Right to be Forgotten on Internet: Absolute or Flexible?

The Author, Parth Verma, is a 1st year BBA LLB student at Christ University, Bengaluru. He is currently interning with LatestLaws.com.

Abstract

The constitution of India provides certain Fundamental Rights to the citizens that are absolute in nature and can’t be violated under any circumstances such as the Right to Life and Personal Liberty under Article 21. Among these rights, the Right to be Forgotten is also aimed to be included. This right has been included under the Personal Data Protection Bill, 2019 and till now it hasn’t been lawfully recognised as a right available to the general public[1]. Yet, the Court has referred to this right several times in different cases to arrive at the judgements.

With the coming up of various social media platforms where information spreads like fire, this right has come into the so called ‘limelight’ of the public. This Right exclusively states that “the personal information of any person could be deleted or modified on a social media platform or any other source if it is not necessary or relevant in the current times.”

However, this right still doesn’t have any legal backing which would be discussed in detail in the later sections. So why has this right become so necessary in the modern times? Why is it still not a legally recognized as a Fundamental Right? What are the objectives of the Personal Data Protection Bill, 2019 of which this right forms a part? This Article shall aim to answer all these and several other questions.

Introduction

The Right to be Forgotten has been defined under the Personal Data Protection Bill, 2019 which hasn’t been passed yet by the Parliament. As a result, this right also doesn’t have any legal backing despite being the need of the hour in current times. It has to be included as a part of the Fundamental Rights under the Article 21 of the Indian Constitution if it is to be legally binding upon the courts.

At the Global Level, it has been recognized as a statutory right in different parts of the world such as the European Union which follows the General Data Protection Regulation Laws (GDPR). However, in India it has still not been recognized as a legal right of the citizens and the courts use at their own discretion in different cases. These courts refer to the laws prevailing at the International Level such as GDPR to arrive at the decisions for providing justice in appropriate cases.

The GDPR laws state that the data under consideration should have the right to obtain from the controller (person or entity that publishes the information) the permanent erasure of personal information that is no longer relevant without undue delay (within a month). This law has been used by the Indian Courts to resolve the disputes and to provide fair justice. There are several reasons for which this right, despite becoming very important in current times of growing internet has not been introduced as a Fundamental Right, that would be discussed in greater detail in later part.

Therefore, it can be stated that till now the decisions regarding the Removal of Personal Data in appropriate circumstances have been taken at the discretion of the courts using the laws at the International Level. Hence, some urgent action is required to provide safeguards against the same so that fair and equitable justice is provided to all.

Position in India

Background

In India, as stated earlier, the Right to be Forgotten on Internet has not been given a legal backing and hence it is still not recognized. This right is contained in the Personal Data Protection Bill, 2019 which states that “an individual has the ability to delink, delete, limit or correct the personal information on the internet which is irrelevant or misleading in any manner.” This right aims to ensure the privacy of the users of the social media websites and to protect their other fundamental rights.

The question of the privacy of citizens arose for the first time in the case of Kharak Singh v. State of UP (1964)[2] where the court declared that Right to Privacy is an absolute right available to the citizens of the country under Article 21 which couldn’t be taken away from them in any circumstance. It also held that this includes the ‘Right to be let alone’ and to ensure public safety. No one is allowed to publish the personal information of an individual without their permission subject to certain reasonable restrictions.

The same point was stated by the Supreme Court bench in the case of Justice KS Puttaswamy v. Union of India (2017)[3] whose judgement has been a quite recent one just before the Right to be Forgotten came to the knowledge of the general public. Yet the stance regarding the erasure of information once it has been published on the internet for ensuring privacy of the citizens wasn’t specified in both these cases. In the cases involving the Right to be Forgotten, these cases were not of much help and hence the courts were required to follow the International Law to arrive at the judgements. Hence, it can be stated that this Right is very important to protect the right to privacy of the persons on the internet due to lack of any other statutory provision as well.

However, it has been felt on the other hand that certain information is required to be stored by the Government or the Courts to uphold the Right to Information of the citizens of the country. Further, it has also been declared by the court that this right is going to be violative of the right to Press Freedom and the Freedom of Speech and Expression. This is so because it would reduce the scope of investigating and to research about the information published on internet that is in the interest of the general public.

There might be certain information on the Internet that is prima facie defamatory to the person or abusive of their rights when they have been falsely accused in a criminal case. The power would now lie in the hands of the entity or person who publishes this content. They in turn might exploit it which would go against the rights of the sufferer and might cause them certain damage to reputation or even job position in several cases.

