Right to be Forgotten: An Evolving Right

The Author, Dr. Komal Sandhu is a Professor at IILM Law School, IILM University, Gurugram, Haryana.

"The impact of the digital age results in information on the internet being permanent. Humans forget, but the internet does not forget and does not let humans forget." - Hon’ble Supreme Court in the K. S. Puttaswamy Judgement.

We live in an era where, from the products we purchase to the people we interact with, are verified on the basis of their reviews on online platforms, considering this, if there is a single critical review, a defamatory article or Video one can lose a customer or even worse it can restrict them from living the life they desire. With the rise of the involvement of AI, the issues of deepfake are also on the rise. The growing need for making goods, services and information accessible online has led rise in numerous incidents of false information and fake goods and services. For instance, a businessman gets dragged into a legal battle for bankruptcy for which he, later on, is acquitted, now when he tries to make new deals with potential clients, they withdraw their interest citing the reason that they have read articles declaring him bankrupt. Imagine the amount of ordeal the person has to go through; wouldn’t it be unfair and unjust for him to not be able to practice his profession freely. Section 43A of the Information Technology Act 2000 says that organizations who possess sensitive personal data and fails to maintain appropriate security to safeguard such data, resulting in wrongful loss or wrongful gain to anyone, may be obligated to pay damages to the affected person.

Right to be forgotten

Right to be forgotten (RTBF) also known as the "right to erasure" is an evolving concept in India, where an individual could seek to remove or delete online posts that is accessible to the general public, containing any picture, video or news article mentioning their personal information that may cause damage to their reputation in any manner if the details are judged to be inadequate, irrelevant or no longer relevant or excessive.

Development of RTBF in EU

It was in the year 2014 when the European court of justice acknowledged the right to be forgotten for the first time in the case of, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, it was held that “Processing of personal data carried out by the operator of a search engine is liable to affect significantly the fundamental right to privacy and to the protection of personal data when the search by means of that engine is carried out on the basis of an individual’s name, since that processing enables any internet user to obtain through the list of results a structured overview of the information relating to that individual that can be found on the internet — information which potentially concerns a vast number of aspects of his private life and which, without the search engine, could not have been interconnected or could have been only with great difficulty — and thereby to establish a more or less detailed profile of him. That is all the more the case because the internet and search engines render the information contained in such a list of results ubiquitous. In the light of its potential seriousness, that interference cannot be justified by merely the economic interest that the operator of such an engine has in that processing. A fair balance must be sought in particular between the legitimate interest of internet users in access to information and the data subject’s fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.”[1]

The Court found that European data protection law gives individuals the right to ask search engines like Google to delist certain results for queries related to a person’s name. In deciding what to delist, search engines must consider if the information in question is “inaccurate, inadequate, irrelevant or excessive,” and whether there is a public interest in the information remaining available in search results. Endeavours have been made in the European Union to consolidate the right to be forgotten. The Data Protection Directive was a European Union directive passed in 1995 to govern the exemption of personal data within the EU. It is a crucial part of EU privacy and human rights law. Following that, in April 2016, the General Data Protection Regulation (GDPR) was enacted, superseding the Data Protection Directive, 1995.

Article 17 of the General Data Protection Regulation (GDPR) states, “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies. “Undue delay” is considered to be about a month. In Article 17, the GDPR outlines the specific circumstances under which the right to be forgotten applies. An individual has the right to have their personal data erased if:

• The personal data is no longer necessary for the purpose an organization originally collected or processed it.
• An organization is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws their consent.
• An organization is relying on legitimate interests as its justification for processing an individual’s data, the individual objects to this processing, and there is no overriding legitimate interest for the organization to continue with the processing.
• An organization is processing personal data for direct marketing purposes and the individual objects to this processing.
• An organization processed an individual’s personal data unlawfully.
• An organization must erase personal data in order to comply with a legal ruling or obligation.
• An organization has processed a child’s personal data to offer their information society services.

However, an organization’s right to process someone’s data might override their right to be forgotten. Here are the reasons cited in the GDPR that trump the right to erasure:

• The data is being used to exercise the right of freedom of expression and information.
• The data is being used to comply with a legal ruling or obligation.
• The data is being used to perform a task that is being carried out in the public interest or when exercising an organization’s official authority.
• The data being processed is necessary for public health purposes and serves in the public interest.
• The data being processed is necessary to perform preventative or occupational medicine. This only applies when the data is being processed by a health professional who is subject to a legal obligation of professional secrecy.
• The data represents important information that serves the public interest, scientific research, historical research, or statistical purposes and where erasure of the data would likely to impair or halt progress towards the achievement that was the goal of the processing.
• The data is being used for the establishment of a legal defense or in the exercise of other legal claims.

