Swimming Pools, Pee, and Trying to Delete Your Data from the Internet
Troy Hunt compares deleting personal data from the internet to removing pee from a swimming pool—once it's in, it's nearly impossible to eliminate. Data spreads across multiple broker sites, and opt-out processes are often ineffective and require constant repetition.
Background
- **Troy Hunt** is an Australian security researcher who runs "Have I Been Pwned" (HIBP), a free service that lets people check if their email or data was exposed in a breach. He does not collect data — he republishes data already leaked to the internet.
- The piece responds to a user who angrily demanded deletion from HIBP, comparing it to discovering pee in a swimming pool. Hunt's retort: the "pee" is the original breach; HIBP just warns you the pool is contaminated.
- Core dilemma: once data is public in a breach, it cannot be fully deleted. Hunt offers to remove a domain from search results ("domains not searched") but cannot erase the underlying leak. This fuels ongoing debates about the "right to be forgotten" vs. transparency, especially under EU's GDPR.