People are not static; they are entitled to re-invent themselves and correct their past actions.[1]
- Introduction
- Definition
- Personal Data Protection Bill, 2019
- Enforcing the Right to be Forgotten
1. Introduction
In a world where people seek to make things viral or trending, there is also an emerging movement of being Forgotten. More and more people are seeking deletion of their personal information online by way of Right to be Forgotten. Unlike in the pre-digital era where this was easy, the new era of internet never forgets. The information in the public domain is like toothpaste, once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away.[2] That is where the principle of Right to be Forgotten becomes important facet of life. Unlike other Fundamental or Legal Rights, the Right to be Forgotten is not an easy road. Its enforceability is often contrasted with the practicality and technological challenges. This short article gives a brief on the Right to be Forgotten, its recognition in India and how to enforce it.
2. What is the Right to be Forgotten?
The Right to be Forgotten simply means to be able to delete the personal information on the internet. In broader terms it is the right empowering an individual to limit, de-link, delete, or correct the disclosure of personal information on the online space which the individual feel is misleading, embarrassing, irrelevant or has served the purpose.[3]
The Right to be Forgotten has been developing its own space from several years as the outreach of the internet started touching every individual’s life on the planet. While the legal framework for the same has been in place in many countries including the European Union[4], the same is still in the nascent stage in India. The Right to be Forgotten got a boost when the Hon’ble Supreme Court of India in 2017[5] while holding Right to Privacy a fundamental Right, also found that Right to be Forgotten is a part of protecting individual’s privacy.
3. Personal Data Protection Bill, 2019
The much-awaited Personal Data Protection Bill, 2019 (“Bill”) under Section 20 codifies this Right and provides right to restrict or prevent the data fiduciary[6] from continuing disclosure of the personal data when such disclosure has:
- has served the purpose for which it was collected or is no longer necessary for the purpose;
- was made with the consent of the data principal[7] and such consent has since been withdrawn; or
- was made contrary to the provisions of this Act or any other law for the time being in force.
The interpretation of the aforesaid grounds will be a bigger task. For example, it will be debatable whether the information disclosed has served the purpose or will it require continued publication. Justice Sri Krishna Committee has putforth a balancing test in order to come to the conclusion whether the information can be removed or be continued with[8]. Any request for removal of information brings into direct conflict two rights viz. Right to Privacy and Right to Free Speech and Expression (including right to receive information) and the balancing of these two rights will play a pivotal role for application of Right to be Forgotten.
Even the Bill recognizes this conflict, and has infact put Right to Freedom of Speech and Expression at higher pedestal. The proviso to Section 20(2) provides that an Order to restrict or delete any information cannot be passed unless it is shown by the Applicant seeking to restrict or delete information that his right or interest in preventing or restricting the continued disclosure of his personal data overrides the right to freedom of speech and expression and the right to information of any other citizen.
The determination and balance of rights is an important role. The Bill entrusts this power to the Adjudicating Officer[9]. The White Paper[10] proposed that Right to be forgotten be incorporated in the Data Protection law and further to entrust the power to determine and balance to the data fiduciary like it has been done in the EU. It was however believed that entrusting data fiduciaries with the power to determine the Right to be Forgotten will be bundersome. Justice Sri Krishna Committee also differed from the suggestions of the White Paper and sponsored for giving statutory form to the balancing tests. In respect of appropriate entity to determine and balance the rights, the Committee felt that the balancing function is appropriately seen as adjudicatory one as entrusting this role to the data fiduciary will amount to the privatization of regulation and shift responsibility for the protection of fundamental rights to private entities that are not constrained by democratic accountability.
The Bill has incorporated all the suggestions of the Committee, entrusting power to determine and balance to the Adjudicating Officer exclusively[11] and further giving statutory form to the balancing tests as incorporated under Section 20(3) which provides for the Adjudicating Authoring, while considering the Application/request, to have regard to:
- the sensitivity of the personal data;
- the scale of disclosure and the degree of accessibility sought to be restricted or prevented;
- the role of the data principal in public life;
- the relevance of the personal data to the public; and
- the nature of the disclosure and of the activities of the data fiduciary, particularly whether the data fiduciary systematically facilitates access to personal data and whether the activities shall be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.
The Bill also gives the Applicant a right to seek review of the Order passed by the Adjudicating Authority, in case the take down request has been rejected[12], with a further appeal to the Appellate Tribunal[13]. Section 20 in itself is a complete code which acts as a one stop shop for enforcing the Right to be Forgotten. It will indeed be a progressive time for the general public to be able to make a request for taking down a news article, or picture, video from the Internet inorder to safeguard the Right to Privacy. However, until the Bill is enacted into a law, it’s a long road ahead.
The Bill was introduced in the Lok Sabha on 11.12.2019 and was referred to the Standing Committee on the same day and the Standing Committee report is yet to be released. It seems unlikely that the Bill will see the light of the day anytime soon. The Information Technology Act and the rules thereunder are highly insufficient to deal with the fast pace internet development and outreach. The voices in support of Data Protection are getting louder across the Country and there is a widespread and seemingly consensual convergence towards an adoption and enshrinement of the right to get deleted or forgotten.[14] Thus, a need for a refreshed law with power to take a major leap is highly awaited.
