AI And The Right To Be Forgotten - Consumer Data Protection In The Digital Age
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
AI AND THE RIGHT TO BE FORGOTTEN: CONSUMER
DATA PROTECTION IN THE DIGITAL AGE
Vishnu Yadav, Maharashtra National Law University, Nagpur
ABSTRACT
The rapid advancement of Artificial Intelligence (AI) and the increasing reliance on search engines have intensified concerns regarding consumer data privacy. While the European Union (EU) has robust data protection laws, including the Right to Be Forgotten (RTBF) under Article 17 of the General Data Protection Regulation (GDPR), India’s recently enacted Digital Personal Data Protection Act, 2023 lacks explicit provisions addressing RTBF. This research aims to highlight the significance of RTBF in the Indian context, especially given the rise of AI-driven data processing systems. By adopting a comparative analysis approach, the study examines the strengths and shortcomings of the GDPR’s RTBF framework and identifies gaps within India's DPDP Act.
Drawing insights from relevant legal literature, judicial precedents such as the Google Spain case, and technical complexities posed by AI systems, the research explores the feasibility of adapting RTBF principles for India. The findings suggest that incorporating RTBF into the DPDP Act would significantly enhance consumer control over personal data, mitigate privacy risks in AI systems, and align India’s data protection framework with global standards. While the study acknowledges implementation challenges, particularly regarding data deletion from decentralized AI models, it proposes legislative strategies and technological safeguards to ensure effective enforcement. This research is novel in advocating for India-specific RTBF provisions, tailored to address the nation's evolving digital landscape.
The insights offered will benefit policymakers, legal scholars, and data protection practitioners striving to enhance consumer privacy rights in India while ensuring responsible AI governance. Keywords: Artificial Intelligence, Consumer Data Protection, Data Privacy, Digital Rights, Right to Be Forgotten.
1. Introduction:
Computer technologies have developed at an exponential pace and changed the worldwide information environment. On the one hand, it has raised interoperability and information exchange, but on the other hand, it has created fundamental problems of personal privacy and guarding confidential information. Among the various controversies in this new virtual world is the principle of the Right to Be Forgotten (RTBF) aimed at providing the rights of individuals to limit the presentation of their personal data on the Internet. RTBF is one of the primary rights of data protection laws, especially of the European Union (EU), that took up the right in Article
17 of the General Data Protection Regulation (GDPR)1. In contrast, India's new Digital
Personal Data Protection (DPDP) Act, 2023 doesn't mention anything about this right and thereby leaves a big gap in the nation's data protection policy. The aim of this paper is to analyze the contribution of RTBF to India's new digital landscape and see how India can learn from the European Union while making successful legislation on consumer data privacy protection.
1.1 Background (RTBF):
Google Spain Sl v. The concept of RTBF became prominent after the landmark ruling in Agencia Española de Proteción de Detos (AEPD). 2 In 2014, the European Union (CJEU) gave its ruling in the court. In this case, CJEU decided that individuals have the right to request to remove personal information from the search engine results, if such a data is old, wrong, or is no longer relevant to the original purpose for which it was collected. This decision established that search engines act as data controlles under the European Union law, which they are subject to GDPR compliance about data erasing obligations. RTBF under Article 17 of GDPR, formally administered individuals to request to remove their personal data under certain conditions.
These conditions include examples where data for the basic purpose of the collection is no longer necessary, where individually agrees, or where the data was illegally processed. However, RTBF is not absolute; Exceptions exist where compliance with public interest, freedom of expression, or legal obligations can override an erasure request. 1 Regulation 2016/679 of the European Parliament and of the Council, art. 17, 2016 O. J. (L 119) 1 (EU).
2 Google Spain SL v. Spanish Data Protection Agency (AEPD) , Case C-131/12, ECLI:EU:C:2014:317 (CJEU
2014).
In addition to the GDPR structure of the European Union, the California Consumer Privacy Act (CCPA) in the United States provides equal protection to consumers to request their personal data to be removed by businesses. However, the scope and enforcement of RTBF under CCPA varies significantly from the GDPR structure.
