Right to be forgotten – A perspective to Privacy Law

Contributor: Amisha

Background

The concept of the Right to be forgotten, is not a recent development, but emerged through the judgement of The European Union’s Court of Justice in 2014, when it was discovered that the law needed a halt, or s stoppage to findings which were no longer relevant over the period of time and that the individual related to such information may want to remove it.

In 1998, a man, ran into some financial difficulties which resulted in him needing some funds. He advertised a property for auction in the newspaper which ended up on the Internet by chance, as a result news about the sale was searchable on Google long after he had fixed his financial issue and everyone kept looking him up on the Internet assuming that he is still bankrupt. Ultimately the European Court of Justice realised that this was a severe damage to his reputation and that it gave birth to the concept of the “right to be forgotten” which means that on the search engines like Google under certain circumstances the European Union residents could have their personal information removed from public records databases and search engines.

In 2019, it was established that this ruling was restricted to EU only, and that this concept is also known as the right to erasure, which underlines a civil right to individuals to have their personal information removed from the internet which calls for a traceable procedure to ensure that the removed data is also erased from the backup storage media.

Considering India’s position, it does not have any statutory provision that provides for the Right to be Forgotten however the Indian system does have the Personal Data Protection Bill passed in 2018 which says that the Right of be Forgotten falls under Article 21 and is a fundamental right.

Understanding the Concept of “Right to be Forgotten”

The ‘right to forget’ right, is a right based on the concept of length of time in reference to an occurrence to an individual, in relation to certain data which may have been floating in the public domains, and hence, is required to delete the same as the that particular occurrence holds no relevance any longer. With respect to Privacy Laws, the third persons can no longer access the data which has been erased thus, helping individuals from being defamed safeguarding their reputation and goodwill in the society.

In India, the only law pertaining to right to be forgotten is Personal Data Protection Bill, 2019. Section 20 of the bill grants any entity the right to limit or protect the prolonger discovery of their private data when such records –

Have provided the aim under which it was obtained or are no longer required for any such purpose.
Have been made with the permission of the person which approval has now been withdrawn.
Were made in contravention of the PDP Bill, or any other law in force.

Recognition of the “Right to be forgotten” right, in the Indian Legal System

When it comes to RTBF, in India, the concept of it emerged before the judiciary in Dharamraj Bhanushankar Dave v. State of Gujarat before the Gujarat High Court. The facts revolved around the petitioner being charged with murder, and criminal conspiracy who was acquitted by the Sessions Court. The petitioner claimed that since the judgement by the Court was non-reportable, the respondent should not publish it defaming the petitioner’s reputation, however it was later held by the Court that such publication does not violate the petitioner’s image and is as per the Article 21 of the Indian Constitution. Hence, RTBF did not hold its validity in the above case.

However, in, V. v. High Court of Karnataka, the Court recognized RTBF. The facts of the case focused on removing the name of the petitioner’s daughter from the cause title as it was easily accessible. The court recognized this issue, and ordered that his daughter’s name be removed from the cause title and the order as well, and it also held that “this would be consistent with the trend in western countries, where the right to be forgotten is applied as a rule in sensitive cases concerning women in general, as well as particularly sensitive cases involving rape or harming the modesty and reputation of the individual concerned.”

In the landmark judgement of K.S. Puttaswamy v. Union of India, the Supreme Court, recognized RTBF, under Article 21, and stated that the right to be forgotten was subject to restrictions but its exercise must require the right to freedom of expression and information, fulfilment of legal responsibilities, execution of a duty in the public interest, protection of information in the public interest or defending legal claims, to be in question.

In a recent judgement, by the Madras High Court in an important order regarding RTBF was given in which the petitioner’s name continued to appear on the High Court’s verdict and was freely accessible through Google search. The petitioner had been acquitted, but as this threw negative light on his image the High Court was requested to issue an order to take down the name from their verdict. However, the Madras High Court rules that the right to be forgotten cannot exist in administration of justice, and the name appearing in the verdict does not violate his image.

A Comparison between General Data Protection Regulation [EU] and Personal Data Protection Bill, 2019 [India]

GDPR is a set of rules enforceable by law for the protection of personal data in EU and this Act is a mandatory rule for all websites to follow in the EU. It was enforced in 2018 giving individuals the right to delete / erase their personal information by asking the organisation

The General Data Protection Regulation was enforced on 25 May 2018 by European Union. The General Data Protection Regulation provides the right to individuals to delete/erase their personal information by asking the organisers.

Section 17 of the General Data Protection Regulation states that:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay. But the right given to the individuals by GDPR is not an absolute right. Therefore, the organisers are not always entitled to do it. The RTBF has been given under Section 17 of this framework. The right only applies to data held at the time the request is received. It does not apply to data that may be created in the future. The right is not absolute and only applies in certain circumstance.

