The Answer: Deleting Data Does Not Prove a Model Has Forgotten

The subject of this final judgment is the practical implementation of the GDPR right to erasure by controllers when personal data may also have entered a learned system. The focus is the inference that is safe to make after a deletion action: what was addressed, what paths were covered, what the model tests show, and what remains uncertain. Readers can now evaluate an erasure or forgetting claim by separating the legal decision, the system action, the propagation and restoration work, the behavioural evidence, and the boundary of the conclusion.

The answer to the title is direct. Deleting data does not prove that a model has forgotten because deletion and forgetting concern different objects, and because a model’s failure to produce an answer is only an observation under the conditions tested. The source record may be gone while a learned influence remains. The model may stop producing a target while the source record remains elsewhere. Both may be changed, yet the evidence may still cover only one access route or one version of the system.

That conclusion is not an argument against deletion or against machine unlearning. It is an argument for saying exactly what either action establishes.

The legal answer: erasure is a scoped obligation, not a visual event

Under Article 17 GDPR, erasure is a right and an obligation when one of specified grounds applies, but it is not an unconditional command to destroy every item associated with a person. The grounds include data no longer being necessary for their purpose, withdrawal of consent without another legal basis, a successful objection, unlawful processing, a legal obligation to erase, and data collected in connection with an information-society service offered to a child under the relevant conditions. Article 17(3) also recognises exceptions for matters such as expression and information, legal obligations, public interest, public health, safeguarded research or archiving, and legal claims.

That structure changes the meaning of “done.” A controller first needs to know which processing and data the request concerns, then determine whether a ground applies and whether an exception limits the result. A single person can have a marketing record that should be erased after consent is withdrawn, an account profile that is no longer necessary, and a narrow invoice record that must be retained under another legal obligation. The correct outcome may be partial rather than uniform. A blanket declaration that everything was deleted can be inaccurate in one direction; a blanket declaration that nothing can be deleted can be inaccurate in the other.

The right also has states between ordinary use and final erasure. Restriction can limit future processing while accuracy is checked or competing grounds are assessed. A lawful exception may permit continued processing for a defined purpose, but it does not suspend the other data-protection principles. Storage limitation, minimisation, integrity, and confidentiality still matter. Anonymisation may be relevant in a constrained context, yet the EDPB’s findings show why pseudonymisation or partial masking cannot simply be renamed permanent deletion. The legal state and the technical state must be described separately.

The EDPB’s 2025 coordinated action shows why this is an implementation problem rather than a wording problem. Thirty-two supervisory authorities investigated controllers’ practices and received responses from 764 controllers. The report assessed compliance as “average” among most participating authorities, while warning that authorities used different strategies and that the sample is not a universal prevalence estimate. Its recurring findings—weak procedures, inadequate training, insufficient information, uncertainty about exceptions and retention, backup difficulties, and uncertain anonymisation—are different symptoms of one underlying failure: the organisation cannot reliably connect a request to the full processing lifecycle.

The result is a distinction between interface evidence and accountability evidence. An account page disappearing can show that a user-facing state changed. It does not show whether the controller identified email records, support tickets, vendor copies, or backup paths. A deletion log can show that a command ran. It does not show that the command covered the right scope. A response to the person can show that the controller communicated an outcome. It does not make an unexplained refusal lawful. The stronger claim needs a relationship between the data map, the legal decision, the action, and the record of what was verified.

Communication is part of that relationship. Article 12 requires clear and accessible information, facilitation of data-subject rights, and information on action within one month, with a possible extension of up to two further months when necessary and explained. If the controller does not act, the person must receive the reasons and information about supervisory and judicial remedies. This means that the controller cannot rely on a silent interface change to communicate a complicated result. The person should be able to understand whether the request was granted, limited, refused under an exception, or still being handled under an identified process.

Propagation adds another boundary. Article 17(2) requires reasonable steps to inform other controllers processing public personal data about a request to erase links, copies, or replications when the conditions for erasure apply. Article 19 requires communication of an erasure carried out under Article 17(1) to recipients to whom the data were disclosed, unless that is impossible or involves disproportionate effort. These provisions make copies and recipients relevant to the legal and factual picture.