1.2 AI, Search Engine and Data Profession Anxiety:
Integration of Artificial Intelligence (AI) in search engines and digital services has revolutionized data processing capabilities, enabling personal material distribution, future stating analysis and targeted marketing. AI systems rely extensively on large datasets, often including personal information, refining their algorithms and increasing accuracy 3. While these progresses have improved user experiences, they have also increased the concerns of privacy, especially about the discovery engine results and frequent availability of older or irrelevant data in AI-operated platforms. The AI system creates unique challenges to apply RTBF. Unlike the traditional database, the AI models can directly embed personal data in your learning model, making it technically difficult to identify and eradicate such data effectively.
This complexity increases concerns about AI's ability to eliminate data privacy violations despite existing legal protection4. As AI models develop, ensuring that the RTBF mechanism extends to the AI-managed data repository, consumer becomes necessary for the protection of privacy.
1.3 RTBF Required in India's Developed Digital Scenario:
India's digital ecosystem has seen more than 700 million Internet users and communication, with significant expansion with rapidly growing dependence on commerce and governance5. The rise of e-commerce, social media and AI-operated services has been processed and stored by unprecedented versions of personal data. Despite these developments, India's data protection structure lacks clear provisions addressing RTBF, which induces serious risk to consumer privacy. 3 Busra Bilsin, Navigating EU Data Protection Law: The Challenge of the Right to Be Forgotten in AI-Driven Text Producers (2023) (Master’s thesis, Vienna Univ. 2023).
4 Mike Ananny & Kate Crawford, Data Erasure Challenges in AI Systems (2018).
5 Subhajit Saha & Surjashis Mukhopadhyay, A New Age of Data Privacy Laws in India , Int'l JL & Soc. Sci. 23 (2024).
The objective of the Digital Personal Data Protection Act, 2023 is to establish a comprehensive data protection framework in India. While the ACT data introduces the principles of minimalization, purpose limit and consent-operated data processing, it fails to provide individuals with the right to request data for data erasure Akin for RTBF provisions under GDPR6. This lapse is looking at online search results and increasing ability to remain in the AI system for old, irrelevant or harmful personal data. In the absence of RTBF provisions, Indian consumers face challenges in using their digital footprint control. This difference leaves individuals sensitive to iconic losses, identity theft and violation of privacy.
As India carries forward its data protection governance, adopting RTBF principles inspired by the GDPR framework of the European Union can provide control to citizens on their personal information. Integrating the RTBF within the DPDP Act will align India's data protection standards with global best practices, ensuring that individuals have a legal mechanism to protect their privacy in the digital age. This paper will further find out how RTBF can be effectively included in India's legal framework, the European Union RTBF model, its implementation in the AI system and its unique digital landscape can be analyzed.
2. Current Legal Structure in India:
The enactment of the Digital Personal Data Protection Act, 2023 is an important milestone in India's developed data protection scenario. With rapid digitization of services and comprehensive data processing in regions, a comprehensive data privacy law was required. While the DPDP Act introduces several necessary provisions to regulate data processing practices and protect personal data, it excludes the clear recognition of the right to forget (RTBF). This lapse presents important concerns for the protection of consumer privacy, especially in the era with artificial intelligence (AI) and advanced data analytics. The following sections examine the framework of the DPDP Act and its gaps related to the RTBF.
2.1 Overview of Digital Personal Data Protection Act, 2023:
The Digital Personal Data Protection Act, 2023 (DPDP Act) was implemented to establish a legal framework for processing digital personal data in India. The Act applies to individual data
6 Digital Personal Data Protection Act, No. 22 of 2023, § 14 (India).
collected both within and outside India and if such data is processed in relation to the offering of goods or services to Indian residents. Its primary objectives include data protection rights for individuals (called data principals) and implementing obligations on institutions that determine data processing objectives (called data fiducials) 7 The major features of the DPDP Act include:- Consent-based data processing: The Act said that data fiducians should obtain independent, specific, informed and vague consent from the data principals before processing their personal data8. Data fedus also need to provide clear notices underlining the purpose of data collection and the rights available for data principal.
