Forgetting

The immutability of the Blockchain can become a problem for applications that wish to comply with privacy regulations such as the GDPR Right to be Forgotten. Most applications must allow for the complete erasure of personal information and of course, data owners may require at any time that data be removed from third-party servers. ProvenDB complies with these requirements by implementing a Forget command.

The forget command removes all non-primary key information from documents matching a filter condition but leaves the document hash and other metadata intact. The Merkle trees that prove the database versions containing forgotten documents remain valid.

The hash value cannot be used to retrieve any personal information. However, users of ProvenDB should be aware that we must maintain the document primary key (the MongoDB “_id” attribute) to build a Merkle tree. You should not store personally identifiable information within the primary key if you wish to be fully compliant with GDPR Right to be Forgotten.


What’s Next