Erase deleted personal data from document history

How to do it

Many CRDT libraries keep past versions so that offline copies can still merge. Automerge keeps the full history, and Yjs keeps deleted text when garbage collection is off for version history. Build a new document from the current content alone, replace the stored copy and raise the document's epoch number. The server then refuses changes based on an older epoch, so an old offline copy cannot bring the data back, and those clients reload. Account deletion follows Let people delete their account themselves, and backups follow Erase retired databases and every copy.

Examples

TypeScript example

export async function eraseHistory(documentId: string) {
  const { doc: old, epoch } = await documents.load(documentId);
  const fresh = new Y.Doc();
  fresh.getText('body').insert(0, old.getText('body').toString());
  await documents.replace(documentId, Y.encodeStateAsUpdate(fresh), { epoch: epoch + 1 });
  broadcast(documentId, { type: 'reload' });
}

Python example

def erase_history(document_id: str) -> None:
    old = documents.load(document_id)
    fresh = Doc()
    fresh["body"] = Text(str(old.doc.get("body", type=Text)))
    documents.replace(document_id, fresh.get_update(), epoch=old.epoch + 1)
    broadcast(document_id, {"type": "reload"})

How to check

A test writes a name, deletes it and runs the erasure. The stored bytes of the document no longer contain the name. A client holding the old copy reconnects, its changes are refused and it reloads.

Sources

• GDPR, Regulation (EU) 2016/679, Article 17

Related rules

• ACC-56 Let people delete their account themselves in Accounts and identity
• DAT-35 Erase retired databases and every copy in Data and databases