Data Principal Rights: Act grants many rights to individuals, including the right to access information about data processing, right to improve and elimination, and the right to grievance. 9 However, the extensive data of the Act GDPR does not provide clearly to the RTBF, unlike the Eraser structure. Data Fedus obligations: DPDP Act implements broad obligations on data fidary, including safety safety measures, ensuring data accuracy, and informing data violations immediately. 10 Data Protection Board: Act establishes India's Data Protection Board, is strong to maintain compliance, handle complaints and apply punishment for violations11. While the DPDP Act reflects positive progress towards improving India's data privacy framework, its failure to include RTBF provisions releases individuals with limited support to control chronic or irrelevant personal information in the digital field.
2.2 Intervals in DPDP Act Regarding RTBF:
The absence of a clear right to forget within the DPDP Act is important challenges in protecting personal privacy. RTBF, as recognized under Article 17 of GDPR, gives individuals the right
7 Digital Personal Data Protection Act, No. 22 of 2023, § 14 (India).
8 Subhajit Saha & Surjashis Mukhopadhyay, A New Age of Data Privacy Laws in India , Int'l JL & Soc. Sci. 23 (2024).
9 Deborshi Barat, An Overview of India’s New Data Protection Law, J. on Governance 24 (2024).
10 Digital Personal Data Protection Act, No. 22 of 2023, § 10 (India).
11 Digital Personal Data Protection Act, No. 22 of 2023, § 18 (India).
to remove their personal data from the search engine, database and other public records under specific circumstances. The following intervals highlight the absence of RTBF in India's DPDP Act:
2.2.1 Lack of Data Erasure Obligations for Search Engines:
Under the GDPR structure, the search engine is designated as data controller and is legally bound to comply with RTBF requests12. Conversely, the DPDP Act search does not apply uniform obligations on the search engine or other online platforms, allowing personal data to remain indefinitely in the search results, even if such data is chronic or irrelevant.
2.2.2 No Clear Mechanism to Remove Data from AI System:
AI systems present unique challenges for data deletion. Machine learning models often integrate individual data directly into their algorithms, making the complete data removal over13. While the GDPR's RTBF provisions address data deletion from such systems, the DPDP Act lacks provisions to eradicate data from the AI-operated repository, leaving Indian consumers without safety measures in such scenarios.
2.2.3 The Absence of the Legal Framework for the Requests for D-Indexing Requests:
To request de-indexing of individual information from RTBF law search engine and other publicly available database14 under GDPR strong persons. Such D-Indexing provisions ensure that old or defamation information is not accessible. The DPDP Act fails to provide a comparable mechanism for individuals wishing to limit public access to harmful or irrelevant data.
2.2.4 Inadequate Security Against Reputed Losses:
The absence of RTBF limits Indian consumers' ability to reduce reputed damage caused by chronic or misleading data. The RTBF framework of GDPR allows individuals to protect their 12 Paul Voigt & Axel von dem Bussche, The EU General Data Protection Regulation (GDPR): A Practical Guide (2017). 13 Busra Bilsin, Navigating EU Data Protection Law: The Challenge of the Right to Be Forgotten in AI-Driven Text Producers (2023) (Master’s thesis, Vienna Univ.).
14 Gloria González Fuster, Article 17 and the Right to Erasure in GDPR (2014).
reputation by ensuring obsolete data that it is no longer publicly accessible15. Without uniform provisions in the DPDP Act, individuals in India remain unsafe for prolonged prestigious risks.
2.2.5 Limited Judicial Guidance on RTBF Implementation:
In India, the Supreme Court recognized the right to secrecy as a fundamental right in Landmark. Justice K. S. Putaswami vs India Union. Case16. Although this decision confirmed privacy as a main constitutional value, Indian courts have so far developed a strong RTBF jurisprudence similar to the European Union's Google Spain Case 32. The absence of statutory clarity in the DPDP Act leads forward judicial interpretations that may support the RTBF implementation in India. In the light of these intervals, it is important to ensure comprehensive data protection to include RTBF within the DPDP Act of India. Drawing from the GDPR structure of the European Union, India can establish clear guidelines for legal support for individuals seeking engine obligations, AI data deletion mechanisms and data removal.
Strengthening the DPDP Act with such provisions will better align India's data privacy landscape with global best practices.