Case Laws

This has been seen in a large number of cases in the current times but the different courts interpreted this right in their own different perception. Since there is no codified law or right in this regard, this could happen very frequently where the courts at the same level could give different rulings for cases having a similar set of facts. This in turn won’t ensure fair justice to the citizens of the country which is the basic purpose of any law. In the recent years there have been contrasting judgements given by the High Courts in Gujarat and Karnataka relating to the ‘Right to be Forgotten’ having the main focus on the publishing of information on internet in an unlawful manner[4].

In the case of Dharamraj Bhanushankar Dave v State of Gujarat and Others (2017)[5], the reasoning of the High Court of Gujarat didn’t duly recognize the ‘Right to be Forgotten.’ With respect to the facts of the case, the petitioner was charged of various criminal offences such as Culpable Homicide not amounting to murder. The main concern of the petitioner was that this information in the case was declared to be non-reportable by the court yet it could be easily accessed on the different websites on the internet. The petitioner contended that this was clearly violating his Right to be Forgotten and was also affecting his personal and professional life. However, the court declared in this case that the judgement published on any website won’t come under the purview of ‘reportable’ and would be required to ensure the Right to Information of the citizens of the country. The Judgement is relevant in all respects to be known by the general public and hence the state has the lawful right to publish the same.

However, in another similar case, a contrasting judgement was delivered by the High Court of Karnataka. In the case of Sri Vasunathan v. The Registrar General (2017)[6], the court recognised the Right to be Forgotten of the Petitioner and passed the Judgement in their favour. In this case, the petitioner was a lady who had filed a petition against a person who was involved in several heinous crimes such as forgery and compelling to get married. Both parties adopted an out-of-court approach to resolve the dispute. However, still her name was getting reflected at the online portal under legal disputes.

As a result, the father of the petitioner asked for the removal of the petitioner’s name from the portal as it was violative of her privacy and brought her into negative light in the eyes of the public. The court adopted a route which focused on the issue that regardless of the power of Registrar to publish any judgement on any given platform, the other approach was adopted and this published information went against the moral decency and ruined the character of the lady. Since it was a very sensitive issue that could adversely impact the personal and social life of the lady, the Court asked the Registry to hide the name from all the online portals. It was subject to the condition that if an RTI is filed or a copy is asked for, then the petitioner’s name would be required to be reflected.

The two judgements as stated earlier were contrasting from one another. However, this also had a reason. In the first case above, the petitioner had already been convicted by the sessions court. He also couldn’t have availed the defence that his privacy was being violated as the act carried out was within the lawful powers of the Registrar General. Hence the petitioner in this case wasn’t able to avail his ‘Right to be Forgotten’ primarily due to his own wrongdoing.

In the other case though, the lady was facing the suffering due to a case for which she had been involved but in whose favour the decision had been passed. Despite no fault of her own, she was suffering in her social and personal life. Therefore, there was actually a need to protect her character and ensure some moral decency, for which they passed the judgement in her favour. The bench believed that this was a much more sensitive issue and hence some leeway should be given to the lady.

The most recent judgement that again brought this topic into prominence was in the case of Ashutosh Kaushik v. Union of India and Others (2021)[7]. In this particular case, the petitioner Ashutosh Kaushik had filed a petition in the Delhi High Court under Article 226 for the respondent authority to remove all the videos, posts and online content available for his diminutive act of drunken driving in 2009. He had been a Roadies Winner and acted in many films due to which this content was viewed by many of his fans which created a negative impression on his fans about him. However, this act had been committed a decade ago and the content posted at that time was irrelevant in the present circumstances and was affecting him psychologically and caused him mental pain.

The High Court of Delhi in this case relied upon the Judgement in the case of Jorawar Singh Mundy v. Union of India and Others (2021)[8] which declared that if any information on the internet which is irrelevant or inaccurate in the current scenario could be removed or erased to protect the rights of the person affected due to the same. Therefore, the Court declared that the information is to be removed by Google regarding the diminutive acts of the Petitioner in 2009 and 2013 for they were not relevant now and unnecessarily brought him into negative light.

From all these cases it can be concluded that to some extent, courts have recognized this right of the citizens despite it not being recognized statutorily. At the same time, there will also be a need to ensure that it doesn’t provide an undue advantage to the petitioner because then they could easily escape from the eyes of the public. The issue regarding the introduction of this Right among all the other rights under Article 21 and whether this right should be absolute or flexible in nature would be discussed in detail in the coming sections.

Position at the Global Level

Background

At the International Level, the Right to be Forgotten was derived for the first time from the European data protection laws. In 1995, the European Union issued a Directive on Data Protection which stated that the personal information of any person could be removed in case the person deletes his/her account on the website or platform. This laid down the foundation stone for the development of the concept of the ‘Removal of Personal Data’ and became very important to protect the rights of the individuals. The data of an individual can also be processed i.e removed or modified so that it doesn’t violate their ‘Right to Privacy.’ It could also be subject to certain conditions such as Transparency, Proportionality and a Legitimate Purpose.

