The cost of forgetting

Forgetting is usually framed as mercy. The right to be forgotten, the discipline of data minimization, the instinct to keep only what you need and discard the rest — these are protective reflexes, and they are right to be protective. Data that is never collected cannot be leaked, sold, subpoenaed, or turned against the person it describes. There is a real and hard-won wisdom in the principle that the safest record is the one that does not exist. But forgetting has a second face, and it is the one nobody puts on the brochure: the same deletion that shields a person can also erase the only thing that would have let that person hold a decision to account.

The two goods are in genuine tension, and it is worth saying so plainly because the tension is so often denied. On one side is the right to be forgotten — the claim a person has over their own data, the entitlement to have it minimized, expired, and ultimately destroyed. On the other is the right to an account — the claim a person has, when a consequential decision is made about them, to know what it rested on and to be able to contest it. These rights do not merely coexist uneasily; at the level of the record they pull in opposite directions. The account is made of exactly the material the deletion is meant to remove. To honor one fully and reflexively is to weaken the other.

Picture the sequence that makes this concrete. A decision is made about a person, drawing on a body of evidence. The decision goes against them. They want to contest it, which means they need to see what it was built on — the sources, in the form and order they were actually consulted. But by the time they ask, a retention policy has done its work, and the evidence is gone. Not hidden, not withheld, not lost to malice. Deleted, on schedule, in the name of their own protection. The mechanism designed to safeguard them has quietly disarmed them. They have a right to an account and nothing left to account from.

You cannot contest what no longer exists. A record deleted for the subject's protection can leave the subject with nothing to defend.

Provenance is the thing deletion takes first

What deletion destroys is not merely data; it is provenance. Where a piece of evidence came from, when it was captured, what state it was in at the moment a decision relied on it — this is the connective tissue that lets a conclusion be defended rather than merely asserted. A decision built on evidence whose origin can no longer be established cannot be stood behind, even if the decision happened to be correct. And provenance is precisely the most fragile part of a record under a deletion regime, because it is metadata, the supporting apparatus, the part nobody thinks to preserve when the instruction is to keep only what is necessary. The substance may survive in summary while the provenance — the thing that would make the substance contestable — is the first casualty.

This is why the naïve resolutions both fail. Keep nothing is appealing because it is clean and defensible and reduces exposure to near zero, but it forecloses accountability by construction: a decision whose basis has been erased can never be examined, which means it can never be shown to be wrong, which means it has effectively been placed beyond challenge. Keep everything is appealing because it preserves the record perfectly, but it does so by perpetuating exactly the standing risk that minimization exists to address, and it converts every retained decision into an indefinite liability sitting on the books. Each default sacrifices one right wholesale to protect the other. Neither is a resolution; each is a surrender dressed as a policy.

The decision no one should make by accident

What I want to insist on is narrower than a solution and, I think, more important. It is that the trade-off is a decision, and it should be made on purpose. In most systems it is not. It is made by default — by whatever retention setting shipped, by whatever the storage cost happened to favor, by a policy written for a different purpose and never reconsidered in light of accountability. The result is that the most consequential question about a record — whether it will still exist when someone needs to contest it — gets answered by inertia. A person's ability to challenge a decision that shaped their life turns out to have been settled, invisibly, by a default no one chose with that consequence in mind.

Made deliberately, the trade-off has more texture than the binary suggests. Not all of a record carries the same weight on either side. The raw evidence about a person and the proof that the decision followed from that evidence are different objects with different lifespans and different risks. There is room — not always, but more often than the keep-nothing-or-everything framing admits — to retain what makes a decision contestable while letting go of what merely makes a person exposed. To preserve, for a defined and bounded window, enough of the basis that a challenge remains possible, and to bind that preservation to the contestability it serves rather than letting it sprawl into permanent accumulation. The point is not that this is easy. The point is that it is a design question with real options, and treating it as one is the whole of what I am asking.

A record that can outlive the moment it is needed is a hazard. A record that cannot survive long enough to be contested is a different hazard, and a quieter one, because its failure is invisible until the day someone reaches for the account and finds it gone. Between those two failures lies a choice that deserves to be made with open eyes — by someone who has weighed what is protected against what is erased, and who can say what was kept, for how long, and why. The right to be forgotten and the right to an account are both real. What no one should be allowed to do is resolve the conflict between them by accident, and then call the silence that follows either privacy or accountability. It is neither. It is just a decision nobody admitted to making.

— Dispatches · Summit Cognitive