3. RTBF Structure in European Union:
Right to forget (RTBF) is an important element of data protection laws in the European Union (EU), designed to empower individuals with the right to request the elimination of personal data in specific circumstances. This framework is mainly coded under Article 17 of the General Data Protection Regulation (GDPR), which aims to balance personal privacy with ideas of public interest. The RTBF model of the European Union has become a global benchmark for data security, affecting the privacy law in many courts. Understanding the GDPR's RTBF provisions and its judicial interpretations provides significant insights to policy makers to strengthen India's data protection structure.
3.1 Understanding Article 17 of GDPR:
Article 17 of GDPR, titled 'Right to Erezure', formally establishes RTBF and underlines conditions under which individuals can request to remove their personal data from online 15 Bashirat Bukola Atata, Artificial Intelligence and the Right to be Forgotten, 20 Int’l J. Res. Pub. & Revs. (2024).
16 Justice K.S. Puttaswamy v. Union of India, (2017) 10 S.C.C. 1 (India).
platform, search engine and data repository 27. Under this provision, data controllers are legally bound to erase individual data without any delay if one of the following conditions is applied:- - Data is no longer necessary: Personal data that has fulfilled its intended objective can be validly erased to protect personal privacy 28. - Consent refund: If a person agrees to data processing and no other legal basis exists, the data controller should remove information 29. - Objection to processing: Where individuals object to data processing and no overriding validation justifies continuous retention, data should be erased 30. - Unlawful data processing: Any data obtained without proper legal authority should be removed. - Compliance of legal obligations: RTBF can apply when it is necessary to eradicate data to meet legal obligations under the European Union Law17.
- Children's data protection: Special emphasis is given on data related to children, which require strict control to protect minors from long -term data exposure risk. Despite these rights, Article 17 accepts that RTBF is not absolute. Exceptions exist where data retention is justified for purposes such as freedom of expression, public interest, legal obligations, or establishment, exercise, or protecting legal claims. GDPR is thus attacking a delicate balance between protecting personal privacy and preserving valid social interests. To ensure compliance, data controllers must take appropriate steps to inform the third-party data processor of RTBF requests, ensuring that the data extends to the ereizure downstream platforms where the data may have been shared. This interconnected system search is important in controlling data spread in engines, social media and other digital services.
3.2 Major Judicial Specimens:
Judicial interpretations have played an important role in defining the scope and application of 17 Google Spain SL v. Spanish Data Protection Agency (AEPD) , Case C-131/12, ECLI:EU:C:2014:317 (CJEU 2014).
RTBF under GDPR. Notable matters have shaped the legal understanding and practical enforcement of this right:
3.2.1 Google Spain Sl v. Agencia Española De Proteción De Datos (AEPD) (2014)
Landmark .google Spain. The ruling established the RTBF as a legitimate implementable right in EU36. The European Union Court (CJEU) ruled that the search engines such as Google functions are obliged to follow the RTBF requests as a data controller. The case included a Spanish citizen Mario Costeza Gonzalez, who requested Google to remove the discovery results associated with old newspaper articles about their previous financial difficulties. Cjeu ruled in favor of Costeja, emphasizing that personal data should be erased if it is chronic, irrelevant, or excessive in relation to the purpose for which it was originally collected. The case laid the foundation of RTBF enforcement on digital platforms.
3.2.2 GC and other V. CNIL (2019)
In this decision, Cjeu clarified the regional scope of RTBF under GDPR. The court ruled that while the search engine should follow the RTBF requests within the European Union member states, they are not mandatory to expand this right to the Non-European Union Jurisdiction18. The decision strengthened the geographical boundaries of GDPR enforcement and highlighted the complications of implementing RTBF in the border data environment.
3.2.3 NT1 & NT2 v Google LLC (2018)
In this case of the United Kingdom High Court, the court investigated the balance between RTBF and public interest. Two contenders were involved in the case, the two guilty criminals were demanding to get information about their previous crimes, which were removed from the search engine. The court ruled in favor of a claimant, whose sentence was considered old and irrelevant, while the request of the other contender was rejected due to significant public interest in maintaining data19. The case underlines the importance of reference when evaluating RTBF requests and balances the legal interests with competition. 18 GC & Others v. National Commission for Information Technology and Civil Liberties (CNIL) , Case C-136/17, ECLI:EU:C:2019:773 (CJEU 2019).