Later on, the Google Spain Case (Google Spain SL and Google INC v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González)[9] in 2014 further led to the developments in this issue of the ‘Right to be Forgotten’ and broadened the scope of this concept through its interpretation. In this case the Court of Justice of the European Union (CJEU) declared that within the right of the people to request the erasure of their information, they also have the right to delink their information. It essentially means that the person can request the search engine to delist several links that contained some personal information which is irrelevant or inaccurate. However, this law declared by the court proved to be very difficult to execute by the search engines. This was so because Google was receiving millions of requests to delist their links on the search engine that became very difficult to execute.

Furthermore, it had several ambiguities and loopholes. It was unclear regarding whether all the content would be delisted or some review would be required. While on one hand, there is a need to protect the privacy of the individuals, there is also a need to ensure that it doesn’t become a threat to other important rights such as the Right to Information and Right to Freedom of Speech and Expression. Therefore, not all the requests could be accepted as some may even go against the interest of the general public. Despite all its drawbacks, this judgement has proved to be very vital in deciding the cases involving the ‘Right to be Forgotten’ with a greater ease.

Global Data Protection Rules, 2016

On the basis of this judgement stated above, later on the European Union introduced the Global Data Protection Rules (GDPR) which raised a significant interest regarding the issue of the ‘Right to be Forgotten.’ The GDPR has 11 chapters ranging from the duties of a controller, rights of the data subject to the general provisions regarding the data protection and the privacy of the users. The controller in this case refers to the individual or the entity that has the power to regulate the content and is involved in the collection and publishing of the data of the residents in the European Union.

These regulations are common to all the members of the European Union and they are required to have separate Supervisory Authorities. These authorities are required to supervise which content should be erased so that the Right to Information and Freedom of Speech and Expression of the people are ensured. The procedure under this section has been kept flexible to achieve a good balance between the privacy of the individuals and the Freedom of Speech and Expression across the internet. Even if the controller belongs to some other country outside the European Union but the person whose data is to be removed or processed belongs to a country in the European Union, these regulations would still apply on the processor. In the case of Google v. CNIL (Commission nationale de l’informatique et des libertés)[10] in 2019, it had further been declared by the Court that the jurisdiction to which this law shall apply and the right which the processor will get to delist would only be restricted to the members of the European Union.

This regulation has certain provisions which are analogous with the provisions under Article 21 consisting of the Fundamental Right to Life and Personal Liberty. Under Articles 2(2) and 88 of GPDR, it has been stated that this processing of data further is going to be subject to national security and in context of the employment. While drawing its analogy with the Right to Privacy under Article 21 in India, there are also certain reasonable restrictions that could be imposed upon the privacy of the individuals. One of them is also for ensuring the national security and the sovereignty of the country which is the same as given in the GDPR.

While only the content which is genuinely harming the privacy of the individual is to be processed, the responsibilities of the processor have been defined under Article 24 of the GDPR[11]. They need to ensure that the processing is in compliance with the regulations using suitable technical and organizational measures. For ensuring fair and transparent processing, a proper code of conduct is imposed upon the controller under Article 40 of the GDPR. Article 42 further talks about the certification mechanisms or the seals for further ensuring some compliance on the part of the controller regarding the various regulations.

At the International Level, these regulations have been the most comprehensive and have played a very important role in spreading this topic throughout the world in the different countries. Beginning from 1995, the Right to be Forgotten has come a very long way at the International Level and has spread awareness in countries from Brazil and India to Japan and Canada. There are still several loopholes in the current GDPR which are required to be clarified and it remains to be seen how it is going to impact the countries outside the European Union further in the coming years.

Should this Right be Absolute or Flexible?

The Right to be Forgotten till now has not been made a right of the citizens of India. It is contained under the Personal Data Protection Bill, 2019 which is yet to be passed. However, as seen in the various cases especially in India where the character of a person and his/her privacy and reputation were brought in question, this right has played a very important role in providing them justice. This right if introduced will fall under the Right to Life and Personal Liberty under Article 21 of Constitution of India. It provides a person with the assurance that they won’t suffer because of the content that has been published online regarding them through its removal in appropriate circumstances.

However, this erasure of information should also be subject to certain conditions such as the information should be irrelevant in the current situation to the general public. Further, certain information is required in the public interest and to uphold their Right to Information even if it goes against the privacy of the individuals. The erasure of all the information can also violate the Right to Freedom of Speech and Expression as the media persons will be deprived of their right to research on a given topic due to lack of information. It can hence have an adverse impact on press freedom and quality of media reporting in the country. Whereas several cases could arise in which the information is necessary to be published on the internet and needs to be stored especially the matters of public importance.

