An increasing amount of sensitive data is stored on systems beyond the direct control of the originator of the data. This includes private individuals, corporations, and governments, and complicates the problem of confidential data destruction and protection of privacy.

There are some standard current techniques to secure data on remote systems and enable secure and efficient deletion of data: data can be encrypted while “at rest” (i.e., while stored in systems). By careful management of the encryption key, the owner of the data can ensure that the data cannot be inappropriately decrypted. And by securely deleting the encryption key, the encrypted data is effectively deleted.

However, techniques to protect sensitive data at rest do not necessarily help protect computation using that data, nor protect the information carried by that data, e.g., the output of computation over the sensitive data.

There is increasing awareness among companies and individuals about the importance of the data they own and generate, and the risks involved with losing control of that data much like in the past when the solution was to shred and/or burn hard copy like paper or film.

Legislation is increasingly regulating how companies handle sensitive data. The EU has been proactive in adopting legislation that gives individuals the “right to be forgotten”, i.e., the right of an individual to have certain data about them deleted. The EU General Data Protection Regulation (GDPR) will be enforced as of May 2018 and gives EU citizens various rights (“right to erasure”) over data that concerns them and requires companies that handle data of EU citizens to support these rights. Though this is the “Present” in some countries, it is not yet a custom in the United States.