19 NT1 & NT2 v. Google LLC, [2018] EWHC (QB) 799 (UK).
3.2.4 Right to Be Forgotten and AI Systems.
While the GDPR's RTBF requirements address traditional data storage systems, the AI model offers unique challenges to apply RTBF. The AI system, especially dependent on machine learning, can embed individual data directly into algorithm structures20. As a result, removal of such data can lead to compromise on the functionality and future accuracy of the AI model. Scholars argue that applying the 'Machine Unlearning' mechanism designed to remove specific data points without distorting the AI model- can increase GDPR amenability for AI-operated platforms21. The Progressive RTBF structure of the European Union highlights the importance of balancing privacy rights with data retention requirements in developing digital ecosystems.
For India, integrating RTBF within the Digital Personal Data Protection Act, 2023, while AI-specific challenges will be important to address accounting data security intervals. The EU's progressive RTBF framework highlights the importance of balancing privacy rights with data retention requirements in evolving digital ecosystems. For India, participating RTBF within the Digital Personal Data Protection Act, 2023 while accounting for AI-specific challenges will be critical in addressing data protection gaps.
4. AI and the Challenges of RTBF Implementation:
The implementation of the Right to Be Forgotten (RTBF) presents unique challenges in the context of Artificial Intelligence (AI) systems. AI models, especially those relying on machine learning algorithms, inherently differ from traditional data storage systems. These differences pose significant obstacles to ensuring complete data erasure when RTBF requests are made. The complexities arise from AI's data retention mechanisms and technical constraints, as well as the evolving legal landscape that struggles to keep pace with AI progresses.
4.1 Data Retention Complexities in AI Models:
AI models, largely those using machine learning and deep learning algorithms, are intended to analyze vast datasets to identify patterns, make predictions, and automate decision-making 20 Busra Bilsin, Navigating EU Data Protection Law: The Challenge of the Right to Be Forgotten in AI-Driven Text Producers (Master’s thesis, Vienna Univ. 2023).
21 Mike Ananny & Kate Crawford, Data Erasure Challenges in AI Systems (2018).
processes. Unlike traditional databases that store discrete data points, AI models often integrate data directly into their decision-making framework. This integration makes identifying and isolating specific data points for deletion a strictly multifaceted task. A significant trial stems from the training phase in AI models. During this phase, personal data
is not merely stored in conventional formats but becomes an integral component of the model’s learning structure. The data contributes to the model’s weight modifications, feature engineering, and output accuracy22. Accordingly, deleting specific data points may distort the model’s internal architecture, impacting its functionality and predictive competences. Moreover, AI systems often employ federated learning and decentralized data storage, where data is processed across multiple nodes rather than in a centralized database. This distribution complicates RTBF enforcement, as data erasure requests may require deletion across numerous dispersed systems. Since these systems lack centralized control, ensuring comprehensive data removal becomes particularly interesting.
Another challenge arises in unsupervised learning models, where data clustering and pattern acknowledgement occur without predefined labels. In these systems, data points influence broader model behavior without being directly traceable. Consequently, even if personal data is deleted, its influence on the model’s learned patterns may persist, posing privacy risks despite erasure attempts.
4.2 Technical and Legal Barriers in Enforcing RTBF:
From a technical perspective, enforcing RTBF in AI systems demands innovative solutions that balance data erasure with model performance integrity. Two prominent technical contests are: - Machine Unlearning: AI researchers are exploring machine unlearning techniques that allow selective deletion of data points from trained models. Unlike traditional deletion methods, machine unlearning intentions to reverse the influence of deleted data on model performance without requiring full model retraining. Although promising, these techniques remain experimental and face limitations in scalability and efficiency. 22 Bashirat Bukola Atata, Artificial Intelligence and the Right to Be Forgotten, 5 Int’l J. Res. Pub. & Rev. 123 (2024). [hereinafter Atata].
