Recognition of new right with the changing time is a vital need for the growth of society. It requires a different orientation with balanced amendments. Right to be Forgotten (RTBF) is finding its way in India. RTBF refers to the right of an individual to ask for the removal of information involving his/her past from the Internet which is usually easy to look up using a search engine and often undermine their future opportunities in terms of jobs, relationships etc. The meaning differs with varying jurisdictions.
Introduction
It is the branch or subset of Right to Privacy (RTP) which now comes under the rubric of fundamental right under Article 21 of the Indian Constitution, after the path-breaking judgment of K.S. Puttaswamy. There are various controversies concerning RTBF as there are no firm rules or settled laws for the same. Indian constitution and legislature give way to various rights like the right to speech, right to information etc. but the conflict arises with the contradictory nature of RTBF in front of these fundamental rights. The article gives insight into the Personal Data Protection Bill, 2019 (PDP Bill) and highlights the prominence of Right to be Forgotten (RTBF) and the need for its implementation in India.
The paper highlights the emergence of RTBF and the PDP Bill .The PDP Bill emerged on the line of European General Data Protection Regulation (GDPR) but still differs a lot.
RTBF can be classified into two categories i.e. Right to Erasure and Right to Delist. The Right to Erasure means deletion of the data from the source storage and hence, the data is deleted entirely from the web. On the other hand, the Right to Delist means that the data be deindexed from various search engines making it impossible to be searched through search engines but would still exist on the web. In India, only the delisting of data from the search engine is done and no deletion of data takes place in the name of requests for RTBF[i].
The Indian PDP Bill is different from the European GDPR in many aspects as the RTBF, which is provided under the heading of Right to Erasure under Article 17 of the GDPR.
However, in India RTBF and Right to Erasure are two separate rights given under different sections. The RTBF is given under Section 20, the Right to Erasure as provided under Section 18(1)(d).
The data-principal in GDPR has been provided with the right, to exercise the right by directly approaching to the data-fiduciary, who has the power to accept or reject the request, based on some grounds whereas under the PDP Bill, the data-fiduciary is required to apply to the Adjudicatory Authority who will include the members of the government.
How The Right To Be Forgotten Evolved?
The origin and historical background of RTBF can be traced back to French Jurisprudence which referred to it as Right to Oblivion. This right was utilized by the offenders, who had served their sentence, to object the publication of their conviction or about the wrongs committed by them to protect reputation among the society members[ii].
The RTBF has been in practice since 2006 after it emerged in the European Union and Argentina. The RTBF visibly emerged after the settlement of the Google Spain SL, Google Inc. v A E P D, Mario Costeja González[iii]in the year 2014 by the European Court.
To process the personal data, the European Union came up with the Data Protection Directive (Directive 95/46/EC) in the year 1995; this was marked as the emergence of RTBF. Article 12 of this directive mentioned about the protection of people on the Internet, though RTBF was not specifically stipulated in this article, later in 2012 came a draft European Data Protection Regulation was introduced, in its Article 17, it stipulates about the RTBF and superseded the directive and Recitals 65 and 66. The draft was finalized which lead to the formation of GDPR[iv]and was adopted in the year 2016 and was enforced in the year 2018 and RTBF law was passed by the 28-member bloc.
In the Google Spain case, the person named Costeja disputes that the google web search continued to show his name in the article newspaper La Vanguardia which specifies the auction of his reposed home due to the debt which he paid later and the matter stood resolved years ago. He requested for the removal of the link of the respective article by the newspaper publisher and Google, contending it to be a breach of his privacy. The court rejecting the claim against the newspaper upheld the complaint against Google. The court observed that where the information is ‘inaccurate, inadequate, irrelevant or excessive,’ individuals have the right to ask search engines to remove links with personal information about them.[v]It was held that the content to which the search engine directs is the responsibility of the search engine and thus, Google was directed to comply with EU data privacy laws[vi] and recognized the RTBF. Similarly, in the US in the case of Melvin v. Reid[vii], the court recognized RTBF as a part of RTP.
RTBF In India & PDP Bill, 2019
RTBF is not explicitly a law in India but it is a part of privacy that should be provided to every individual to protect the information which is private/personal and the person doesn’t want it to be in a public forum.
In the case of Kharak Singh v. State of U.P.[viii], The Supreme Court of India for the first time held that personal liberty is the part of the Right to Life and thus includes RTP. In the case of R. Rajagopal v. State of T.N.[ix], the apex court ruled that the RTP was suggested by the Right to Life and Liberty under Article 21 though not directly expressed.
There are other cases in which the courts believed that RTP fall under Article 21of the Indian Constitution; for example Govind v. State of Madhya Pradesh[x], State of Maharashtra v. Madhukar Narayan Mardikar[xi], PUCL v. Union of India[xii].