For example, a person Z commits a crime and has been convicted by the Court for the same. Later on, even when he is released after serving his punishment, his name would still remain on the internet under the case that has been published on the Internet. This would be required for the future reference to the courts in the different cases and also for the purpose of public knowledge. Even if it leads to a bad reputation of that person and causes some problems in his professional life, the information still will not be erased from the internet as it’s for the general interest of the public. The Fundamental Rights of the Public will always supersede the rights of an individual. In other words, societal interest is more important and should in most cases be given priority over the interest of an individual when he/she is only at fault.

Therefore, it can be concluded that the Right to be Forgotten should be flexible in nature so that fair justice can be provided on a case-to-case basis. If it is absolute in nature, it may give an unfair advantage to the person and would be violative of the Fundamental Rights of the general public. Thus, it should be flexible enough to be suitably modified according to the facts and circumstances of the different cases.

Conclusion

The Personal Data Protection Bill, 2019 has already been in consideration in the Parliament for long. With the various debates taking place regarding the same, it is expected that the Right to be Forgotten is going to be introduced only after the Parliament is fully assured of an effective balance between the this right and the Right to Information of the public. Further, even the introduction of this right under the Fundamental Rights could be a complicated process because for the same the PDP Bill would be required to be passed.

Secondly, it aims to protect the privacy of the individuals and while doing the same, it could restrict the Right to Freedom of Speech and Expression. As a result, Privacy would be needed to be added as a reasonable restriction under Article 19(2) under the Freedom of Speech and Expression in the Fundamental Rights. This Right is important especially in these times of Internet.

Yet, the major drawback that could be faced is that once some information is published on the Internet, it spreads like fire and even if erased later on, it would still come to the knowledge of a large number of people and cause a damage to the reputation of a person. Another problem associated with it could be that any information that is of public importance will be published across a lot many platforms many of which can’t be easily found. As a result, the personal information might not be capable of being completely erased.

Regardless of its drawbacks, it becomes vital to protect the Rights of an individual citizen and to prevent them from losing their reputation or harm their personal or professional life. Therefore, there is certainly a need to introduce this right in the interest of the public but at the same time there is a need to achieve an effective balance between this right and the Right to Freedom of Speech and Expression of the general public by making this right flexible to apply it only in appropriate circumstances.

Therefore, it can be concluded that this right should be kept flexible on the internet so that it protects the privacy of the individuals and also upholds the Right to Information of the public and the Right to Freedom of Speech and Expression. With certain developments taking place at the local and the International Level, it remains to be seen how this right is going to be implemented in India in the coming years. There is  still a very high hope despite the uncertainty that this right will certainly be introduced amongst the Fundamental Rights to protect the interest of the public at large.

References

1. Sofi Ahsan, Explained: Right to be Forgotten, The Indian Express, Published on December 27 2021 https://indianexpress.com/article/explained/explained-right-to-be-forgotten-7691766/

2. Jamia Law Journal, Case Commentary: Right to be Forgotten, Volume 3, ISSN No: 2456-2718, (2018)

3. Clement Perarnaud, Right to be Forgotten, Digwatch  https://dig.watch/topics/right-to-be-forgotten/

4. Google Spain Case, Judgement, 2014, 13^th May, Published on Eur-Lex https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62012CJ0131

5. Global Data Protection Regulation: Right to be Forgotten, Intersoft Consulting https://gdpr-info.eu/issues/right-to-be-forgotten/

6. Apoorva and Jigar Parmar, ‘The Fine Line that separates Judicial Transparency and the Right to be Forgotten’, The Hindustan Times, Published on June 24, 2021 https://www.hindustantimes.com/opinion/the-fine-line-that-separates-judicial-transparency-and-the-right-to-be-forgotten-101624521826341.html

7. Kharak Singh v State of UP, (1964) SCR (1) 332, (India)

8. Justice KS Puttaswamy v Union of India, (2017) 10 SCC 1 (India)

9. Dharamraj Bhanushankar Dave v State of Gujarat and Others, 2015 SCC OnLineGuj 2019, (India)

10. Sri Vasunathan v The Registrar General, (2017) W.P. No. 62038/2016 (India)

11. Ashutosh Kaushik v Union of India and Others, (2021) cited from https://lawbeat.in/sites/default/files/2021-07/Ashutosh%20kaushik%20Vs%20Union%20of%20India%20%26%20Ors.pdf (India)

12.Jorawar Singh Mundy v Union of India and Others, (2021) W.P. (C) 3918/ 2020, (India

13. Google Spain SL and Google INC v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, (2014) C‑131/12 (Spain)

14. Google v CNIL (Commission nationale de l’informatique et des libertés), (2019) C-507/17, (France)

Picture Source :