top of page

Right to Be Forgotten


Introduction

Amidst the current demanding and strenuous circumstances, work from home (WFH) has become synonymous to our daily routine. Resultantly, most of the businesses have shifted to an online mode of working rather which has increased the data of each company and individuals to be posted and shared on the internet. This data can be used for multiple purposes, but the data principal can have a detrimental effect if it is used for any other purpose for which no consent was provided by such data principal. In an unpleasant situation as a result of misuse of such data, the data principal might face problems of embarrassment, social hostility, etc, due to his personal data usage. In the case of K.S. Puttuswamy v. Union of India (‘Puttuswamy’), the Supreme Court in its Nine-Judge Constitution Bench unanimously held that the Right to Privacy is a fundamental right of every individual under Article 21 of Right to life and personal liberty of the Indian Constitution. It was also held that the Right to privacy is not an absolute right and can have reasonable restrictions. However, in recent times, a lot of personal data have been leaked as well example, Air India, Dominos Pizza, etc, which directly infringes the Right to privacy of the customers. Therefore, privacy cannot be protected ab initio, but a right to individuals could be granted to erase their data that might be harmful.

Origin of Right to be Forgotten

The right to be forgotten emerges from the Right to Privacy. From an international perspective, the Right to Privacy was first traced in the various treaties and Conventions. The European Convention on Human Rights (ECHR), 1950, International Covenant on Civil and Political Rights (ICCPR), 1966, talks that there should not be any interference in individual privacy. A data protective directive was also passed by the European Parliament in 1995, which aimed at giving people the Right to Privacy and the Right to be forgotten. Articles 6(1)(e) and 12(b) of the directives talk about the personal data should be used only to achieve the purpose of collecting the data and allows the erasure of data that doesn’t comply with the directive, respectively. Therefore, the Right to be forgotten is a facet of the Right to privacy. This Right to be Forgotten was acknowledged recently in 2014 after the popular case of Google Spain v. Agencia Española de Protección de Datos (‘Google Spain case’).


In the Google Spain case, the European Court of Justice introduced a new right i.e., “Right to be Forgotten”. The court interpreted the data protection directive of 1995 and held that the data principle/subject can ask the search engines to compel their personal information from the online database. Therefore, it was implicitly recognized right for the first time since 1995. There was a lot of criticism where critiques argued that the right to privacy was given overrides the right to information. Even a few Indian authors argued that a balance between the right to privacy and the right to information will be a win-win situation for both the data principal and the public. But however, this balance was very difficult to attain and it will depend on a case-to-case basis. The European Union (E.U.) adopted a new General Data Protection Regulation (GDPR) in 2016, which came into effect in 2018. Article 17 of GDPR lays down the right to erasure or be forgotten, wherein the data principal is allowed to demand erasure of his personal data on certain conditions like withdrawal of consent, data being used unlawfully, etc. However, this right to be forgotten is not absolute and has certain conditions attached to it, wherein in certain situations it becomes impossible to exercise this right like to uphold the right to freedom and Right to Information or when such data is necessary for public health.

The legal framework in India

In the Indian context, at present, there is no specific law that protects the personal data of data principals and which recognizes their right to be forgotten. Currently, only the Information Technology Act, 2000 and the rules under its deal with data protection very briefly. After the Puttuswamy judgement and introduction of GDPR in the European Union, a need was felt in India as well to have separate legislation on data protection and granting the right to be forgotten to the data principal, which was similar to the right to erasure in the GDPR. Therefore, a committee was formed, headed by Justice B.N. Srikrishna, which gave a draft on Personal Data Protection in 2018. This was the first time in India where the right to be forgotten was given statutory recognition. The draft was introduced by the government as a Bill in the Parliament with some minor changes in the draft of 2018 as Personal Data Protection Bill, 2019 (‘PDPB’). However, the Bill could not be passed and was referred to the Parliament’s Committee for giving their inputs on the Bill for further changes. Section 20 of the PDPB allows the data principal a right to be forgotten in which they can restrict the continued disclose of their personal data in certain situations. These situations are:

  1. Data has served its purpose;

  2. Data principal wants to withdraw his consent; and

  3. When disclosure of personal data violates any existing legislation.

An application has to be filed by the data principal to the Adjudicating Officer who is appointed under Section 62 of PDPB by the Central Government. It is then upon the Adjudicating Officer to decide whether this right should be exercised which includes the sensitivity of personal data, its role in public life and the nature of disclosure. However, if the GDPR is compared with the PDPB, the right to get the data removed in GDPR can be done by connecting with the controller of data, whereas in India, it is the right with the Adjudicating officer and not with the data controller.


Indian Judiciary on Right to be Forgotten

At present, as the PDPB is yet to be enforced, there have been certain judicial precedents in India that talk about the Right to be Forgotten.

