data subject rights

**Data subject rights** are the legal rights granted to individuals under **GDPR** (and similar regulations) regarding the personal data that organizations collect and process about them. For AI and ML systems, these rights create specific technical challenges that must be addressed in system design. **Key Rights Under GDPR** - **Right of Access (Article 15)**: Individuals can request a copy of all personal data an organization holds about them, including data used for model training. Organizations must respond within **30 days**. - **Right to Rectification (Article 16)**: Individuals can request correction of inaccurate personal data. If corrected data was used to train a model, this may require model updates. - **Right to Erasure / "Right to be Forgotten" (Article 17)**: Individuals can request deletion of their personal data. This is the most challenging right for ML — it may require **machine unlearning** or model retraining to remove an individual's influence. - **Right to Restrict Processing (Article 18)**: Individuals can request that their data not be processed, even if not deleted. - **Right to Data Portability (Article 20)**: Individuals can request their data in a **machine-readable format** and transfer it to another controller. - **Right to Object (Article 21)**: Individuals can object to processing based on legitimate interest, including processing for model training. - **Right Not to Be Subject to Automated Decisions (Article 22)**: Individuals can object to decisions made **solely by automated means** (including AI/ML) that significantly affect them. **Technical Challenges for AI** - **Data Discovery**: Finding all instances of a person's data across training sets, embeddings, vector databases, and derived datasets. - **Machine Unlearning**: Removing a person's data influence from a trained model without full retraining — an active research area. - **Explainability**: Providing meaningful explanations of automated decisions made by complex ML models. - **Provenance Tracking**: Maintaining records of which data was used to train which models. **Compliance Implementation** - **Data Inventory**: Maintain comprehensive records of all personal data processing activities. - **Automated Workflows**: Build systems for handling data subject requests at scale. - **Retention Policies**: Define and enforce how long personal data is retained in datasets and models. Data subject rights are **legally enforceable** — organizations face significant penalties for non-compliance and must design AI systems with these rights in mind from the start.