In December 2021, the Centre told the Delhi High Court that the ‘right to be forgotten’ is a part of the fundamental right to privacy. The Centre also added that it does not have a significant role to play in the matter. There are many petitions pending in various courts of India which have been seeking the enforcement of ‘right to be forgotten’. However, this as a legal principle has not yet been backed by the statute in India.
Right to be forgotten The ‘right to be forgotten’ allows a person to seek deletion of his/her publicly available private information from all public platforms, once their personal information in question is no longer necessary or relevant. These platforms include the internet, search engines, databases, websites, etc. This concept has found recognition in some jurisdictions abroad, particularly in the European Union. At present, this right is not recognised by law in India.
As per the Center for Internet and Society, ‘right to be forgotten’ gained prominence in the Google Spain Case, 2014.
Nevertheless, courts in India, in recent months, have held it to be an intrinsic part of the right to privacy. The ‘right to be forgotten’ falls under the purview of an individual’s right to privacy, which is governed by the Personal Data Protection Bill which is yet to be passed by the Parliament.
In a landmark verdict in 2017 (Puttuswamy V. Union of India) a nine-judge bench of the Supreme Court declared ‘Right to Privacy’ as a fundamental right. The apex court stated that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21. It is a part of the freedoms guaranteed by Part III of the Indian Constitution.
Countries that have legally recognised ‘right to be forgotten’ The European Union in 2018 adopted the General Data Protection Regulation (GDPR). Article 17 of the GDPR provides for the right to erasure of certain categories of personal data, that which is no longer considered necessary. These include consent for which has been withdrawn or processing of which has been objected to, personal data unlawfully processed, and data where there is a legal obligation for erasure. However, the regulations limit the right to erasure in certain circumstances. This includes reasons of public interest in the area of public health, for archiving purposes ‘in the public interest, scientific or historical research purposes or statistical purposes in accordance’ and for ‘establishment, exercise, or defence of legal claims’.
According to the EU GDPR website, “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay” (if one of a number of conditions applies).
In its landmark ruling, the EU’s highest court ruled in 2019 that the ‘right to be forgotten’ under the European law would not apply beyond the borders of the EU member states. The European Court of Justice (ECJ) ruled in favour of Google, which was contesting a French regulatory authority’s order to have its web addresses removed from its global database.
This ruling was considered as an important victory for Google. It laid down that the online privacy law could not be used to regulate the internet in other countries which are outside the EU.
In 2015, Russia enacted a law that allowed users to force a search engine to remove links to personal information on grounds of irrelevancy, inaccuracy, and violation of law.
The ‘right to be forgotten’ is also recognised, to some extent, in Turkey and Siberia. Courts in Spain and England have ruled on the subject.
Position in India The Centre told the Delhi High Court, in December 2021, that the right to privacy has been recognised as a fundamental right in the Puttaswamy V. Union of India judgement (2017) and that the ‘right to be forgotten’ is evolving in India. The government also stated that the Personal Data Protection Bill 2019, (which is presently under the Joint Parliamentary Committee for final recommendations), contains provisions to the doctrine of the ‘right to be forgotten’.
In the Case of Justice K. S. Puttaswamy (Retd.) and Anr. vs Union of India, the Supreme Court of India on 24 August 2017 gave the verdict that the Right to Privacy is a fundamental right protected under Article 21 and Part III of the Indian Constitution. The apex court, however, clarified that like most other fundamental rights, the right to privacy is not an absolute right. Subject to the satisfaction of certain tests and benchmarks, a person’s privacy interests can be overridden by competing state and individual interests.
Personal Data Protection Bill 2019 on ‘right to be forgotten’ Clause 20 under Chapter V of the Personal Data Protection draft bill titled ‘Rights of Data Principal’ has mentioned about ‘right to be forgotten’. It states that the ‘data principal (the person to whom the data is related) shall have the right to restrict or prevent the continuing disclosure of his/her personal data by a data fiduciary’.
A data fiduciary means any person, including the State, a company, any juristic entity or any individual who alone, or in conjunction with others, determines the purpose and means of processing of personal data. Under the ‘right to be forgotten’, users would be able to de-link, limit, delete, or correct the disclosure of their personal information held by data fiduciaries.
The sensitivity of the personal data and information could not be determined independently by the person concerned. It would be overseen by the Data Protection Authority (DPA). This means that while the draft bill would give some provisions under which a data principal could seek that his data be removed. However, his or her rights would be subject to authorisation by the adjudicating officer who works for the DPA.
The adjudicating officer would need to examine the sensitivity of the personal data while assessing the data principal’s request. He should also examine the scale of disclosure, degree of accessibility sought to be restricted. Also, he should look into the role of data principal in public life and the nature of the disclosure among other variables.
Courts’ rulings on ‘right to be forgotten’ Justice Pratibha M Singh of the Delhi High Court, while dealing with a civil suit seeking the removal of certain news reports on MeToo allegations stated that the ‘right to be forgotten’ and the ‘right to be left alone’ are inherent aspects of the right to privacy. The allegation was against the managing director of a media house. She also said that there should be a control on republication of these new reports.
The court, in April 2021, directed the removal of a judgement from the search results of Google. But this order is now being opposed by Google. The Karnataka High Court ordered to its registry, in January 2017, to ensure that internet search engines do not reflect a woman’s name in an order passed in 2015. In November 2020, the Orissa High Court in its ruling in a case related to videos uploaded on Facebook by a rape accused stated that such videos should not be posted on social media platforms without the consent of the concerned woman. However, it did not pass any order for removal of the videos.
Ongoing cases in the Delhi High Court on ‘right to be forgotten’ Some petitioners have sought removal of orders in cases, in which, they have been acquitted or already served their sentences. Lawyers for the petitioners acknowledge that there is an absence of statutory backing to seek relief for the petitioners.
© Spectrum Books Pvt Ltd.