privacy policy makers

Abstract: This inaugural keynote lecture surveys the state of the art of the right to be forgotten and examines how it is being transformed by artificial intelligence. Drawing on cognitive science, philosophy and the social sciences, it treats forgetting as a constitutive function of memory, and recalls that remembering the past and imagining the future share the same mechanism. It then reviews the origins, the European and national case law, and the paradoxes of the right, and offers a periodisation of the specialised literature between 2009 and 2026. The core claim is that digital memory has moved through three regimes, archive, search engine and generative model, and that the right was designed for the first two. In the third, personal information is no longer stored as a locatable record but inferred and regenerated. Artificial intelligence prefigures the frameworks of individual and collective remembering. The right to be forgotten thus ceases to be merely an individual ex post remedy and becomes a property to be designed and governed within legal and ethical ecosystems along the artificial intelligence value chain.

Abstract: As large language models (LLMs) continue to grow in scope and capability, privacy concerns are on the rise. Since users increasingly interact with a single general-purpose system across many distinct contexts, there is a natural tendency to pursue a one-size-fits-all solution to privacy. Unfortunately, this overlooks a crucial insight from decades of privacy research: privacy is inherently contextual. In this paper, we argue that existing work in prompt privacy is drifting towards attempts to design a unified framework, which is highly misleading and can foster a false sense of security. Furthermore, we argue that even future work in this direction needs to wrestle with fundamental tensions across various desirable properties of prompt privacy. Thus, such continued attempts towards a unified framework need to be reconsidered. We recommend three critical paths forward: application-specific deployment of LLMs, context-specific evaluation of privacy frameworks, and better privacy literacy.

Abstract: The infamous privacy paradox refers to the apparent inconsistency between people's stated concern for privacy and their readiness to disclose personal information. This phenomenon has sparked two largely disconnected literatures: one offering experimental evidence of inconsistent behavior, and another providing qualitative accounts and defending the importance of privacy. The Article presents an online field experiment that bridges those literatures and shows that the so-called paradox arises from a mischaracterization of the underlying behavior. The Article finds that it is structural uncertainty about risk that drives seemingly paradoxical privacy decisions. It does so by isolating discounting mechanisms and empirically testing whether observed privacy choices reflect temptation or rational responses to uncertainty. The results suggest that privacy behavior is not paradoxical but, rather, consistent with choices shaped by incomplete information. The Article then discusses the policy implications of this reframing. As privacy decisions stem from structural uncertainty, which operates as a market failure, regulation should aim to reduce that uncertainty. This supports regulation that prioritizes transparency (for people to assess the risks of data collection) and flexibility mechanisms that accommodate evolving contexts. Such reframing provides a new argument for the right to be forgotten, which allows people to revisit prior disclosures as new risks become apparent. By shifting the focus from individual inconsistency to structural uncertainty, the findings call for privacy law to better reflect the reality of people's decision-making environments.