In this modern age, the digital footprint we leave behind becomes a permanent mark on the tapestry of our lives. With just a single click, share, or post our personal information is spread over the enormous digital landscape. Any breach of such personal information invading an individual’s privacy has the potential to have a harmful impact. Owing to digitization of Data, the need for protecting the privacy of individuals is higher than ever. One of the ways this protection can be accessed in today’s day and age is via the grant of the Right to be Forgotten (RTBF) or the Right to Erasure.
RTBF empowers a person to get his/her personal information deleted from search engines, social media or digital platforms (subject to certain limitations and requirements) and by the exercise of this right an individual can protect their data against any harm arising from its misuse. To better understand the ins and outs of the RTBF and the protection it offers, the focus of this article will be on the background of this right, its evolution in the European Union and its current position in India.
Background
Although it did not result in a favorable ruling, the origin of the RTBF can be traced back to the 2009 case of Virgina Da Cunha, an Argentinian musician who had brought a suit against the search engines Google and Yahoo to remove online listings associating her to pornography and prostitution, in Da Cunha’s case however, the Supreme Court of Argentina ruled in favor of the search engines. Another similar case came to light in Europe when Mario Costeja González, a Spaniard filed a case against Google Spain to remove links that associate him with an auction article in a newspaper for his repossessed home. In the case of Gonzalez it was observed that individuals had the right to get their personal information removed from search sites if they are not relevant anymore. Despite the judgements that came before, the concept of RTBF was not recognized by the European Court of Justice till 2014.
With time, as courts across the world recognize the Right to be Forgotten, some jurisdictions are yet to regulate the same and/or provide legislation on this front to enable people to protect their privacy by providing them specific rights to this effect.
I. International Perspective On Right To Be Forgotten
A. European Union:
Although the EU had adopted Data Protection Directive back in 1995 to regulate the personal data within its territory, the rule established in Google Inc. v Agencia Española de Protección de Datos was enshrined in the General Data Protection Regulation (GDPR) only in 2014. After the adoption of this rule in 2018 organizations are obligated under the GDPR to follow the regulations provided for, if they are collecting and processing data of individuals living within the EU even if the organization itself is outside EU.
GDPR exclusively provides for the Right to Erasure under Article 17 which states that a person can get his/her information erased with the help of the Data Controller i.e the individual who deals with erasure of data without any undue delay on any of the following grounds:
(i) Withdrawal of consent given by the data subject;
(ii) Processing information for unlawful purposes;
(iii) Data is not required for the purpose it was collected;
(iv) As per legal obligation information is required to be removed.
It is however pertinent to note that the right to erasure is subject to certain restrictions which include but are not limited to freedom of speech, public health and scientific research.
B. UNITED STATES OF AMERICA
Although there is still no right similar to the RTBF in USA, the state of New York briefly initiated a measure providing individuals with the right to obligate search engines and online aggregators to remove any inaccurate or unreasonable material in relation to them. USA however still lacks any proper legislation in this regard.
II. Right To Be Forgotten in India
Even though there is no prevalent legislation in India which expressly provides for the RTBF the judiciary has time and again tried to clear the issue pertaining to RTBF through various judgements. The question on the RTBF made an appearance before the judiciary, first, in Dharamraj Bhanushankar Dave v. State of Gujarat, where even though the Gujarat High Court did not expressly recognize the RTBF the discussion on the right ensued in India. However, subsequent to the decision of the Apex Court in the matter of Kharak Singh v. State of Uttar Pradesh, the right to privacy was considered a fundamental right protected under Article 21 of the Indian Constitution. Next, in the matter of KS Puttaswamy v. Union of India the court threw light on the RTBF by recognizing it as one of the spheres of the right to privacy provided to the citizens of India under Article 21 of the Indian Constitution.
An examination of the landmark cases on the RTBF in India and the acknowledged standard across the globe establishes the afore stated stance via various judgements:
(i) In Jorawer Singh Mundy v. Union of India, an American citizen who was charged and acquitted under the Narcotics Drugs and Psychotropic Substances Act, 1985 had the judgement of his case published across three platforms namely Google, Indian Kanoon, and vLex.in. As a result of such publications, the reputation and career of the individual in question were severally damaged. In the present case keeping in mind that the individual was acquitted, the Court directed the three respondent parties to remove the judgment name ‘Custom v. Jorawar Singh Mundy’ from the search result across the general search engines. A similar approach was also taken by Delhi High Court in the case of X. v. YouTube where an actor’s explicit video was shared on various video sharing platforms and the court directed that the same be taken down via a reiteration of the RTBF.
(ii) In the matter of Subhranshu Rout v. State of Odisha, the Odisha High Court examined the position and status of Right to be Forgotten and observed that- “information in the public domain is like toothpaste, once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away.”
(iii) The Kerala High Court recently in the matter of Vysakh KG Vs Union of India & Anr, had observed that RTBF cannot be absolute in nature. It must come with certain limitations or restrictions. However, information relating to family and matrimonial cases published on websites must be taken down on request of the parties.
Future Course Of Action:
The Digital Personal Data Protection Bill of 2022 was introduced by the Ministry of Electronics and Information Technology, on the recommendation of the Justice B.N. Srikrishna Committee. The Bill, amongst other rights and obligations also provides the right to correction and erasure of personal data under Section 13, which expressly states that the data principal has the right to correct, complete, update, and erase any inaccurate, misleading, incomplete, or irrelevant personal data which is no longer necessary. The Bill also mandates procuring informed consent from a digital citizen before processing their personal data while also allowing them the freedom to withdraw such consent at any point time. If the consent is withdrawn, then processing of the personal data of such individual will cease and be removed within a reasonable time from all forums. The Bill also casts the duty on the data principal to furnish authentic verifiable information while exercising the right to correction or erasure under Section 13 of the Bill.
Conclusion
While the right to be forgotten is a complex and contentious legal concept with far-reaching implications, various nations have started recognising this right in the interest of protection of the privacy of their citizens. In India, the judiciary has recognized the right to privacy as a fundamental right and RTBF as an instrumental subset of the same. Additionally, with the introduction of the Bill, India is on track to formally regulate the RTBF. However, even if the Bill is converted into an Act, the implementation of RTBF presents unique challenges including but not limited to jurisdictional issues and the requirement of a balance between the RTBF and freedom of speech and expression along with preservation of public interest. It therefore becomes clear, that while the introduction of the Bill is a great step in the right direction, India remains in need for a strong data protection regime that solves these issues while still providing individuals with the right to protect their privacy.
Contributors: Madhu Gadodia, Shaanal Shah and Dayita Panicker