ETHICAL CHALLENGES OF THE RIGHT TO BE FORGOTTEN IN BLOCKCHAIN SYSTEMS: A SYSTEMATIC REVIEW

Öz

The General Data Protection Regulation (GDPR) defines the Right to Be Forgotten (RTBF) as the right of individuals to request the deletion of their personal data under certain conditions. While this right reflects key ethical principles such as autonomy and control over personal information, its implementation poses significant challenges in blockchain systems, where immutability is a core design feature. This tension creates ethical, technical, and governance-related concerns. This study systematically reviews the academic literature on the relationship between RTBF and blockchain technologies, with a particular focus on ethical issues. Following the PRISMA 2020 guidelines for Systematic Reviews and Meta-Analyses, a comprehensive literature search conducted on January 3, 2026 resulted in the inclusion of 46 peer-reviewed studies. The selected studies were analyzed based on four research questions addressing: (1) the conceptualization of RTBF, (2) ethical conflicts arising from blockchain immutability, (3) proposed technical and governance-oriented solutions, and (4) existing limitations and research gaps. The findings indicate that RTBF is predominantly interpreted as a legal obligation rather than an ethical principle. The most frequently identified ethical challenge concerns the conflict between immutable ledgers and data deletion requirements. Proposed mitigation strategies include privacy-by-design approaches, off-chain data storage, hash-based referencing, and redactable blockchain mechanisms. However, significant challenges remain, including legal uncertainty, scalability and interoperability limitations, and unclear governance responsibilities. Overall, this review provides a structured synthesis of existing research, contributing to a deeper ethical understanding of RTBF in blockchain systems and offering insights for future research, system design, and regulatory policymaking.

Anahtar Kelimeler

• Blockchain Technologies;
• Right to Be Forgotten (RTBF)
• General Data Protection Regulation (GDPR)
• Ethical Challenges
• Data Erasure

BLOKZİNCİR SİSTEMLERİNDE UNUTULMA HAKKININ ETİK ZORLUKLARI: SİSTEMATİK BİR DERLEME

Öz

Genel Veri Koruma Tüzüğü (GVKT), Unutulma Hakkı’nı (UH), bireylerin belirli koşullar altında kişisel verilerinin silinmesini talep etme hakkı olarak tanımlar. Bu hak, bireysel özerklik ve kişisel bilgi üzerinde kontrol gibi temel etik ilkeleri yansıtsa da uygulanması blokzincir sistemlerinde önemli zorluklar doğurmaktadır; çünkü değiştirilemezlik bu sistemlerin temel bir tasarım özelliğidir. Bu durum, etik, teknik ve yönetişimle ilgili gerilimler yaratmaktadır. Bu çalışma, UH ile blokzincir teknolojileri arasındaki ilişkiyi inceleyen akademik literatürü, özellikle etik meseleler bağlamında sistematik olarak gözden geçirmektedir. PRISMA 2020 Sistematik İnceleme ve Meta-Analiz yönergeleri izlenerek, 3 Ocak 2026 tarihinde gerçekleştirilen kapsamlı literatür taraması sonucunda 46 hakemli çalışma analize dahil edilmiştir. Seçilen çalışmalar dört araştırma sorusu çerçevesinde incelenmiştir: (1) UH’nin kavramsallaştırılması, (2) blokzincir değiştirilemezliğinden kaynaklanan etik çatışmalar, (3) önerilen çözümler ve (4) mevcut sınırlılıklar ve araştırma boşlukları. Bulgular, UH’nin çoğunlukla etik bir ilke olmaktan ziyade hukuki bir yükümlülük olarak yorumlandığını göstermektedir. En sık vurgulanan etik sorun, değiştirilemez kayıt yapıları ile veri silme gereklilikleri arasındaki çatışmadır. Önerilen çözüm yaklaşımları arasında gizlilik-odaklı tasarım, zincir dışı veri depolama, hash tabanlı referanslama ve düzenlenebilir blokzincir mekanizmaları yer almaktadır. Ancak hukuki belirsizlikler, ölçeklenebilirlik ve birlikte çalışabilirlik sorunları ile yönetişim sorumluluklarının net olmaması gibi önemli zorluklar devam etmektedir. Genel olarak bu inceleme, blokzincir sistemlerinde UH’nin etik boyutuna dair mevcut araştırmaları yapılandırılmış bir şekilde sentezleyerek, gelecekteki araştırmalar, sistem tasarımı ve düzenleyici politika geliştirme süreçleri için önemli çıkarımlar sunmaktadır.