In a very celebrated judgment of Justice K.S. Puttaswamy (Retd) vs Union of India[xiii], the Supreme Court ruled that RTP is a fundamental right under Article 21 of the Constitution of India.
The only mention of the RTBF can be found in Section 228A of IPC and Section 23 of POCSO Act which restricts its applicability to sexual offences against women and children respectively keeping in mind their vulnerability[xiv].
The draft PDP Bill was introduced by the expert committee chaired by a retired Supreme Court judge, B. N. Srikrishna in the year 2018. The committee was set up by the government of India after the Supreme Court directed the government to work towards the making of data protection rules. All this resulted in the remarkable judgment of Puttaswamy, 2017, in which the hon’ble S.C. declared that the RTP is a fundamental right.
Later in 2019 PDP Bill[xv](final bill) was introduced in the Lok Sabha by the Minister of Electronics and Information Technology which differed a little from the draft bill. The Bill has been referred to a Joint Select Committee (JSC). A report will be submitted by JSC before the commencement of the final week of Budget Session, 2020[xvi].
The Bill was introduced to protect the privacy of individuals concerning their data. The PDP Bill states that “there is a need to protect the personal data of an individual, which is a vital part of informational privacy where RTP is a fundamental right[xvii]. It has come up with a new right i.e. the RTBF which will serve the purpose of eliminating those content from the internet which becomes irrelevant over time.
The RTBF, as envisaged u/s 20of PDP Bill provides ‘data principal’[xviii] the right to restrict or prevent continuing disclosure of his/ her data by a ‘data fiduciary’[xix]. This right can be exercised on three grounds i.e.
- Purpose of the data has been served; or
- Withdraws the consent given earlier; or
- Data disclosed violates the Act.
Section 9 of the PDP Bill mentions that the personal data of an individual shall be under the possession of the data fiduciary only to the point it serves the purpose and deletes at the end of processing. Further, the data fiduciary is obligated to undertake reviews periodically to determine the necessity to retain the personal data and if not, then the data must be deleted.
Thus, even if the RTBF u/s 20 of the PDP Bill does not provide a Right to Erasure, the Restriction on retention of personal data u/s 9 of the PDP Bill requires data fiduciaries to erase personal data on their own under stipulated circumstances.
Right to Erasure is included u/s 18(1)(d) of the PDP Bill segregated from RTBF which only includes a right to non-disclosure and not erasure. Right to Erasure broadens the ambit of the rights of data principals to request the erasure of data which is no longer required for processing.
Judiciary On Right to be Forgotten
Many times, Indian Judiciary has been witnessed supporting the purpose behind the RTBF, which can be observed in the following two cases:
In-State of Punjab vs Gurmit Singh (1996), the Supreme Court believed that “The anonymity of the victim of the crime must be maintained as far as possible throughout.” In another case, the State of Karnataka vs Putta Raja (2003), the Supreme Court instead of mentioning the name of the person who was subjected to a sexual offence, referred that person as “victim” to protect that person from any kind of social discrimination.
The antithetical views of Gujarat and the Karnataka High Court in the following two judgments don’t bring forth the position of RTBF in India, which points towards the need of settled law on the point.
In Dharamraj Bhanushankar Dave v. State of Gujarat & Ors.[xx], petitioner pleaded against the judgment published by an online repository of cases and it was searchable by Google web search. This case mentioned about the accusation of the petitioner for various offences like murder etc. and was acquitted both by Sessions Court and the High Court of Gujarat. Since the case was non-reportable, petitioner contended it to be an infringement of Article 21 but was unable to prove the same with any legal provision. The court denied the protection of RTBF to the petitioner.
https://lawaddiction.com/inception-of-shufaa-pre-emption/
In the case of Sri Vasunathan v. The Registrar General, 2017[xxi], High Court of Karnataka was requested by the petitioner to remove the name of his daughter from the order dated 15.06.2015 of the court which ensued from the suit by the petitioner’s daughter on the ground that it may harm her reputation. The respondent issued a fake marriage certificate which contained the name of the petitioner’s daughter, who de facto never married the respondent. Hence, the plea was to annual that marriage certificate. The settlement took place between the parties and the case was withdrawn later. The plea was accepted by the Karnataka High Court and issued orders to eliminate the name from everywhere else except the official website of the court.[xxii] Hence, the RTBF was recognized.
There are various other judgments which deal with the question of RTBF.
Zulfiqar Ahman Khan v/s Quintillion Business Media Private Limited and Ors.[xxiii],is still pending before the High Court of Delhi which directed the respondent to take down the articles containing harassment allegations against the plaintiff from the internet and recognized the RTBF of the plaintiff in an order dated 09.05.2019.The RTBFand the ‘Right to be Left Alone’ are the inherent facets of RTP, observed the court.