Additionally, if an institution can demonstrate that a request to remove personal data was unreasonable or baseless, it may charge a "reasonable fee" or refuse the request altogether.

If Google challenges a data protection agency's ruling, it can be subject to legal action. Google has been asked to execute delinking requests from EU nationals on all international domains by the European Union.

Development of RTBF in the USA

The United States of America has an evolved general set of laws that defends its residents’ protection. The State of New York was quick to acquaint a draft “right to be forgotten” Bill A05323 in its State Assembly, named “An act to amend the civil rights law and the civil practice law and rules, in relation to creating the right to be forgotten act.”

The United States has very few rights to be forgotten, especially considering that they are in direct opposition to the first amendment of the US Constitution, which guarantees the freedom of speech and expression. This is especially true despite strong opposition. It is therefore argued that the right will unavoidably result in yet another kind of restriction.
Evolution of RTBF in India

In the year 2017 the Hon’ble SC, through its judgment KS Puttuswamy v UOI made the right to privacy a fundamental right, one of the various facets of this right includes the “right to be forgotten”.

Section 43A of the Information Technology Act, 2000 says that organizations who possess sensitive personal data and fail to maintain appropriate security to safeguard such data, resulting in wrongful loss or wrongful gain to anyone, may be obligated to pay damages to the affected person.

In “Jorawer Singh Mundy vs Union of India”, an American citizen approached the Delhi High Court in 2021 seeking the removal of all publicly available records of a case registered against him under the Narcotics Drugs and Psychotropic Substances Act, 1985. He argued that although the trial court acquitted him back in 2011, he was unable to find a job in the United States on account of a quick Google search showing the judgment in his case.[2] 

The Kerala High Court in the case of V Shylu v. UOI opined that search engines like Google cannot claim to be mere intermediaries with no control over the content that appears in search results.

In V. v. High Court of Karnataka, the right to be forgotten was acknowledged by the Karnataka High Court. The goal of this lawsuit was to have the petitioner's daughter's name removed from the cause title since it was readily available and would damage her reputation. After ruling in the petitioner's favor, the court issued an order removing the petitioner's daughter's name from both the cause title and the orders. The court held that “this would be consistent with the trend in western countries, where the ‘right to be forgotten’ is applied as a rule in sensitive cases concerning women in general, as well as particularly sensitive cases involving rape or harming the modesty and reputation of the individual concerned”.

Justice BN Srikrishna Committee’s draft Personal Data Protection Bill 2018, introduced this right, that would enable an individual to limit, delink, delete, or correct the disclosure of personal information on the internet that is misleading, embarrassing, or irrelevant. However, the Bill has been reintroduced by the India's Ministry of Electronics and Information Technology ('MeitY'), and it has requested the relevant stakeholders to submit their suggestions and comments upon the Bill.

Section 13 of the Digital Personal Data Protection Bill, 2022, provides for the Right to correction and erasure of personal data; furthermore, clause (d) of sub-section 2 of section 13 states that A Data Fiduciary shall, upon receiving a request for such correction and erasure from a Data Principal erase the personal data of a Data Principal that is no longer necessary for the purpose for which it was processed unless retention is necessary for a legal purpose.

Conclusion

It was stated by the Hon’ble SC in the case of K S Puttaswamy v. UOI that, “privacy, in its simplest sense, allows each human being to be left alone in a core which is inviolable. Yet the autonomy of the individual is conditioned by her relationships with the rest of society. Those relationships may and do often pose questions to autonomy and free choice. The overarching presence of state and non-state entities regulates aspects of social existence which bear upon the freedom of the individual. Right to privacy is an integral part of right to life. This is a cherished constitutional value, and it is important that human beings be allowed domains of freedom that are free of public scrutiny unless they act in an unlawful manner.”[3]

The importance of the right to be forgotten cannot be emphasized enough, especially when the information is unnecessarily hampering the livelihood of an individual or is an inhibition to a person’s right to live with dignity, nonetheless, if the information is in the interest of the public, then, the societal interest must prevail over an individual’s interest.

References:

[3] K S Puttaswamy (Retd.)V Union Of India And Ors., 2017