Anahtar Kelimeler

• Blokzincir Teknolojileri
• Unutulma Hakkı (UH)
• Genel Veri Koruma Tüzüğü (GVKT)
• Etik Zorluklar
• Veri Silme

Kaynakça

1. Ahmad, H., & Aujla, G. S. (2023). GDPR compliance verification through a user-centric blockchain approach in multi-cloud environment. Computers and Electrical Engineering, 109, 108747. https://doi.org/10.1016/J.COMPELECENG.2023.108747
2. Alessi, M., Camillò, A., Giangreco, E., Matera, M., Pino, S., & Storelli, D. (2019). A decentralized personal data store based on Ethereum: towards GDPR compliance. Journal of Communications Software and Systems, 15(2), 79–88. https://doi.org/10.24138/JCOMSS.V15I2.696
3. Alfaidi, A., & Chow, E. (2020). Health Record Chain (HRC): Implementation of mobile healthcare system using blockchain to enhance privacy of electronic health record EHR. Proceedings - 2020 International Conference on Computational Science and Computational Intelligence, CSCI 2020, 863–866. https://doi.org/10.1109/CSCI51800.2020.00161
4. Alfaidi, A., & Semwal, S. (2022). The right to be forgotten: privacy and security in blockchain with multi-authority based chameleon hash function MAP-ABCH solution. Lecture Notes in Networks and Systems, 438 LNNS, 861–876. https://doi.org/10.1007/978-3-030-98012-2_60/FIGURES/6
5. Angón, O. C. (2024). General data protection regulation, right to be forgotten, blockchain technology and human rights. The Age of Human Rights Journal, 23(23), e8702–e8702. https://doi.org/10.17561/TAHRJ.V23.8702
6. Anido-Rifón, L., von-Eitzen-Delgado, C., Ruiz Molina, M., Molina Martínez, P., Álvarez González, S., Rodríguez Vázquez, V., Fernández-Iglesias, M. J., Mikic Fonte, F., & Llamas Nistal, M. (2025). balancing data protection and decentralization: harnessing blockchain’s potential while ensuring GDPR compliance. Lecture Notes in Networks and Systems, 1256 LNNS, 393–402. https://doi.org/10.1007/978-3-031-81928-5_38
7. Ateniese, G., Magri, B., Venturi, D., & Andrade, E. R. (2017). Redactable Blockchain - Or - rewriting history in bitcoin and friends. Proceedings - 2nd IEEE European Symposium on Security and Privacy, EuroS and P 2017, 111–126. https://doi.org/10.1109/EUROSP.2017.37
8. Balistri, E., Casellato, F., Giannelli, C., & Stefanelli, C. (2021). BlockHealth: Blockchain-based secure and peer-to-peer health information sharing with data protection and right to be forgotten. ICT Express, 7(3), 308–315. https://doi.org/10.1016/J.ICTE.2021.08.006