4. Enforcing the Right to be Forgotten
Till the time the Bill is enacted and the relevant provisions for Right to be Forgotten are notified, any request for taking down the information from the internet has to be made through different channels. While a formal request to the respective website may not give immediate or satisfactory relief, Applications have been approaching Courts to enforce their Right to be Forgotten. There have been several reported instances where the Courts have enforced individual’s Right to be Forgotten and allowed public information to be deleted.
In a Writ Petition filed before the Karnataka High Court[15] seeking to mask the name of Petitioner’s daughter from the Cause title of a case, it was argued that if the name appears in a simple search on google or yahoo, then it might damage her reputation. The High Court accepting the contention and recognizing the principle of Right to be Forgotten, allowed the name of the Petitioner’s daughter to be redacted.
The Delhi High Court has dealt with the Right to be Forgotten principle in two occasions. In a Civil Suit filed seeking permanent injunction against the publication and re-publication of two articles on a website, the Hon’ble Court while recognizing the Right to be Forgotten and on the argument of the Plaintiff that the articles hamper his personal and professional life, restricted the website from republishing the Articles[16]. The Civil Suit, however, was settled between the parties later. Similarly, in a Writ Petition filed before the Delhi High Court seeking removal of Judgement from certain websites on the ground that even though he was acquitted in the judgement published online, his name appearing in the judgement harms his employment prospects. In an interim order passed by the Court and recognizing Right to be Forgotten, it directed the websites to block the judgement.[17]
On similar facts, however, the Gujarat High Court took a very narrow view and dismissed the Writ Petition seeking to block the judgements published online containing the name of the Petitioner.[18] In sensitive cases relating to crimes against Women, the Courts have on multiple occasion directed to mask the name of the victim, but the decisions are based more on morality than on the principle of Right to be Forgotten.
As evident from the aforesaid orders, there’s an emerging trend of recognizing the Right to be Forgotten as an enforceable right, however, there is no set mechanism in place till now to enforce the same.
The appropriate remedy to enforce such Right is therefore either preferring a Writ Petition or filing a Civil Suit for injunction. A Civil Suit against a private party will be perfectly maintainable where the principles of Injunction guided by equity will come into play to decide whether or not any information available online can be removed or not. However, maintainability of a Writ Petition for such enforcement against private bodies, which form majority of websites, is questionable and also debatable. In sensitive cases relating to crimes against Women, the Courts have on multiple occasion directed to mask the name of the victim, but the decisions are based more on morality than on the principle of Right to be Forgotten.
*********
[1] Justice K.S. Puttaswamy (Retd.)& Anr. v. Union of India & Ors., (2017) 10 SCC 1.
[2] Subhranshu Rout @ Gugul vs State of Odisha BLAPL No.4592 OF 2020 dated 23.11.2020
[3] “A Free and Fair Digital Economy Protecting Privacy, Empowering Indians” Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, at p. 75, available at https://www.meity.gov.in/writereaddata/files/Data_Protection_Committee_Report.pdf
[4] Ben Wolford, Everything you need to know about the Right to be Forgotten, https://gdpr.eu/right-to-be-forgotten/ (last accessed on 27.05.2021)
[5] Justice K.S. Puttaswamy (Retd.)& Anr. v. Union of India & Ors., (2017) 10 SCC 1
[6] Section 3(13) of the Bill defines “data fiduciary” as any person, including the State, a company, any juristic entity or any individual who alone or in conjunction with others determines the purpose and means of processing of personal data;
[7] Section 3(14) defines “data principal” as the natural person to whom the personal data relates.
[8] “A Free and Fair Digital Economy Protecting Privacy, Empowering Indians” Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, at p. 76 available at https://www.meity.gov.in/writereaddata/files/Data_Protection_Committee_Report.pdf
[9] Adjudicating Officer is appointed under Section 62(1) of the Bill.
[10] White Paper of the Committee of Experts on a Data Protection Framework for India available at
<http://meity.gov.in/writereaddata/files/white_paper_on_data_protection_in_india_18122017_final_v2.1.pdf>
(last accessed on 27 May, 2021) at p. 141)
[11] Section 20(2): The rights under sub-section (1) may be enforced only on an order of the Adjudicating Officer made on an application filed by the data principal, in such form and manner as may be prescribed, on any of the grounds specified under clauses (a), (b) or clause (c) of that sub-section:
[12] Section 20(4)
[13] Section 20(5)
[14] Subhranshu Rout @ Gugul vs State of Odisha BLAPL No.4592 OF 2020 dated 23.11.2020
[15] [Name Redacted] v. The Registrar, Karnataka High Court, Writ Petition No.62038 Of 2016.
[16] Zulfiqar Ahman Khan vs M/S Quintillion Business Media Pvt. Ltd. & Ors. CS(OS) No. 642 of 2018, Order dated 09.05.2019.
[17] Jorawer Singh Mundy @ Jorawar Singh Mundy vs Union of India & Ors. WP(C) 3918 of 2021, Order dated 12.04.2021.
[18] Dharamraj Bhanushankar Dave vs State of Gujarat & Ors. SPECIAL CIVIL APPLICATION NO. 1854 of 2015, Order Dated 19.01.2017.