  1. In the case of Dharmraj Bhanushankar Dave v. State of Gujarat(‘Dave case’), the Petitioner seek remedy under Article 226 of the Indian Constitution for removal of the judgement from Indian Kanoon and other online databases as it was a ‘non-reportable judgement’. Petitioner further claimed that this has violated his Right to life and personal liberty guaranteed by Article 21 of the Indian Constitution. The court observed that “The judgement in appeal is part of the proceedings and the said judgement is pronounced by this Court and therefore, merely publishing on the website would not amount to same being reported as the word “reportable” used for judgement is in relation to it being reported in a law reporter.” Therefore, there was no legal basis on which the court would have ordered the removal of this judgement.

  2. The Karnataka High Court dealt with the similar issue of Right to be Forgotten in the case of Sri Vasunathan v. The Registrar General. A writ petition was filed by a father who seeks the order to block his daughter’s name from an earlier order passed by the same court. This case was filed because the judgement was freely available on online platforms which affected the goodwill and reputation of his daughter in society. The Court found that “This would be in line with the trend in western countries of the ‘right to be forgotten’ in sensitive cases involving women in general and highly sensitive cases involving rape or affecting the modesty and reputation of the person concerned.” So, the court ordered the registry to hide her name from the case and ensure that it does not reflect her name in the public domain.

  3. In order concerning the case of Beena T. Cherian v. Chief Information Commissioner in February 2017, the Kerala High Court ruled in favor of Right to be Forgotten. This was a similar case to the Dave case, where the case was filed for protecting the identity of the individual in previous cases available on online search engines including Google and Indian Kanoon. The court directed Indian Kanoon to remove the name of the person from all such orders.

  4. In a recent case of Zulfiqar A. Khan v. Quintillion Businessman Media Pvt. Ltd.& Ors. (‘Zulfiqar case’), where the Delhi High Court adjudicated on the matter seeking removal of some posts from The Quint which were posted in wake of the #MeToo movement. The order was passed by a single-judge bench (Justice Singh) who found that the Right to be Forgotten is a facet of the right to privacy. Therefore, the court ordered the immediate removal of all such content from the website which had the petitioner’s name on it. Also, the right to erasure was used against third parties in this order. However, this order faced a lot of criticism especially for failing to balance the ‘Right to Privacy’ and ‘Right to Information’ and ‘Right to Freedom of Speech’.

  5. The Orissa High Court faced an issue that dealt with the Right to be Forgotten. In the case of Subhranshu Rout v. State of Odisha, Justice S.K. Panigrahi discussed the applicability of the Right to be Forgotten which lacks legislative backing in India. So, without clear legislation on this, it was difficult for the court to adjudicate on technical nuances. The court dealt with this issue because the accused had uploaded sexual assault data on social media and the victim wished for the removal of such data. The case was not filed in form of a Writ Petition, so the victim couldn’t get appropriate benefits from the court. However, Justice Panigrahi recognized that the right to privacy of the victim is being violated and there is an urgent need to have appropriate legislation to protect the personal data of data principals. Therefore, this case will be an obiter, instead of having a precedential value.

The recent order passed by the Delhi High Court – Custom v. Jorawar Singh Mundy

Mr. Jorawar Singh Mundy (‘Petitioner’) was an American citizen by birth. The Petitioner seeks for removal of an earlier reported judgement by the Delhi High Court in the case of Custom v. Jorawar Singh Mundy (‘Custom Case’), so he filed a writ petition under Article 226 of the Indian Constitution. The Custom Case was filed against the Petitioner when he had visited India in 2009, under sections 21(c), 23 read with 28 and 29 of Narcotics Drugs and Psychotropic Substance Act, 1985 (‘NDPS Act’) for shipment of narcotic drugs and psychotropic substances. The trial court acquitted the Petitioner in its verdict on 30th April 2011. An appeal was filed by the concerning authorities in the Delhi High Court, but the it affirmed the decision of a trial court in its judgement on 29th January 2013.


The Petitioner returned to the US for pursuing graduation in law. He faced a huge disadvantage in getting a job opportunity as the Delhi HIGH COURT decision was freely available on the internet, and all the details of that case could easily be found with just a Google search. Therefore, he sent a legal notice to Google India Private Ltd., Google LLC, Indian Kanoon, and vLex.in. However, only vLex.in acted upon the notice and deleted the judgement from its portal. As the judgements were not withdrawn from other portals, the Petitioner filed a writ petition in Delhi HIGH COURT, requesting for deleting the judgements from all respondent sites under his Right to be Forgotten which is the facet of Right to Privacy.

Delhi High Court : Interim Order

The Delhi High Court on 12th April 2021, headed by Justice Singh, a single judge bench, passed an interim order in the favour of the petitioner. The Court considered the issue of whether their previous order can be removed from the online platform considering the Right to Privacy of the Petitioner on one hand, while Right to Information of the public along with maintaining transparency in judicial records on the other. The issue requires checking which right overrides the other. A similar question had to be considered by the Adjudicating Officer given under the PDPB, 2019 while deciding whether the restriction on continued disclosure of personal data overrides the right to freedom of speech and expression as well as the Right to Information of the public. The court while passing the order briefly touched upon the judgement of the Supreme Court in the Puttuswamy case, and the earlier orders of different High Court in the Subhranshu case and Zulfiqar case.