9. Barati, M., Aujla, G. S., Llanos, J. T., Duodu, K. A., Rana, O. F., Carr, M., & Ranjan, R. (2022). Privacy-aware cloud auditing for GDPR compliance verification in online healthcare. IEEE Transactions on Industrial Informatics, 18(7), 4808–4819. https://doi.org/10.1109/TII.2021.3100152
10. Barati, M., & Rana, O. (2021). Checking GDPR compliance for cloud-based services. Proceedings - 2021 IEEE World Congress on Services, SERVICES 2021, 2. https://doi.org/10.1109/SERVICES51467.2021.00013
11. Barati, M., & Rana, O. (2022). Tracking GDPR compliance in cloud-based service delivery. IEEE Transactions on Services Computing, 15(3), 1498–1511. https://doi.org/10.1109/TSC.2020.2999559
12. Barati, M., Rana, O., Petri, I., & Theodorakopoulos, G. (2020). GDPR compliance verification in internet of things. IEEE Access, 8, 119697–119709. https://doi.org/10.1109/ACCESS.2020.3005509
13. Barati, M., Rana, O., Theodorakopoulos, G., & Burnap, P. (2019). Privacy-aware cloud ecosystems and GDPR compliance. Proceedings - 2019 International Conference on Future Internet of Things and Cloud, FiCloud 2019, 117–124. https://doi.org/10.1109/FICLOUD.2019.00024
14. Bayle, A., Koscina, M., Manset, D., & Perez-Kempner, O. (2018). When blockchain meets the right to be forgotten: technology versus law in the healthcare industry. 2018 IEEE/WIC/ACM International Conference on Web Intelligence (WI), 788–792. https://doi.org/10.1109/WI.2018.00133
15. Biswas, S., Chakraborty, S., & Chakraborty, R. S. (2025). Redacting without regret: a dual-layer framework for policy-compliant blockchains. 2025 7th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS), 1–9. https://doi.org/10.1109/BRAINS67003.2025.11302930
16. Botta, V., Iovino, V., & Visconti, I. (2022). Towards data redaction in bitcoin. IEEE Transactions on Network and Service Management, 19(4), 3872–3883. https://doi.org/10.1109/TNSM.2022.3214279
17. Calani, M., Denaro, G., & Leporati, A. (2024). Exploiting the blockchain to guarantee GDPR compliance while consents evolve under data owners’ control. CEUR WORKSHOP PROCEEDINGS, 2940, 331–343. https://boa.unimib.it/handle/10281/328337
18. Eiza, M. H., Ta, V. T., Shi, Q., & Cao, Y. (2024). Secure semi-automated GDPR compliance service with restrictive fine-grained access control. Security and Privacy, 7(6), e451. https://doi.org/10.1002/SPY2.451
19. Everything you need to know about the “Right to be forgotten” - GDPR.eu. (2026, January 4). https://gdpr.eu/right-to-be-forgotten/
20. Fugkeaw, S., Sungchai, S., Nakprame, S., & Sreekongpan, P. (2025). Enabling secure and scalable GDPR-compliant blockchain-based e-KYC with efficient redaction. IEEE Access, 13, 136834–136853. https://doi.org/10.1109/ACCESS.2025.3594656
21. Gan, W., Zhao, M., Guo, H., Zhang, C., Hong, J., & Zhu, L. (2023). Fine-grained data rights governance in blockchain-based cloud-edge communications. Proceedings - IEEE Global Communications Conference, GLOBECOM, 904–909. https://doi.org/10.1109/GLOBECOM54140.2023.10436817
22. Ghaly, P., Gjermundrød, H., & Dionysiou, I. (2025). Privacy-preserving “Right to Be Forgotten” in configurable blockchain tokenization: a cryptographic audit framework. 2025 7th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS), 1–8. https://doi.org/10.1109/BRAINS67003.2025.11302955
23. Giordano, M. T. (2021). Blockchain and the GDPR: New challenges for privacy and security. In Blockchain, Law and Governance (pp. 275–286). Springer, Cham. https://doi.org/10.1007/978-3-030-52722-8_20
24. Guo, H., Chen, L., Ren, X., Zhao, M., Li, C., Xue, J., Zhu, L., & Zhang, C. (2024). Privacy-preserving and revocable redactable blockchains with expressive policies in IoT. IEEE Internet of Things Journal, 11(21), 35390–35404. https://doi.org/10.1109/JIOT.2024.3435729
