Fouad Abdelrazek | September 13, 2026
Artificial intelligence (AI) collects a myriad of personal data with limited transparency for individuals about its use. It can deduce a significant amount of personal information from ordinary data. For example, AI can determine a person’s geographical origin, gender, age, health status, intoxication level, emotions, fatigue, and personality traits from voice recordings.
This underscores the importance of the Right to Be Forgotten (RTBF), which emerged as a key privacy right, enumerated in Article 17 of the General Data Protection Regulation (GDPR), the generally applicable law on the processing of personal data. The right’s objective is to protect personal data and ensure its free movement. This is based on Article 16(1) of the Treaty on the Functioning of the European Union, which states that “Everyone has the right to the protection of personal data concerning them.” The RTBF empowers individuals to control their personal data by allowing them to request its deletion when it is identifiable or could be identified.
The Right to Be Forgotten: Non-absolute nature under the GDPR
However, according to Article 2(2)(d) and Article 2(3) of the GDPR, the regulation excludes the processing of certain personal data from its scope. It does not apply to personal data processing by “competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offenses . . . and the prevention of threats to public security.”
Moreover, the GDPR does not apply to personal data processed by “the Union institutions, bodies, offices and agencies.” Accordingly, this restriction has limited the applicability of the RTBF. Additionally, paragraph (3) of Article 17 has introduced further limitations on the exercise of this right. It is limited when exercising the right of freedom of expression or information is necessary, when meeting legal obligations, when carrying out duties regarding public interests, public health, or when establishing, exercising, or defending legal claims.
Therefore, the RTBF is not an unconditional entitlement under the GDPR. Specifically, the right’s applicability depends on whether the GDPR applies.
The Right to be Forgotten under the ECHR
The RTBF is also grounded in Article 8 of the European Convention on Human Rights (ECHR). According to the ECHR, there is a negative obligation on any public authority to refrain from unjustified interference when an individual exercises their right to privacy. Consequently, this negative obligation has supported the development of the RTBF, as no public authority can prevent any individual from exercising this right when it concerns his private and family life without a legally justified reason.
However, Article 8(2) of the ECHR also acknowledges limits to the right. It permits interference with the right to respect for private and family life, where such interference is in accordance with the conditions set out in that provision. For example, interference may be justified on grounds of national security or public safety where the requirements of Article 8(2) are met. Accordingly, the RTBF may be restricted or limited where its exercise conflicts with legitimate public interests, such as national security.
The European Commission’s proposed amendments
Recently, the European Commission proposed amendments to simplify compliance for smaller companies and clarify how the GDPR applies to emerging technologies, such as AI. Although they aim to benefit the European economy, the proposed amendments seem to have had a profoundly negative effect on the RTBF for European Union and European Economic Area residents where the GDPR applies.
The first proposed amendment limits the definition of personal data in Article 4 of the GDPR. Under this amendment, personal data will be defined on a subjective basis instead of an objective one. This allows data used for AI training to escape actual erasure. For example, suppose an entity A has data about an individual that is not categorized as personal data, such as anonymized data. In that case, it can transfer this data to another entity, B, which uses an AI system that identifies this individual. Now the data would be reclassified as personal data only for entity B. According to the subjective base, the data would be classified as personal data only by the controller who holds it. Therefore, under this amendment, if the individual requests to exercise their RTBF, it could be subject to erasure only from entity B upon the individual’s request. But when this data is erased, entity A can simultaneously provide entity B with the same data again, since it is not considered personal data for entity A, and the RTBF becomes as if the data had never been requested to be erased from entity B.
Another effect of limiting the definition of personal data is that it may lead to the classification of data as non-personal data despite its potential to be used to identify individuals when it is linked to other data. Since AI can help connect different datasets, large amounts of information, which would be deemed non-personal under the new amendments, could be used to identify individuals. This data would have been considered personal data under the old amendments. This “non-personal data” will not be erased if the RTBF was requested.
The second proposed amendment narrows the scope of sensitive data in Article 9 of the GDPR by limiting its definition to directly revealed data only, rather than including both directly revealed and inferred data. Using AI to process personal data can lead to the deduction of sensitive personal data from ordinary personal data. Since the data is evaluated under the subjective standard discussed above, the RTBF would not ensure that sensitive personal data deduced by AI would be permanently deleted.
The third proposed amendment, adding Article 88(c) to the GDPR, will expand the use of the “legitimate interest” concept in Article 6(1)(f) by allowing entities to process vast amounts of personal data to train AI systems. Roughly speaking, the entity is the one that determines its legitimate interest under the GDPR requirements by establishing the purpose and the need to process the personal data of an individual with whom there is a relevant relationship. Moreover, it should be necessary for its purpose and must not override an individual’s fundamental rights. However, it is a very broad concept. Sometimes it is used as a loophole to collect personal data when it is hard to obtain prior consent. Further, it could be used by an entity to retain personal data after exercising the RTBF.
Consequently, if the previous proposed amendment is adopted, it will give the entity a stronger legal basis to collect and process vast amounts of personal data of individuals, even if those individuals have never interacted with the entity. Moreover, the entity may continue processing personal data even if the individual has requested to exercise their RTBF. Additionally, this will provide a more robust legal basis for retaining personal data than currently exists.
Conclusion
Recently, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) issued a joint opinion 2/2026 on the proposed amendments to the Digital Omnibus. The opinion concluded that the proposed amendments narrow the definition of personal data, which may weaken the exercise of fundamental rights of data protection and the material scope of the GDPR. This opinion argues that these amendments concerning personal data will undermine individuals’ rights. The proposed amendments to the GDPR significantly impact the implementation of the RTBF, rendering it largely ineffective.
While one could argue that the current limits to the RTBF are in place to protect other interests or national security, the proposed amendments weaken the GDPR’s objectives of giving individuals control over their personal data. These amendments sacrifice crucial rights of EU residents in favour of providing advantages to AI companies, apparently to boost the European economy. This raises a crucial question regarding the extent to which the European legislator could limit a fundamental right in proportion to economic and technological objectives.