Efficacy of GDPR’s Right-to-be-Forgotten on Facebook

Abstract

Online social networks (OSNs) like Facebook witness our online activities either by our consent or by bartering our desire to avail free services. Being a witness, OSNs have access to users’ personal data, their social relationships and a continuous flow of their online interactions from various tracking techniques the OSNs deploy in collaboration with the content providers across the Internet. Users’ behavioral data critical in predicting their interests, which is not only useful in targeting the users with relevant advertisements but also in clustering them into distinct personality traits that are useful in effective persuasion. Realizing the potential privacy implications of such a collection and usage of personally identifiable data and its potential misuse, the European Union has enacted a law, referred to as GDPR, to regulate the way collection and processing of personal data occurs. One of the core tenets of this regulation is the right-to-be-forgotten. In this paper, we analyze the efficacy of this tenet and the challenges when it is invoked by users on online social networks like Facebook. We investigate the reasons behind these challenges and associate their causes to the nature of the communication on social networks in general, the business model of such social platforms, and the design of the platform itself; say for Facebook. In short, in its current form, if the right-to-be-forgotten tenet of GDPR is to be enforced in its spirit, it will jeopardize Facebook’s business model.