25. Gutierrez-Aguero, I., Anguita, S., Larrucea, X., Gomez-Goiri, A., & Urquizu, B. (2021). Burnable pseudo-identity: a non-binding anonymous identity method for Ethereum. IEEE Access, 9, 108912–108923. https://doi.org/10.1109/ACCESS.2021.3101302
26. Hou, Y., Zou, J., Wang, L., Lu, X., Lu, X., & Wang, M. (2025). PRBCP: Publicly redactable blockchain with off-chain reputation-based consensus protocol. IEEE Transactions on Network and Service Management, 22(5), 4603–4618. https://doi.org/10.1109/TNSM.2025.3578659
27. Islam, M. R., Alam, K. M. R., & Manik, M. M. H. (2024). Decentralized GDPR compliance: a blockchain framework for personal data management. 2024 27th International Conference on Computer and Information Technology, ICCIT 2024 - Proceedings, 3063–3068. https://doi.org/10.1109/ICCIT64611.2024.11022541
28. Krupa-Lipińska, K., & Wulff, C. M. (2021). The Right to be Forgotten in Post-Google Spain case law: an example of legal interpretivism in action? Comparative Law Review, 26(0), 255–279. https://doi.org/10.12775/CLR.2020.010
29. Kuperberg, M. (2020). Towards enabling deletion in append-only blockchains to support data growth management and GDPR compliance. Proceedings - 2020 IEEE International Conference on Blockchain, Blockchain 2020, 393–400. https://doi.org/10.1109/BLOCKCHAIN50366.2020.00057
30. Larraia, E., Kiraz, M. S., & Vaughan, O. (2024). How to redact the bitcoin backbone protocol. 2024 IEEE International Conference on Blockchain and Cryptocurrency, ICBC 2024, 485–493. https://doi.org/10.1109/ICBC59979.2024.10634365
31. Lee, N. Y., Yang, J., Onik, M. M. H., & Kim, C. S. (2019). Modifiable public blockchains using truncated hashing and sidechains. IEEE Access, 7, 173571–173582. https://doi.org/10.1109/ACCESS.2019.2956628
32. Lee, W. S., John, A., Hsu, H. C., & Hsiung, P. A. (2022). SPChain: a smart and private blockchain-enabled framework for combining GDPR-compliant digital assets management with AI models. IEEE Access, 10, 130424–130443. https://doi.org/10.1109/ACCESS.2022.3227969
33. Li, X., Xu, J., Yin, L., Lu, Y., Tang, Q., & Zhang, Z. (2023). Escaping from consensus: instantly redactable blockchain protocols in permissionless setting. IEEE Transactions on Dependable and Secure Computing, 20(5), 3699–3715. https://doi.org/10.1109/TDSC.2022.3212601
34. Liagkou, V., Stefanidis, K., Isazade, A., Malik, A., & Alshawki, M. B. (2025). Blockchain-enabled GDPR compliance enforcement for IIoT data access. Journal of Cybersecurity and Privacy 2025, Vol. 5, Page 84, 5(4), 84. https://doi.org/10.3390/JCP5040084
35. Mahindrakar, A., & Joshi, K. P. (2020). Automating GDPR compliance using policy integrated blockchain. Proceedings - 2020 IEEE 6th Intl Conference on Big Data Security on Cloud, BigDataSecurity 2020, 2020 IEEE Intl Conference on High Performance and Smart Computing, HPSC 2020 and 2020 IEEE Intl Conference on Intelligent Data and Security, IDS 2020, 86–93. https://doi.org/10.1109/BIGDATASECURITY-HPSC-IDS49724.2020.00026
36. Mahmood, Z., & Vacius, J. (2020). Privacy-preserving block-chain framework based on ring signatures (RSs) and Zero-Knowledge Proofs(ZKPs). 2020 International Conference on Innovation and Intelligence for Informatics, Computing and Technologies, 3ICT 2020. https://doi.org/10.1109/3ICT51146.2020.9312014
37. Metin, B., Erkan, S., Atasu, İ., & Yılmaz, E. (2019). Privacy impact assessment as a tool for GDPR compliance preparation. Kişisel Verileri Koruma Dergisi, 1(2), 75–86. https://dergipark.org.tr/en/pub/kvkd/article/646782
38. Mone, V., & Sivakumar, C. (2022). An analysis of the GDPR compliance issues posed by new emerging technologies. Legal Information Management, 22(3), 166–174. https://doi.org/10.1017/S1472669622000317
39. Mukkamala, R., Olariu, S., & Kalari, S. (2025). MerkleChain: a privacy-enhanced and flexible merkle-tree-based blockchain architecture. 90–97. https://doi.org/10.1109/BCCA66705.2025.11227179
40. Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E. A., Brennan, S. E., Chou, R., Glanville, J., Grimshaw, J. M., Hróbjartsson, A., Lalu, M. M., Li, T., Loder, E. W., Mayo- Wilson, E., McDonald, S., … Moher, D. (2021). The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ, 372. https://doi.org/10.1136/BMJ.N71
41. Parikh, A. M., Sural, S., Atluri, V., & Vaidya, J. (2025). Enabling right to be forgotten in a collaborative environment using permissioned blockchains. Lecture Notes in Computer Science, 15722 LNCS, 156–175. https://doi.org/10.1007/978-3-031-96590-6_9/TABLES/3
42. Piao, Y., Ye, K., & Cui, X. (2021). A data sharing scheme for GDPR-compliance based on consortium blockchain. Future Internet 2021, Vol. 13, Page 217, 13(8), 217. https://doi.org/10.3390/FI13080217
43. Politou, E., Casino, F., Alepis, E., & Patsakis, C. (2021). Blockchain mutability: challenges and proposed solutions. IEEE Transactions on Emerging Topics in Computing, 9(4), 1972–1986. https://doi.org/10.1109/TETC.2019.2949510
44. Saif, M. Bin, & Migliorini, S. (2025). Blockchain-based data immutability and traceability in the era of GDPR. 546–553. https://doi.org/10.1109/BCCA66705.2025.11229677
45. Sarkar, S., Banatre, J. P., Rilling, L., & Morin, C. (2018). Towards enforcement of the EU GDPR: enabling data erasure. Proceedings - IEEE 2018 International Congress on Cybermatics: 2018 IEEE Conferences on Internet of
46. Things, Green Computing and Communications, Cyber, Physical and Social Computing, Smart Data, Blockchain, Computer and Information Technology, IThings/Gre…, 222–229. https://doi.org/10.1109/CYBERMATICS_2018.2018.00067
47. Semwal, S., & Alfaidi, A. (2022). Blockchain graphs (BCGs) to support right-to-be-forgotten “RTBF” in blockchains. Lecture Notes in Networks and Systems, 438 LNNS, 892–905. https://doi.org/10.1007/978-3-030-98012-2_62/FIGURES/6
48. Shirmohammadi, M., Islam, A., & Karimipour, H. (2025). An intent-based networking framework for secure and privacy-compliant machine unlearning using meta-learning and redactable blockchain. IEEE Internet of Things Journal. https://doi.org/10.1109/JIOT.2025.3638966
49. Tasdelen, A. (2024). Fundamentals of blockchain. In Exploring Blockchain Applications: Management Perspectives (pp. 6–25). CRC Press. https://doi.org/10.1201/9781003389552-2
50. Vargas, J. C. (2019). Blockchain-based consent manager for GDPR compliance. 165–170. https://dl.gi.de/handle/20.500.12116/20985
51. Xiao, L., Han, D., Zhou, S., Xu, N., Chen, L., & Xie, S. (2023). A Blockchain-empowered federated learning framework supprting GDPR-compliance. Proceedings - 2023 IEEE 10th International Conference on Cyber Security and Cloud Computing and 2023 IEEE 9th International Conference on Edge Computing and Scalable Cloud, CSCloud-EdgeCom 2023, 399–404. https://doi.org/10.1109/CSCLOUD-EDGECOM58631.2023.00074
52. Xu, S., Ning, J., Li, X., Yuan, J., Huang, X., & Deng, R. H. (2024). A privacy-preserving and redactable healthcare blockchain system. IEEE Transactions on Services Computing, 17(2), 364–377. https://doi.org/10.1109/TSC.2024.3356595
53. Xu, S., Ning, J., Ma, J., Huang, X., & Deng, R. H. (2021). K-Time modifiable and epoch-based redactable blockchain. IEEE Transactions on Information Forensics and Security, 16, 4507–4520. https://doi.org/10.1109/TIFS.2021.3107146
54. Zhang, D., Le, J., Lei, X., Xiang, T., & Liao, X. (2024). Secure redactable blockchain with dynamic support. IEEE Transactions on Dependable and Secure Computing, 21(2), 717–731. https://doi.org/10.1109/TDSC.2023.3261343
55. Zhuk, A. (2025). Beyond the blockchain hype: addressing legal and regulatory challenges. SN Social Sciences 2025 5:2, 5(2), 11-. https://doi.org/10.1007/S43545-024-01044-Y