Machine Unlearning and Explainable AI for Personal Data Protection Compliance under the GDPR and Algerian Law no 18-07

Abstract

AI systems trained on personal data create a real problem for data protection rules: once information becomes part of a model’s internal parameters, can it actually be removed, and can the model’s decisions be properly explained to people? This research addresses that question by comparing two legal systems – the GDPR and Algeria’s Law 18-07 – alongside the technical methods currently available. The first part examines how both laws treat AI-related rights, focusing mainly on the right to erasure and the right to explanation. Each right is mapped onto a seven-step machine learning process, from data collection to deployment. This comparison reveals that most rights can be applied in practice, but erasure and explanation turn out to be by far the hardest to achieve technically. The second part reviews machine unlearning techniques – full retraining, SISA, certified removal, gradient ascent, and knowledge distillation – together with the methods used to verify whether unlearning actually worked, such as membership inference attacks, shadowmodel tests, and likelihood-ratio approaches. No single technique manages to be cheap, easy to interpret, and resistant to manipulation all at once. The analysis also covers explanation tools like SHAP, LIME, Integrated Gradients, and counterfactual explanations, showing that being mathematically sound doesn’t automatically mean a method meets legal standards. The main finding is that unlearning methods sit somewhere on a scale between cost and reliability, but a dependable way to confirm that erasure truly happened is still missing. Explanation methods, while technically solid, still lack any agreed standard for what counts as legally sufficient under either the GDPR or Law 18-07.