What “delete” means when there is nothing to delete with

Neither Article 17 nor the recitals explain the word “erasure”. The study prepared for the European Parliament by its research service (PE 634.445, Michèle Finck, July 2019) records the omission plainly and draws a conclusion from it: there are grounds to hold that physical destruction is not required.

The support for that reading is Google Spain, where removing a link from search results was treated as sufficient while the publication itself stayed where it was. The newspaper survived. The link did not. If that is so, the argument is not about whose technology is tidier but about where the line of acceptability runs.

The official name of the provision is “Right to erasure ('right to be forgotten')”. The quotation marks inside the heading are not decorative: the right to be forgotten is a headline synonym, while the legal term is drier — the right to erasure. Regulation (EU) 2016/679 was adopted on 27 April 2016 and has applied directly across the Union since 25 May 2018.

Six grounds and five doors

Erasure can be demanded on six grounds, and the list is closed: the data are no longer necessary for the purposes of collection; consent has been withdrawn and no other basis exists; an objection has been raised that the controller cannot outweigh; the processing was unlawful; erasure is required by law; the data were collected from a child in connection with online services.

There are five exceptions, set out in paragraph 3, and they operate “to the extent that” processing is necessary: freedom of expression and information, compliance with a legal obligation or a task in the public interest, public health, archiving and research, and the establishment or defence of legal claims. An exception does not cancel a request — it carves a piece out of it.

On 13 May 2014 the Grand Chamber of the Court of Justice of the European Union ruled in case C-131/12. The GDPR did not yet exist: the court applied Directive 95/46/EC and Articles 7 and 8 of the Charter of Fundamental Rights.

It began in March 2010 with a complaint by a Spaniard, Mario Costeja González. A search on his name returned two pages of the newspaper La Vanguardia dated 19 January and 9 March 1998 — a notice of a real-estate auction held to recover social security debts. The debt had been settled years earlier. On 30 July 2010 the Spanish regulator AEPD rejected the claim against the newspaper and upheld the one against the search engine.

Paragraph 80 explains the difference: a search engine gives any user a structured overview of the information about a person and thereby allows a profile to be assembled. In 1998 the newspaper did what a ministerial order required it to do. Twelve years later the search engine does something else.

Paragraph 93 — the sentence for anyone building archives

Processing that was lawful and accurate at the outset may become incompatible with the law over time if the data are no longer necessary for the purposes for which they were collected: inadequate, irrelevant or excessive in the light of the time that has elapsed. In paragraph 98 the court noted specifically that the publication had taken place sixteen years earlier.

For a system designed to keep records indefinitely this is heavier than any fine. What expires is not the truth of a record but its relevance, and no algorithm measures that quantity. The court added two more points: the applicant does not have to prove damage, and the balance tilts towards the individual “as a rule”, reversing where a person's role in public life makes the public interest preponderant.

The first is time, and it comes not from Article 17 but from Article 12(3): a reply without undue delay and in any event within one month, extendable by two further months for complex requests. Three months at the outside.

The second is price. Infringements of data subject rights fall into the upper tier of Article 83(5): up to 20 million euro, or, in the case of an undertaking, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

The third is practice. The EDPB enforcement overview on the right to erasure, published in February 2026, covered 764 controllers and recorded two habits: anonymisation substituted for deletion, and backups excluded from deletion by default with no reason given. Cryptographic erasure is not mentioned once in that overview — neither as an approved practice nor as a prohibited one.

“Only a hash goes on chain”

The EDPB answers this directly in Guidelines 02/2025: a hash also counts as personal data, as do any identifiers sitting next to it. The reason is arithmetic. One-wayness protects against reversing an arbitrary input, not against brute force over a known set, and there are on the order of five billion email addresses in the world. Edward Felten, quoted in the European Parliament study, observed that such a sweep takes a machine less time than brewing a cup of coffee.

“Our network is private”

Narrowing the set of participants solves access, not immutability. A record that cannot be removed stays put whether ten thousand parties can see the chain or ten. It also raises the question of who the controller is: on CNIL's reasoning every participant with write access becomes one, and several participants pursuing a shared purpose without allocating responsibility in advance risk being joint controllers under Article 26.

“We will fork and clean it out”

A fork is technically possible but needs the network's agreement, which means one person's right hangs on the goodwill of independent parties who owe them nothing. It does not fit inside a month and does not scale: erasure requests are routine, a fork is an emergency instrument. It also destroys the very property the chain was chosen for — a history that can be rewritten on demand cannot be offered as proof.

The technique looks elegant: the data are encrypted from the start and what gets “deleted” is the key rather than the data. It has a canonical source — NIST SP 800-88r2, September 2025. The earlier r1 edition from 2014, still cited by most writing on the subject, was withdrawn on 26 September 2025.

The classification is what matters. The standard has a destroy tier, where the medium ends up as shavings; crypto-erase does not reach it and sits at the purge tier. The ciphertext physically remains.

Preconditions and acknowledged weaknesses

The preconditions are strict: algorithm strength of at least 128 bits with reference to ISO/IEC 27040, random-number generator entropy no smaller than the key length, ECB mode forbidden; the data must never have been written in the clear; every copy of the key must be destroyed, including keys lower in the hierarchy and unwrapped copies sitting in memory and in the encryption engine's registers.

The standard names its own weaknesses. If flaws are found in the algorithm or quantum computation makes key recovery feasible, the method may cease to be an acceptable sanitisation technique. Hence “harvest now, decrypt later”: a copy of the ciphertext taken before the key was destroyed can wait as long as it likes. The technique cannot be relied on where keys were backed up or escrowed. And the outcome cannot be checked: there is nothing to compare the remaining ciphertext against. The current edition adds a sobering line — effectiveness does not depend on documentation.

The legal side is murkier than the engineering. The EDPB holds that encrypted personal data remain personal data, and adds what is fatal for indefinite storage: even flawlessly implemented modern encryption will be defeated by time if the chain is kept forever. The only construction regulators explicitly describe as taking a record out of scope is a perfectly hiding commitment: once the witness and the original value are destroyed, what remains on chain is useless.

The distance between the 2018 and the 2026 positions is the distance between “we understand that you cannot” and “the fact that you cannot is a consequence of your own choice”. In 2018 CNIL acknowledged technical impossibility and proposed a way around it, while honestly noting that these ways are not, strictly speaking, erasure. The EDPB, in guidelines whose final version was adopted on 7 July 2026, is harsher: technical impossibility does not excuse non-compliance, because data protection is built in at the point where the means of processing are chosen, under Article 25(1).

CODE Eternal picked the verifiable answer over the attractive one. Only ciphertext reaches permanent storage: AES-256-GCM, encryption before upload, with the key held by the user and in a managed key store. A deletion request does not pretend to remove the record from Arweave — the key is destroyed, and what stays on chain is a string nobody can read, ourselves included.

And four open compromises. The ciphertext remains forever. Copies of the key kept by the user are a blind spot. There is no way to verify that crypto-erase worked. The legal standing of this architecture is confirmed by no regulator's guidance. That is less than one would like to put in an advertisement and exactly as much as can be produced on request.