The Data Is Still There. You Just Lost the Key.

A TikTok landed in my feed today (yes, I watch TikTok, I know) confidently explaining GDPR's right to erasure in the mostly-correct register that TikTok reserves for legal questions. The video's practical suggestion for engineers stuck with the impossible task of purging one customer's data out of every backup, snapshot, replica, and archive tape was cryptographic erasure. Encrypt each customer's data with its own key. When they ask to be forgotten, destroy the key instead of hunting for their rows through petabytes of cold storage. Simple. Elegant. Apparently good enough for GDPR.

Three weeks ago, before my Europe trip and from a completely different angle, I drafted but never posted an article about the Samuel Tunick's legal troubles and your data at the US border. For anyone who missed coverage of this case: a US citizen was pulled into secondary inspection at Atlanta's airport, was ordered to unlock his phone, and did so with a "duress PIN" that GrapheneOS builds into its Android-hardened builds for precisely this scenario. The duress PIN wipes the encryption keys the moment it is entered, instantly and irreversibly. What Tunick handed over to CBP was, functionally, a brick. Six months later, the DOJ charged him under 18 U.S.C. § 2232 for the destruction of evidence.

For some reason I have not been able to stop thinking about a specific overlap between those two stories. If you don't see the connection yet, don't worry, it's there.

The core weirdness

The TikTok video's advice and the federal prosecutor's theory of the case agree on the substance and disagree only on the response. Both treat destroying an encryption key as equivalent to destroying the underlying data. GDPR (in the TikTok reading) says destroying the key means you have deleted the data, and you are compliant. The DOJ (in the Tunick indictment) says destroying the key means you have destroyed the data, and you are a defendant.

Same premise. Opposite verdicts. Same underlying claim about what actually happens to information when you throw away the key that makes it readable.

Tunick's own defence, incidentally, is arguing the opposite of both. The motion to suppress says nothing was destroyed. The bits are still sitting on the phone's flash chip in the same physical arrangement they held before he typed the PIN. They are just mathematically unreadable. It is, in the analogy his lawyers are effectively drawing, like breaking a lock's mechanism so a door can no longer be opened. The door is still there. The room is still there. Everything in the room is still there. All that has been destroyed is the ability to get in.

Three positions. Only one of them can be right, and the answer depends on a question most engineers never sit with long enough: what does deleted actually mean?

GDPR is asking for less than the TikTok video implied

Start with the easier of the two questions, because it is genuinely less demanding than the video suggested. GDPR does not require you to rewrite every tape in your backup vault the moment somebody unsubscribes. The UK's Information Commissioner's Office has been explicit about this: the standard for backup data is that it be "beyond use," even if it cannot be immediately overwritten. In practice that means production systems delete the record right away, the backup rides out its normal retention schedule untouched except for genuine disaster recovery, and everyone is compliant.

Cryptographic erasure looks appealing precisely because it promises to solve a harder problem than regulators are actually asking anyone to solve. It is a reasonable engineering impulse. It also happens to skip past a question no philosopher would let pass so easily.

Four things that all get called "deleted"

For those not familiar with the different ways data can stop being accessible, they are worth pulling apart. There are, at minimum, four:

• Physically destroyed. The sectors no longer exist. The drive has been ground into confetti. Best deletion money can buy.
• Logically deleted. The pointers are gone, but the bytes are still on the disk, and a recovery tool can pull them back until they get overwritten.
• Cryptographically erased. The bits are exactly where they were, but the key that made them meaningful is gone. Under current mathematical assumptions, the data is unreadable.
• Access controlled. The data is fully intact and readable. You simply do not have permission to see it.

These four sit on a spectrum from the information cannot exist to the information exists and someone has chosen not to show it to you. Cryptographic erasure sits much closer to the access-control end of that spectrum than most people assume, and that is the whole problem.

Apple, incidentally, already leans on this distinction on purpose. When you tap "Erase All Content and Settings" on an iPhone, it discards the keys rather than overwriting the flash. Overwriting NAND at scale is slow. Destroying a 256-bit key is instant. Nobody objects to that use. The friction starts when "instant and irreversible under current assumptions" gets treated as identical to "gone," particularly with a federal indictment sitting on the other side of that exact sentence.

The steel-man case for the identity

Before I dismantle it, the argument that cryptographic erasure is deletion deserves to be stated at full strength, because it is genuinely serious.

