understand her situation. In 2023, her words are scraped, together with several billion other web pages, into the training run of a commercial AI model. Nobody asks her permission, and nobody informs her; at this scale, controllers routinely rely on an exemption from the GDPR’s notification duty. On paper, she now holds five rights against that company: to be informed, to access her data, to correct it, to object to its use, and to have it erased. In practice, she can exercise none of them, because she does not know the model exists and because the model does not hold her words as a discrete record that an ordinary deletion request could locate. Her rights are real. They just do not work.
Hassan, Ammar, The Right to Be Forgotten, Except by AI (September 14, 2026).
Leave a Reply