Section 20 of the PDP Bill recognises this right as well as Clause 18 of the Bill relates to the “right to correction and erasure”. This includes the correction of deceptive information and removal of private information online that is no longer needed. The individuals and organisations to which such information was given to must be informed about the erasure. Clause 9 states that a data trustee cannot hold personal information greater than the actual period for which it was acquired unless the data principal voluntarily gives consent or there is legal coercion. Data trustees are also required to perform the regular review to determine whether or not personal data should be kept.

Clause 36(b) states that the right to limit disclosure of personal data does not apply in which the data is required to enforce a lawful authority or claim, contest charges, get legal counsel, or other similar purposes.

Significance of The Right to be Forgotten with respect to Copyright Laws

The Internet is a platform which never forgets information which is uploaded on it and that is why it is very difficult for people who wish to erase information about them from the Internet. Article 17 of the GDPR Regulation, holds the online content sharing service providers liable if they fail to regard the RTBF. Copyright law is the saviour in situations where victims have their explicit pictures over the internet, and especially when the photo is not clicked by the victim, there are procedures laid down with respect to takedown provisions.

The following are some interesting cases, where the interface between IP Laws and the RTBF have taken place-

In Davydiuk v. Internet Archive Canada, the plaintiff demanded the removal of a pornographic film from the website which retained such copies of the film. The Court held that such sites, who hold a collection of copies of films and preserve them violate the Copyright Law and it is the right of a person to have the same erased from the face of the website. As internet archives are way worse than the accessible data, it becomes imperative that such sites who preserve films and other data be taken down.

Now, there are numerous cases in which the victim may want to remove data which has already entered a public platform over the internet, for instance if a music track was recorded by the victim, but later it enters the public domain by another person who maybe included the track in a film, the victim will result in having no remedy against it and the right to be forgotten will not give protection. The Copyright Law will also not be able to extend it’s help as the track has entered the public domain. In this case the owners require to take limited access to their works before it enters the public domain under exclusive rights. This will restrict fraud, and also provide protection to fair use to works.

In Google Spain SL v. Agencia Espanola de Protection de Datos (AEPD), an individual claimed the erasure of information concerning the debt he owed in past to be removed from the search engines in which the Court held that in order to guarantee the right of privacy and protection of personal data it is necessary to remove personal information from the internet by the third-party publishers and websites.

In the recent case of WhatsApp v. CCI, the right to privacy against private parties was inferred and the Delhi HC delivered its judgement on the same. MEITY had warned WhatsApp to either “take it or leave it’ considering its Privacy Policy being violative of the right to privacy.

In Jorawer Singh Mundy v. Union of India, the plaintiff wanted to overturn the Delhi High Court’s verdict under NDPS Act, which was against him with evidence but was cleared of all charges. However, as the judgement was available on the internet he claimed that it caused him a bad reputation as anybody could access the archives on the site and view the same. Hence, the Delhi High Court held that the RTBF allows people to have data, recordings or images about themselves removed from internet so nobody can locate them.

Implementing the Right to be Forgotten

Madras High Court earlier ruled that RTBF does not exist explicitly, however in India it does hold importance, which is still budding, especially after the introduction of the Personal Data Protection Bill. Hence, the Bill specifically needs to be implemented correctly for its actionable purpose to be achieved to give RTBF a jump start in different cases as well as in Judicial Proceedings. The necessity of this right is only increasing day by day, showcasing the significance of implementation of this Bill with clear results, so that no fundamental right is violated.

A strong security policy would go a long way toward immediately instilling this in each person. Right to be forgotten may be used to assist individuals to secure their security even further.
Online search tools can modify their principles and decide on the destruction of particular information by disconnecting. In any instance, even after being charged by a candidate in the Kerala High Court, large corporations such as Google have retained certain data. This demonstrates that this method of implementing the right is the least practical.

However, combining the three and systematically using them might aid in the appropriate establishment and implementation of Right to be forgotten in India.

Finally, it is worth noting the evolution of the right to be forgotten in different jurisdictions.

Conclusion

The requirement for the RTBF is the need of the hour and with appropriate restrictions this choice given to the individuals must be exercised with caution but for the benefit of the people. Legal duties, public interest, public health, safeguarding a woman’s dignity, other legitimate situations must be considered for the right to be forgotten to be exercised. It is the sole responsibility of the Parliament and the Supreme Court to conduct a thorough examination of the right to be forgotten as a right, under Article 19 for balancing the interface between right to privacy and the right to freedom of speech and expression. India, must establish a strong data protection facility but at the same time cautiously place its bets on the digital world.