The Kerala High Court in the case of Sridharan T v. State of Kerala[xxiv], in its order dated February 23, 2017, recognized the RTBF. The petitioner claimed for the protection of his identity and removal/hiding of the material disclosing it on the ground that RTP under Article 21 of the Constitution is being infringed. An interim order was issued by Justice Shaji P Chaly in the favour of the petitioner. Indian Kanoon was directed to remove the petitioner’s name from the court orders posted on its website until further orders.[xxv]
Subodh Gupta vs Herdscene And Ors.[xxvi], Facebook, Google, and Instagram were directed to remove the data and search results related to the sexual harassment allegations against the petitioner by the Delhi High Court on the ground of defamation.[xxvii]“The allegations cannot be permitted to be made in the public domain without being backed by legal recourse” said Rajiv Sahai Endlaw, J. If this is permitted, it would be “capable of mischief”, further added.
Laksh Vir Yadav v. UOI[xxviii] The petitioner pleaded before the Delhi High Court to remove the reportable judgment about a criminal case from the internet which involved his wife and mother, on the ground that his RTP was being infringed and also his employment opportunities were being affected. So, this case was concerning the affected right of the third party which has remained pending for more than three years.
Significance, Controversy & Implementation Of RTBF
RTBF holds a great significance in a country for the proper dissemination of rights among the members as this right helps one to keep up with the society by not getting trapped into social ostracism. There are instances when the offender serves the complete sentence for the offence committed but still faces the torture or discrimination within the society which is not appropriate for the social and mental well-being of the person in the society or there are cases where the third party gets affected because of any judgment/order or data in the public domain. In such situations, the RTBF can be seen to play a significantly important role.
Under the PDP Bill, RTBF is limited only to discontinue the disclosure of data which is personal and doesn’t include the erasure of data which is antithetical to the jurisprudence of the RTBF and Google Spain Case. The ‘data principal’ under PDP Bill can always request for the erasure u/s 9 of the bill as mentioned earlier.
The Data Protection Committee Report has mentioned in the report that “Removing publicly available information takes away from an individual his right to know; at the same time, it abridges the freedom of the press which has published the story in the first place”[xxix], which to an extent can hold a reasonable position in a country like India being the world’s largest democracy.
In Justice K.S. Puttaswamy (Retd.) & Anr.v/s Union of India & Ors.[xxx], Justice S.K. Kaul said that all aspects of RTBF in GDPR need not be obligated and hence, it cannot be recognized absolutely. An individual should be able to remove when the personal data is no longer necessary, relevant, or is incorrect. This right cannot be exercised where the data is necessary for the welfare of the public, for exercising the fundamental rights, for compliance with legal obligations, research subjected to science or history or statistical data related to economics etc. These conditions are exceptions to the RTP as well as data privacy.
RTBF has also been criticized several times because it conflicted with fundamental rights such as free speech and right to information.[xxxi]Freedom of Speech not just provides rights but also enforce some duties which include the protection of the reputation of an individual.
The right under section 20 of the Bill is formed as such which would be in the balance against the fundamental and other rights. But the right to erasure could be included within the RTBF but with the reasonable restrictions. Controversy always revolved around the pragmatic approach towards establishing the RTBF at the pedestal of an International Human Right law as it is altogether an exhausting task to implement.
The absolute implementation is not pragmatic neither possible in a country like India even if the Right to be Forgotten (RTBF) is carried forward for implementation at the international level then that would also be a chaotic exercise. The data on the internet is so widely spread that it is more or less difficult to control the data/information spread over the internet. The legislations could handle it to some extent by forming the structured space for the data principle and data fiduciary and applying sanctions for any violation.
The PDP Bill has provided rights to the data principle but it is altogether an exhaustive exercise to claim the rights because any such right has to be claimed before the Data protection authority of India[xxxii] who shall be established by the Central Government unlike under the European GDPR where the data fiduciary possesses wider powers.
Conclusion
The PDP Bill, 2019 has come up with a huge step towards protection of the data and RTBF. The PDP Bill, 2019 under the scrutiny of the Joint Select Committee will soon come up with a report which will decide the position of the data protection laws and RTBF in India.
“The RTBF falls under the ambit of the Right to Privacy. It would be clashing with Freedom of Speech and Expression, Right to Information etc.” said Kazim Rizvi (founder of the policy think tank ‘The Dialogue’). Suppression of information of public importance, by the use of RTBF, cannot be the sole excuse to avert it from finding a place in India[xxxiii].
The right should be approved to the claimant to the extent it is in the balance against the fundamental rights. RTBF is facing lots of challenges to mark its place in Indian laws but has been recognized a lot many times by the Indian Courts which clearly shows the positive attitude of the judiciary towards the need of this law. So, the right should be affirmed looking into the social and legal conditions of our country and it should not compromise with the fundamental rights and the democratic structure of our country.
