Implementing GDPR in Social Networks: A Trust and Context-Driven Approach

TL;DR

Enforcing GDPR's "right to be forgotten" in Social Networks is a nightmare due to the interconnected nature of posts, likes, and comments. This paper introduces a Trust-based Model that uses context-aware screening and hierarchical usage agreements to manage data dispersion and ensure that when a root post is deleted, its entire "shadow" of derivative data follows suit, all while maintaining system efficiency.

The Core Conflict: Public Nature vs. Private Rights

Since the enforcement of GDPR in 2018, Online Social Networks (OSNs) have faced a structural paradox. The regulation demands strict data ownership and the right to erasure, yet OSN data is inherently "non-atomic." When you comment on a friend's photo, who owns that data? If you delete your account, does the comment remain because it's on their wall, or does it vanish?

The authors argue that prior works fail because they don't account for Context (you might trust a friend with political discourse but not with financial advice) and Flow (how data leaks beyond direct connections).

Methodology: The Three-Phase Trust Model

The proposed solution refines the authors' previous work by adding a layer of context evaluation to bridge the gap between abstract regulation and technical implementation.

1. Contextual Trust Scoring

Instead of a global trust score, every edge in the social graph is assigned a User Trust Value (UTV) based on categories ($\kappa$).

• Mechanism: A user only accesses a data instance if their $UT{V}_{\kappa }\ge MT{V}_{\kappa }$ (Minimum Trust Value for that category).
• Logic: This prevents "leakage" by ensuring data only flows to users who have demonstrated reliability within that specific topical domain.

2. Hierarchical Usage Agreements

To solve the ownership dilemma, the paper introduces a "Chain of Ownership":

• Primary Ownership: Established during the initial post (e.g., tagging multiple people).
• Usage Agreements: Before Alice comments on Bob’s post, she must agree that her comment is a derivative work. If Bob (the root) deletes the post, Alice’s comment is automatically purged. This creates a legally and technically sound path for the "right to be forgotten."

Experimental Validation

The authors validated their approach through two lenses: user social intuition and algorithmic efficiency.

Efficiency in Data Erasure

One of the biggest hurdles for GDPR is the sheer volume of data. By applying the Context Phase, the model filters the network to find only "Active and Trustworthy" users for a specific topic.

• Impact: In a network of nearly 1,000 users, the system only needed to monitor and potentially erase data from ~36 relevant users. This represents a massive reduction in search complexity for OSN providers.

User Acceptance

The study found that users with high "connection closeness" were significantly more likely to accept joint ownership and consent forms. This suggests that a trust-based model aligns well with human social psychology: we are already comfortable with shared data responsibility among close friends.

Critical Insight & Conclusion

This work moves beyond simple "Access Control" (who can see what) and enters the realm of "Flow and Lifecycle Control" (how data lives and dies). By introducing hierarchical usage agreements, the authors provide a scalable blueprint for OSNs to handle complex data chains.

Limitations: The model relies on accurate automated categorization of posts (Context) and assumes users will be willing to click through consent pop-ups—a behavior that often leads to "consent fatigue." Future implementations may need to look at automating these agreements based on pre-set user trust profiles.