If a 256-bit AES key is truly destroyed, the remaining ciphertext is statistically indistinguishable from random noise. No known algorithm extracts a customer record from it. From an information-theoretic standpoint, the recoverable information has ceased to exist, because there is nothing left to compute your way back through, only patternless bits. On that reading, cryptographic erasure absolutely qualifies as deletion. Just implemented at the mathematical layer instead of the physical one.

That argument is only as durable as the assumption holding it up. Which is where it gets uncomfortable.

History is not kind to "unbreakable"

DES looked unbreakable in 1977. It was retired as insecure long before anyone had planned for it. SHA-1 held the same reputation right up until researchers at Google and CWI Amsterdam produced a working collision in 2017. RSA-1024 is on its way out for the same reasons. Every cryptographic assumption in history has been an engineering prediction with a shelf life that nobody has ever managed to print on the label.

Security researchers already have a name for the attack this enables at scale: harvest now, decrypt later. Collect encrypted material today on the bet that tomorrow's computer, quantum or otherwise, will make today's ciphertext legible. Nation-state intelligence services are widely believed to already be doing this to global network traffic. There is no obvious reason a stolen backup archive is exempt from the same bet.

Encrypt a backup in 2025. Delete the customer and destroy the key in 2026. In 2038 a practical attack against that cipher shows up, either because a large enough quantum computer finally arrived or because somebody found a cleverer classical approach. The question stops being hypothetical. Did that data ever actually disappear, or was it just waiting for the math to catch up?

Where the engineer and the regulator quietly stop agreeing

This is the part that matters.

To an engineer, recoverable means someone could pull the data back right now with tools that exist today. That is a testable claim. A regulator is asking something fuzzier: whether a reasonable person standing here in 2026 would call this data deleted. That is a judgment, anchored to the present, with no promise attached about 2038.

Compliance gets evaluated at a point in time. Cryptographic confidence rests on assumptions with an unscheduled expiration date. Right now the two standards happen to agree. Nothing guarantees they still will once quantum-capable hardware, or just a smarter classical attack, changes what infeasible means.

Canada gets to watch this argument happen elsewhere first

For now, Canada is a spectator on this specific fight. PIPEDA has never had a GDPR-style right to erasure, only a general obligation to retain and dispose of personal information responsibly. The bill that would have added something closer to it, the Consumer Privacy Protection Act inside Bill C-27, died on the order paper when Parliament prorogued in January 2025. Its promised replacement has not been tabled as of this writing.

When our version does eventually land, it will have to answer the same question the EU and a federal courtroom in Georgia are currently fumbling toward. Whether a destroyed key counts as destroyed data, or just a very good lock with an expiry date nobody has bothered to put on the calendar.

I made a version of this argument once before, about how precise language matters when a system's actual capabilities do not match the words being used to describe them. The lesson generalizes. The gap between we cannot do this right now and this cannot be done is the difference between a regulator approving a data-handling scheme that does not do what it claims, and a defendant in an Atlanta courtroom trying to explain to a jury that a mathematically unreadable hard drive and an erased one are not the same thing. Even though right now, for entirely different reasons, both of them are being treated as if they are.

So what can we do about this?

A couple of specific things, depending on where you sit.

If you are designing or approving a data-handling system that leans on cryptographic erasure as its primary deletion mechanism, do not accept the key is gone as a full answer. Ask what algorithm. Ask what key size. Ask what happens if that algorithm is compromised inside your retention window. Ask what your obligation is to the customer whose data you told them you had deleted, if in 2038 that turns out to have been optimistic. If the answer to any of those is "we will worry about that later," the system has not been designed. It has been deferred.

If you are anywhere near the next version of Canadian privacy law, which will have to arrive eventually now that Bill C-27 is in the ground, this is a specific place where the legislation could be sharper than either GDPR or the current American case law. Say plainly what deleted means. Say whether cryptographic erasure counts. Say under what assumptions, and with what re-verification obligation over time. Do not leave a courtroom in Toronto in 2038 to figure out what the drafters meant.

And if you are a normal person who just wants to know whether the thing your bank or your airline or your ex-girlfriend's dating app told you was "deleted" is actually deleted, the honest answer for a growing number of vendors is right now, probably, yes. Everything past right now is a ¯_(ツ)_/¯ .

If cryptographic erasure counts as deletion because recovery is currently infeasible, what is really on offer is a bet dressed up as a definition. Every bet has a settlement date. This one is on a schedule nobody has been willing to name.

The data on Samuel Tunick's bricked phone and the data in your last decade of encrypted backups are doing the same thing right now. Sitting there. Unreadable. Waiting to find out whether unreadable and gone were ever actually the same word.