Model Auditing Tools: To support RTBF compliance, developers are designing model auditing frameworks that trace data lineage and identify embedded data points. Such tools aim to detect where individual data has influenced a model's decision-making process. However, current auditing tools face limitations in complex neural networks where data pathways are opaque and difficult to map. From a legal standpoint, existing data protection frameworks struggle to regulate AI-driven data retention effectively. The General Data Protection Regulation (GDPR) outlines RTBF obligations under Article 17, requiring data controllers to ensure that private data is erased without undue delay. However, GDPR provisions were drafted with traditional data systems in mind and lack obvious guidance on RTBF enforcement in AI environments.
Accordingly, the absence of clear guidelines for AI data deletion creates ambiguity in determining the legal responsibility of AI model developers, data controllers, and platform providers. 23 In the Indian context, the Digital Personal Data Protection Act, 2023 does not address RTBF responsibilities in relation to AI systems. This omission is particularly concerning given India's increasing reliance on AI-driven platforms in sectors such as e-commerce, healthcare, and digital services. Without explicit RTBF guidance for AI systems, Indian consumers remain weak to prolonged data retention risks. Another legal complexity lies in the jurisdictional challenges associated with cross-border data flows. AI systems frequently operate across multiple jurisdictions, making it challenging to determine which legal standards apply to RTBF execution24.
While the GDPR grants RTBF rights to EU residents regardless of where data is processed, enforcing such requests across international AI platforms remains logistically complex and legally uncertain. To address these challenges, legal scholars and policymakers are advocating for AI-specific RTBF guidelines that: - Mandate AI model developers to implement data traceability frameworks. - Create standardized protocols for machine unlearning to enable data removal without
23 Supra, 22
24 GC and Others v. CNIL, Case C-136/17, ECLI:EU:C:2019:773 (CJEU 2019).
compromising model performance. - Introduce decentralized data governance models that assign clear responsibility for data deletion requests in federated AI environments. Emerging comprehensive RTBF solutions for AI systems is critical for ensuring individual privacy rights in an increasingly data-driven society. India's adoption of tailored RTBF provisions aligned with evolving AI technologies can help close existing legal gaps while enhancing consumer privacy protections.
5. Commendations for India’s Legal Framework:
Given the absence of obvious Right to Be Forgotten (RTBF) provisions in India’s Digital Personal Data Protection (DPDP) Act, 2023, incorporating robust data erasure mechanisms is vital to safeguarding individual privacy. Drawing insights from the General Data Protection Regulation (GDPR) and addressing AI-specific challenges, India can introduce inclusive reforms to improve consumer data protection. The following recommendations outline legislative and technological solutions to effectively integrate RTBF into India's data privacy framework.
5.1 Proposals to Incorporate RTBF in Indian Law:
5.1.1 Familiarizing Explicit RTBF Provisions:
To align with global best practices, the DPDP Act should include dedicated RTBF provisions modeled on Article 17 of the GDPR. The proposed modifications should empower individuals to request the deletion of their personal data if: - The data is no longer necessary for its original purpose. - The individual draws consent for data processing. - The data was unlawfully processed. - The data must be erased to comply with legal obligations. Integrating these provisions will provide Indian consumers with stronger control over their
personal information, reducing reputational risks and mitigating privacy violations.
5.1.2 Significant Search Engines and AI Systems as Data Controllers:
Moved by the Google Spain ruling, Indian law should designate search engines and AI platforms as data controllers under the DPDP Act. Such a classification would impose clear obligations on these platforms to comply with RTBF requests and notify third-party platforms to ensure comprehensive data removal. This measure is crucial in addressing the determined presence of outdated, misleading, or defamatory content in digital search results.
5.1.3 Creating a Legal Framework for De-Indexing Requests:
To prevent harmful data from remaining available through search engine results, India should adopt de-indexing protocols modeled after GDPR principles. This mechanism would enable individuals to request the removal of specific URLs containing outdated or harmful information. By distinguishing between de-indexing and data erasure, Indian law can balance RTBF with freedom of expression concerns.
5.1.4 Creating Clear Grievance Redressal Mechanisms:
India’s Data Protection Board should be empowered to adjudicate RTBF requests and resolve disputes involving data controllers. The Board can issue binding directions for search engines and AI platforms to enforce data deletion orders promptly. Ensuring a streamlined grievance redressal system will promote accountability and expedite RTBF enforcement.
