Right to Erasure in Cloud and Distributed Systems: Can Data Ever be Truly Deleted?

Author

Kushagra Tiwari, Sanidhya SS Chouhan, Priyanshu Danu

Abstract

 The right to erasure presumes that deletion is an event. In cloud and distributed systems, it is a process, unfolding across replicas, tombstones, caches, backups, derived datasets and storage media, each running on its own clock. This article argues that the familiar question of whether data can ever be “truly” deleted is badly framed, because it treats physical annihilation as the only legitimate endpoint and so allows regulators and engineers alike to retreat into abstraction. Drawing on database-systems research, cloud provider documentation, European Union data protection law and India’s Digital Personal Data Protection Act, 2023, the article distinguishes logical, cryptographic and physical erasure; shows that the anonymisation threshold in Recital 26 of the General Data Protection Regulation supplies a workable legal standard for the second; and identifies the temporal weakness of that standard. It then proposes an “erasure horizon” model: a disclosed, tiered and auditable bound on how long any recoverable copy of personal data may persist after a valid request. The article concludes that erasure should be regulated as a verifiable engineering process rather than an instantaneous outcome.

Keywords

Right to Erasure; Right to Be Forgotten; Cloud Computing; Distributed Systems; Cryptographic Erasure; GDPR; Digital Personal Data Protection Act, 2023

Full Text:

Download Paper PDF

References

Can data ever be truly deleted? If “truly” means that no bit encoding the information exists anywhere, the answer in distributed systems is almost never, and the honest answer is that no one could prove otherwise. But that is the wrong test, and it has never been the legal one. European law began with delisting, defines identifiability by reference to means reasonably likely to be used, and already tolerates backups on a bounded basis. Indian law speaks of erasure without defining it and ties retention to purpose and legal necessity. Both are compatible with a different answer: data can be made, within a bounded and disclosed period and by methods that can be evidenced, irrecoverable by any reasonably likely means.
That answer has a cost. It requires abandoning the picture of deletion as an instantaneous event and accepting that erasure is a process with a duration, a method and a threat model, each of which can be wrong and must be revisited as technology and adversaries change. It requires controllers to know where personal data lives, to design key hierarchies before they need them, and to say, truthfully and in advance, how long the process takes. It requires regulators to stop asking whether data is truly deleted and to start asking how long it takes, who can prove it, and what has been done to ensure that it does not come back. A right that can be verified is worth more than a promise that cannot be falsified, and the erasure horizon is the form that verification should take.

Share your valuable work from Social Media Buttons