Along with the legislation few other improvements can be made for its implementation like the data fiduciary can have a private setting by which they can address such issues where one needs the information to be removed or not be disclosed further, as the same was done by Google after the Google Spain case. So, the pragmatic approach and changes in the mindset can lead to proper implementation of the right.
References
[i]Intermediary Liability 2.0: A paradigm shift (March 2019), https://sflc.in/sites/default/files/reports/Intermediary_Liability_2_0_-_A_Shifting_Paradigm.pdf.
[ii] Shubham Mishra, RIGHT TO BE FORGOTTEN: EVOLVING RIGHT IN INDIAN DEMOCRACY (October 27, 2018), http://rsrr.in/2018/10/27/right-to-be-forgotten-evolving-right-in-indian-democracy/
[iii]Decided on May 13, 2014, C-131/12, http://curia.europa.eu/juris/document/document_print.jsf?doclang=&docid=152065.
[iv]Regulation (EU) 2016/679, General Data Protection Regulation, https://gdpr-info.eu/issues/right-to-be-forgotten/.
[v] Amber Sinha, Right to be Forgotten: A Tale of Two Judgements (07.04.2020), https://cis-india.org/internet-governance/blog/right-to-be-forgotten-a-tale-of-two-judgments
[vi]David Streitfeld, European Court Lets Users Erase Records on Web, New York Times, 13 May 2014, https://www.nytimes.com/2014/05/14/technology/google-should-erase-web-links-to-some-personal-data-europes-highest-court-says.html.
[vii]Cal. App. 285, 297 P.91 (1931)
[viii]AIR 1963 SC 1295
[ix] AIR 1995 SC 264
[x] AIR 1975 SC 1378
[xi] AIR 1999 SC 495
[xii]AIR 1991 SC 207
[xiii] WRIT PETITION (Civil) No. 494 OF 2012, decided on 24 August 2017
[xiv]Alok Prasanna Kumar, The Right to be Forgotten in Indian law (March 18, 2017) http://www.epw.in/system/files/pdf/2017_52/11/CL_LII_11_18032017_Alok_Prasanna_Kumar.pdf.
[xv] The Personal Data Protection Bill, 2019, http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf.
[xvi]Personal Data Protection Bill, 2019 Introduced In Parliament (14 January 2020), Legalhttps://www.mondaq.com/india/data-protection/882988/personal-data-protection-bill-2019-introduced-in-parliament.
[xvii] Supra note 15.
[xviii] Section 3(14) of Personal Data Protection Bill, 2019
[xix] Section 3(13) of Personal Data Protection Bill, 2019
[xx]Special Civil Application Number 1854 of 2015, Decided on 19.01.2017
[xxi]Writ Petition Number 62038 of 2016 (GM-RES), Decided on January 23, 2017; SCC Online Kar 424
[xxii] Report by Vidhi Centre for Legal Policy, Open Courts in the Digital Age: A Prescription for an Open Data Policy (Nov. 2019), https://vidhilegalpolicy.in/wp-content/uploads/2019/11/OpenCourts_digital16dec.pdf.
[xxiii] 2019 (175) DRJ 660
[xxiv]Civil Writ Petition No. 9478 of 2016
[xxv]Vikrant Rana and Akshay Gupta, India: Will judiciary recognize the emerging “right to be forgotten”?(March 17 2017), https://www.lexology.com/library/detail.aspx?g=bbe714d3-5222-4558-9686-d67254c192c7#_ftn4.
[xxvi]Order dated 18.09.2019, https://www.livelaw.in/pdf_upload/pdf_upload-365121.pdf
[xxvii] Trisha Jalan, Right to be Forgotten: Delhi HC orders Google, Facebook to remove sexual harassment allegations against Subodh Gupta from search results, Medianama, October 1, 2019, https://www.medianama.com/2019/10/223-right-to-be-forgotten-delhi-hc/.
[xxviii] WP(C) 1021/2016
[xxix]Data Protection Committee Report (27.07.2018), https://meity.gov.in/writereaddata/files/Data_Protection_Committee_Report-comp.pdf
[xxx]Writ Petition (Civil) No. 494 OF 2012, decided on 24 August 2017
[xxxi] Deepti Pandey, THE RIGHT TO BE FORGOTTEN: A TRAIL OF CONTROVERSY AND CONFLICT (18.03.2019), http://ijlt.in/index.php/2019/03/18/the-right-to-be-forgotten-a-trail-of-controversy-and-conflict/#_ednref15.
[xxxii] Chapter IX PDP Bill, 2019
[xxxiii] M. Garcia-Murillo, The right to be forgotten: its weaknesses and alternativeshttp://www.academia.edu/8583508/The_right_to_be_forgotten_its_weaknesses_and_alternatives
BY AASHI SHARMA | GURU GOBIND SINGH INDRAPRASTHA UNIVERSITY