The Court while in its reasoning mentioned that in the case of where Petitioner was charged under NDPS, the charges against him couldn’t be proved but he suffered irreparable prejudice in his social life and career prospects. Therefore, the court took a minimalistic approach and held that prima facie the Petitioner should be granted some interim protection. In its order the Delhi High Court directed the Google India Private Ltd. and Google LLC to remove the Custom Case judgement from the Google search and Indian Kanoon was directed to block the judgement of Custom Case from being accessed until the next date of hearing.


Analysis of Delhi High Court Order

Basis the Order passed, there are several observations made as follows, in relation to the Order passed, and its critical analysis.

  1. It is observed, that the Judge made a prima facie review of the question under deliberation. There was no effort taken by the court for deriving a balance between the right to privacy of the petitioner including the right to be forgotten as its facet and the public’s right to freedom of speech and right to information along with maintaining transparency in the judicial records. Such a situation where there is a visible lack of balance will lead to many cases being filed in the court for the removal of judgements available on the internet due to their right to privacy.

  2. The Puttuswamy judgements through all the opinions on the fundamental right to privacy provide that it is a fundamental right that is not absolute. The PDPB through section 20 provides that there needs to be a balancing exercise where it is to be shown that the right to privacy overrides the right to information and the right to freedom of speech of the public along with the State’s legitimate interest to portray such information.

  3. Advocate Gautham Bhatia, a Yale-Oxford Rhodes Scholar in his blog on talked about the fundamental right to privacy and its application. He was of the view that it is not possible to have a ‘horizontal application’ (Exercising individual rights against the private person instead of the State) in the case of the right to privacy. Instead, the application of all the fundamental rights has a ‘vertical application’ (exercising of individual rights against the State). Therefore, it is not justified to have filed a case under the writ jurisdiction where the remedy is sorted from private entities. So, the order of the Delhi High Court seems to be unreasonable as they can’t direct private entities like Google or Indian Kanoon until the constitutional question is adjudicated.

  4. The Supreme Court in the case of R. Rajagopal v. State of Tamil Nadu held that the court records are public documents and the fundamental right to privacy cannot be used to prevent publication of court records. Even though this judgement came much before the Puttuswamy case, but to date, this law is a good law and it can be changed only after a re-examination of the case after the Puttuswamy case. Therefore, at present, it is settled law. So, the Delhi High Court has allowed blocking their earlier judgement from the online database is in direct contravention of the Supreme Court’s decision.

  5. The position of law that was held in the Dave case by the Gujarat High Court contradicts with the position of law in the Delhi High Court’s order in the Mundy case. This conflict between the decisions of various High Courts often leads to judicial incoherence and confusion.

Conclusion

The Right to be Forgotten has emerged from the Right to Privacy all over the world. In India, this right is recognized by the PDPB wherein it allows the data principal to get his personal information deleted from the online database. However, this Bill is still pending in Parliament for approval since 2019. Also, the concept of Right to be Forgotten should not confused with the Right to Erasure, which is also provided the PDPB. Right to Erasure provides the right to (i) get corrected inaccurate or misleading personal data, (ii) get completed any incomplete personal data, (iii) get updated personal data that is out-of-date, and (iv) get erased personal data which is no longer necessary for the purpose for which it was processed. However, under PDPB the Right to be Forgotten, every data principal shall have the right to restrict or prevent continuing disclosure of personal data (relating to such data principal) by any data fiduciary if such disclosure meets any of the following conditions in relation to the personal data: (i) has served the purpose for which it was collected or is no longer necessary; or (ii) was made on the basis of the data principal’s consent and such consent has since been withdrawn; or (iii) was made contrary to the provisions of the personal data protection act or any other law in force, Unlike the Right to Erasure, a Data Principal’s Right to be Forgotten can only be enforced by an order of the Adjudicating Officer under the PDPB.


The above observation made shows that the order passed by Justice Singh at prima facie is conflicting to certain precedents as well as some of the constitutional rights. The fact that the judicially recognized right to be forgotten is being given more importance than the constitutional right guaranteed under Article 19(1)(a) of the Indian Constitution seems to be unreasonable. Nonetheless, it is the first time the court has allowed erasure of the data where the charges involved the NDPS act, which had the potential to harm the reputation of individuals. To prevent the harm to reputation as agreed by various judges dealing with the right to be forgotten, a personal data protection act that explicitly talks about this right is the need of the hour.

– Harshul Bangia & Anupam Prasad

 
 

Follow LexTalk World for more news and updates from International Legal Industry.

 







66 views

Comments

bottom of page