5.1.5 Establishment Cross-Border RTBF Enforcement:
Given India’s expanding digital footprint, RTBF provisions should be extended to include extraterritorial enforcement. Inspired by GDPR’s approach, Indian law should mandate that digital platforms serving Indian residents comply with RTBF requests, even if operating from foreign jurisdictions. This approach will mitigate jurisdictional complications and protect Indian citizens’ privacy across global AI ecosystems.
5.2 Technological Precautions for Data Deletion in AI Systems:
AI systems present unique challenges for RTBF enforcement due to their complex data
retaining mechanisms. The following technological solutions can support effective data deletion in AI systems:
5.2.1 Executing ‘Machine Unlearning’ Techniques:
Machine unlearning is an emerging technique designed to selectively erase data from AI models without requiring full retraining. By reversing the influence of specific data points on the model’s learned patterns, machine unlearning enables efficient data deletion while preserving algorithmic performance. Incorporating machine unlearning techniques can simplify RTBF compliance in AI-driven platforms.
5.2.2 Developing AI Model Auditing Tools:
India should reassure the adoption of AI model auditing frameworks that trace data lineage and identify embedded data points. These tools enhance transparency by mapping the influence of individual data points on AI decision-making processes. By equipping developers with auditing capabilities, India can support RTBF application in AI ecosystems.25
5.2.3 Generating Data Traceability Protocols:
Inspired by GDPR principles, India can introduce data traceability protocols to track personal data throughout its lifecycle in AI systems. Traceability tools will allow data controllers to identify, isolate, and erase data points when RTBF requests are filed. Establishing these protocols will ensure AI systems comply with data deletion necessities without disrupting operative efficiency.
5.2.4 Enhancing AI System Design with ‘Privacy by Design’ Ideologies:
AI developers should be authorized to participate Privacy by Design principles when building data models. This approach emphasizes hands-on data minimization approaches, ensuring AI systems limit the retaining of personal data. By embedding RTBF considerations into AI system architecture, developers can reduce the complexities associated with future data obliteration requests.
25 Atata, supra note X.
5.2.5 Promoting Cooperative Research on RTBF Solutions:
The Indian government should actively promote collaborative research between AI developers, privacy experts, and legal scholars to innovate RTBF solutions for AI systems. Establishing dedicated research initiatives can foster the development of ascendable data erasure techniques that align with growing AI capabilities. By participating these legislative and technological commendations, India can fortify its data protection framework to ensure individuals gain meaningful control over their personal information. Embracing RTBF principles tailored to India’s digital landscape will enhance consumer privacy, lessen reputational harm, and promote responsible AI governance.
6. Conclusion:
The absence of unambiguous Right to Be Forgotten (RTBF) provisions in India’s Digital Personal Data Protection (DPDP) Act, 2023 underlines a critical gap in the nation’s data protection framework. As India’s digital ecosystem endures to expand, ensuring vigorous privacy protections has become increasingly urgent. The addition of AI-driven technologies, search engines, and dispersed data systems presents additional complexities, further emphasizing the need for RTBF-specific safeguards. The European Union’s GDPR provides a inclusive model for RTBF operation, offering a framework that balances individual privacy rights with legitimate public interest deliberations. By drawing insights from the GDPR, India can establish a legal framework that empowers citizens to control outdated, irrelevant, or misleading data in digital spaces.
Titling search engines and AI systems as data controllers, creating organized protocols for de-indexing harmful content, and extending RTBF enforcement to cross-border platforms would provide Indian consumers with much-needed privacy protections. Equally vital are technological innovations that accompaniment legal reforms. Solutions such as machine unlearning, data traceability frameworks, and model auditing tools offer promising avenues to enhance RTBF enforcement in AI-driven environments. Directing Privacy by Design principles during AI system development can further mitigate data persistence risks, ensuring platforms are inherently fortified to comply with data deletion requirements. By incorporating these endorsements, India can modernize its data protection laws to meet
evolving technological challenges. Creating RTBF provisions personalized to the Indian context will strengthen consumer privacy rights, reduce reputational harm, and bring into line India’s data privacy framework with global best performs. Ultimately, fostering a composed RTBF command will empower Indian citizens with greater control over their digital identities while promoting responsible data governance in an increasingly interrelated world.