Ghosts in the machine: How AI memory breaks privacy law (and what we can do about it)

As artificial intelligence systems evolve—especially those built on large language models or conversational AI—they don't just ingest data; they learn, restructuring themselves in response to exposure. This creates a significant, often underestimated risk: reconstruction of personal or organisational information implicitly memorised by the model. Even when data is seemingly anonymised, masked, or deleted, the downstream effects persist, embedded invisibly within the model's parameters and behaviours. This inherent characteristic challenges core legal principles like the right to erasure (e.g. GDPR) and renders definitions of 'personal information' increasingly obsolete, failing to capture the unique risks posed by inferred or reconstructed data from algorithmic memory. This presentation offers a synthesis to empirically investigate and quantify the feasibility and severity of these reconstruction attacks in realistic deployment scenarios, highlighting vulnerabilities overlooked in standard security practices.

This presentation will blend live model interrogation concepts with legal and regulatory analysis to explain and develop:

AI is transforming every sector, yet few understand how its very structure threatens the foundation of modern privacy law, demanding security practices "transform to evolve" concurrently and expanding the potential threat surface. Current technical defences, such as basic data masking or static anonymisation, often prove insufficient against the sophisticated, context-aware reconstruction methods we will demonstrate through research-backed evidence, leaving organisations unknowingly exposed. This session addresses this critical gap, providing foresight by dissecting the emergent vulnerability tied to AI's core learning process. It empowers technical practitioners, GRC professionals, legal counsel, and strategic leaders to move beyond compliance checklists towards ethical leadership, adapting their security posture for a future where "delete" requires a new definition in a machine that never forgets.