Making Data Sharing Work in the EU: Why Data Provenance and Machine Unlearning Matter

Without data provenance and machine unlearning, a single unlawful data point can force the invalidation of an entire dataset or AI model, which is a disproportionate outcome that jeopardises the European Data Strategy.

As the EU's Data Act and the European Health Data Space Regulation (EHDS) take effect, data-sharing environments are becoming increasingly complex. Datasets may combine information from multiple sources and actors, raising important questions concering privacy, trade secrets and intellectual property, and the lawful processing of data.

A key challenge arises when a dataset contains unlawfully processed data. Existing legislation provides limited guidance on how such situtations should be addressed in complex, mixed-data environments. Where targeted remedies are unavailable, the consequences may extend beyond the unlawfully processed data itself, potentially leading to the invalidation of entire datasets or AI models and therefore destroying the value of legitimate, lawfully processed data in the process.

This policy brief, written by members of Work Package 2, examines how Data Provenance and Machine Unlearning can enable a more targeted and proportionate response when unlawfully processed data is identified within shared datasets or trained models. Drawing on empirical testing with health data, the authors examine the application of both exact and approximate unlearning methods in complex, mixed-data settings. The findings demonstrate, that together, Data Provenance and Machine Unlearning can help identify the origin and use of specific data and remove the influence of unlawfully processed data from trained models while preserving the utility of legitimate data resources.

Policy Recommendations:

• Promote Provenance-by-design: EU and national regulators should promote provenance-by-design, and require shared datasets to carry standardised metadata on data origin, legal basis, usage restrictions, and transformations.

• Recognise machine unlearning as a compliance mechanism: EU and national regulators should explicitly recognise machine unlearning as a legitimate and proportionate mechanism to comply with data deletion, withdrawal and revocation obligations.

• Support standartisation: The European Commission should prioritise standardisation of provenance frameworks and unlearning mechanisms through targeted funding and coordination with standard-setting bodies to ensure the availability of the necessary technical tools.

• Clarify liability: Legislators should clarify how to allocate liability in complex, mixed-data environments to avoid the use of entire datasets and AI models being invalidated.

• Strengthen technical expertise: Regulatory authorities responsible for monitoring compliance should be equipped with specialised technical expertise to evaluate provenance records and unlearning claims.