The development of artificial intelligence has profoundly reshaped the ways in which personal data are generated, processed, and retained, placing intelligent systems at the heart of debates on privacy and fundamental rights. This article examines, from a European Union legal perspective, the application of the General Data Protection Regulation (GDPR) to AI and assesses whether the principles and rights enshrined in European law—particularly the rights to erasure, to be forgotten, and to rectification—can be effectively exercised once information has been absorbed by machine learning models. The study examines the main legal and technical challenges arising from the nature of AI, which does not store data in a static form but transforms it into knowledge, thereby complicating its localisation, alteration, or deletion. It also analyses the relationship between the GDPR and the Artificial Intelligence Act (AIA), emphasising their complementary roles and the need to ensure coherence between the two regulatory frameworks. From a legal and ethical standpoint, the paper considers phenomena inherent to AI systems—such as hallucinations, algorithmic bias, and neurodata—to illustrate how they challenge essential principles such as accuracy, minimisation, and purpose limitation, and how they test the rights of individuals in contexts where information cannot truly be “forgotten”. Finally, it proposes alternative mechanisms, mitigation strategies, and emerging solutions aimed at preserving individuals’ effective control over their data in the algorithmic age, thereby reinforcing privacy protection and public trust in the responsible use of new technologies.
No takes yet. Share an insight, caveat, or question.
Delgado et al. (2026) studied this question.
Synapse has enriched 5 related papers. Consider them for comparative context: