Exploring The Right To Be Forgotten - Legal Perspectives And Challenges In India And Beyond
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
EXPLORING THE RIGHT TO BE FORGOTTEN: LEGAL
PERSPECTIVES AND
CHALLENGES
IN INDIA AND BEYOND Ajay Kumar, Assistant Professor (Selection Grade), School of Law, UPES, Dehradun
ABSTRACT
The right to be forgotten is a facet of the broader right to privacy which is recognized as an intrinsic part of the right to life in the K. S. Puttuswamy v. Union of India1 judgment in India. Internationally, this right has been recognized in many jurisdictions, especially in the European Union. The European Union came up with the General Data Protection Regulations2 (hereinafter referred to as EU GDPR) that recognizes the right of a person to get his personal information removed from the internet. 3 Indian law does not specifically recognize this right under any legislation though there have been few judicial interventions where Courts on a case-to-case basis have given certain relief to the claimants of this right but at the same time, few courts have denied the existence of such right to the claimant.
In 2019, the Personal Data Protection Bill (PDP Bill) was introduced in Parliament which explicitly recognized this right. 4 In this article, the author discusses the concept of the right to be forgotten, its development, enforcement in various jurisdictions, the Indian scenario, and the judicial trend in India. Further, this article seeks to analyze the coverage and scope of enforcement of this right under the PDP Bill and the Digital Personal Data Protection Act, 2023 (DPDP Act), and the challenges in its enforcement in India (if any). Keywords: Human Rights, Right to be Forgotten, Information Technology, Privacy Rights, Data Protection (2017) 10 SCC 1.
The General Data Protection Regulations were adopted on Apr. 14, 2016, and came into effect in May 25, 2018.
Article 17 of the EU GDPR recognizes the right to be forgotten.
Section 20 of the PDP Bill, 2019.
Introduction
In modern times, many people are connected to social media and the internet. The virtual world and the internet regulate the lives of people and affect their lives. The development of technology has brought people around the world nearer virtually. People post their happiness, sorrow, achievements, and failures with the people around them in the virtual world. With the increasing use of the internet and social media, a huge amount of data including personal data is generated and stored on the servers of social networking platforms and websites daily. Personal data refers to information that may be ascribed to an identifiable person. This data may be posted voluntarily and sometimes involuntarily.
The data may be of a varied nature like the personal details, or the name appearing in some social media posts or websites where the person has been charged with a crime or a person subject to any civil liability. The data processing on the websites has brought serious challenges and ramifications for individual privacy. Personal information is now not merely confined to oneself rather one feels the same to be in the public domain via the internet and such information is easily accessible by everyone. A picture posted in one small city of a country can be looked at as a far-off place in another country. This increased use of the internet, especially social media platforms has brought challenges for everyone. The amount of data stored on the internet is constantly increasing at a significant pace. The advancement in technology has made it easier to store this immense amount of data.
Storing large quantities of data has become both easy and economical. Technology has made it easier to get information and access data from anywhere in the world. Companies highly value such personal data and therefore, are storing and extracting value from data. Technologies like Blockchain technology, Cloud computing, and Artificial intelligence make it easier for public and private entities to innovate, they also put people's privacy in danger. 5 Organizations like Amazon and Flipkart use this data to enhance personalized experience by providing tailored recommendations on what products a customer should purchase. When an individual's profile is used for tailored advertising, it often includes personal information such as location, phone number, address, IP address, and specific interests.
Consequently, Rania El-Gazzar & Karen Stendal, “Examining How GDPR Challenges Emerging Technologies” 10 Journal of Information Policy, 237 (2020). organizations get significant advantages from personal data. A significant number of users on social networks divulge excessive personal information, not just about themselves but also about their friends and families. Big data analytics techniques not only provide extensive insights into groups but also have the potential to compromise an individual's privacy. The notion of privacy has undergone major changes, with a dramatic increase in the value placed on online privacy and data management. 6 At times, an individual desires to remove that unwanted information from search engines on the internet.
However, the question arises whether there is any such right available to that individual to get such data or information removed from the search engines. One may argue that this refers to the ability to eliminate prior occurrences that are no longer relevant or for which permission has been retracted. Under this right, an individual is entitled to have their digital personal information deleted which includes his information, photographs, and videos floating on any website on the internet. If someone's private information has been posted online without their knowledge or permission, ideally, they have the right to have it removed from the internet. This right, like other basic rights, is subject to some restrictions, nevertheless. The right is usually waived if the data in issue is judged essential for public health maintenance, archiving, or legal reasons.
Therefore, the right to free speech and the right to information often clash with this right. 7 Reading privacy rights in right to life in the K. S. Puttuswamy v. Union of India8 the Apex Court observed: “The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution”. However, the right to be forgotten is not yet officially recognized as an enforceable right in India and is still in a state of flux. The explicit inclusion of this right may be seen in the PDP Yulia Razmetaeva, “The Right to be Forgotten in the European Perspective” 10 (1) TalTech Journal of European Studies 62 (June 2020).
See Ummar Jamal & Prerna Shreenath, “Right to be Forgotten: Meaning, Evolution and Its Legality in India”, LIVE LAW Aug. 2022 available at: Right To Be Forgotten, K. S. Puttaswamy and Anr. V. UoI, European Union, General Data Protection Regulation, Kashmir University, Jindal Global University (livelaw.in) (last visited on Feb. 08, 2024).
Supra note 1.
Bill formulated by the Indian Parliament; however, the execution of this right poses a significant challenge. In India, the right to information has been recognized as a statutory right that comes in direct contact with the right to privacy. The question that arises is how to balance the two cherished rights. How to create a balance between the right of the public to know and the right of a person to be left alone? Another important question is whether one right can take precedence over the other. The Indian courts have granted relief to various claimants reading this right as an intrinsic part of privacy rights and have provided interpretations of this right in different situations as per the circumstances of the cases before them.
However, the specific conditions under which this right may be exercised and the appropriate methods for its enforcement have not yet been definitively established. Right to be Forgotten: Concept and Historical Evolution This concept implies an individual's entitlement to have their personal information, and other identifying details, erased from publicly accessible platforms like internet search results and online directories, under certain conditions. The right ensures that a person can have his or her data wiped so that no one else may discover who they are. It is possible to claim that this is the right to erase events from the past that are no longer relevant.
Following this right, an individual has the right to have their digital personal information, which may include information like name and address, images, and videos, removed from any website that is accessible over cyberspace. The history of the right originates from the French legal concept of "right to oblivion" or Droit a l'oubli. 9 In France, the criminals used this to protest against the disclosure of personal information after they had completed their term. 10 This particular right has been the subject of much discussion worldwide. It has consistently been a subject of controversy, particularly due to the absence of adequate legislation to address this right. There has been discussion over whether this right contradicts the right to freedom of speech. Right to be Forgotten in the European Union Internationally, this right has been recognized in many jurisdictions.
The European Union Jeffery Rossen, “Right to be Forgotten”, 64 Stan. L. Rev. (Feb. 2012) available at: The Right to Be Forgotten | Stanford Law Review (last visited on Jan. 18, 2024). developed the EU GDPR that recognizes a person’s right to get his personal information erased from internet search engines and websites. The European Union acknowledged this right under Article 17 of the EU GDPR by implementing EU GDPR in 2018. The EU GDPR is based on the European Council Directive 95/46, adopted in 1995, and is known as the “Directive on the Protection of Individuals with Regard to the Processing of Personal Data and the Free Movement of Such Data” (called the Directive). The Directive sought to establish regulations and supervision for data controllers, to safeguard individuals' fundamental rights and freedoms, namely their right to privacy.
11 Enforcing the Directive, the European Court of Justice (CJEU), in the significant legal case of Google Spain v. AEPD and Mario Costeja Gonzalez12, issued a direction to Google, instructing them to remove any data from its search results that are deemed "irrelevant, inadequate, or no longer relevant" upon request from an individual called the Data Principal. In this case, an altercation occurred in 2009 between Mario Costeja González and Google Spain. The issue arose when the Google search engine exhibited a hyperlink referring to a news item printed in La Vanguardia in 1998. It revealed that Mr. González's residence was scheduled for a real estate public sale to resolve his outstanding debt obligations, which had since been resolved. Mr. González complained to the Spanish Data Protection Agency, known as AEPD, about both the newspaper and Google Spain.
He claimed that the newspaper has a legal obligation to erase his name and that Google Spain should either delete or hide his information, therefore effectively prohibiting it from appearing in search results. 13 The action filed by Costeja González against the newspaper was dismissed by the AEPD, however, it was upheld against Google. The AEPD determined that the newspaper is not legally obligated to remove the published content, as it was originally published lawfully. However, the agency justified that search engine providers are classified as data controllers, making them responsible under the Directive. As a result, the AEPD required Google to delete links to personal data when a request was made by the individual whose data was involved.
“Recent Cases, “Internet Law — Protection of Personal Data — Court of Justice of the European Union Creates Presumption that Google Must Remove Links to Personal Data upon Request. — Case C-131/12, Google Spain SL v. Agencia Española de Protección de Datos” 128 Harv. L. Rev. 735 (2014). Case Number C-131/12 decided on May 13, 2014, by CJEU.
Supra note 11.
Google Inc. and Google Spain appealed against the ruling and brought their cases to the National High Court of Spain. The court then posed several questions to the CJEU to obtain a verdict on the interpretation of the Directive. Firstly, it sought to determine whether Google fulfilled the conditions to be categorized as a data controller, a prerequisite for being bound by the Directive. Given that Google is a non-EU business entity, the High Court also asked the CJEU to clarify whether the Directive's territorial jurisdiction applies to Google. Should the court answer the first two questions positively, it must evaluate the possibility of Google's accountability as a data controller and examine if people have the right to demand the deletion of their data from Google's servers and search engines.
In 2014, the CJEU enforcing the Directive answered the questions put to it in the affirmative. The court concluded that a search engine's operations may be categorized as data processing since it gathers, retrieves, records, organizes, saves, and discloses data as the data explicitly contains personal information. According to the fact that a search engine operative has control over the objectives and methods of data processing, it should also be considered a data controller. As the entity responsible for managing data, a search engine operator is obligated to adhere to the Directive. Consequently, it was decided that search engine providers are obligated to remove links to websites from their search results upon receiving a request from the individual whose information is being shown.
The CJEU admitted that by accessing vast amounts of personal data that would otherwise be unreachable, search engines might drastically affect fundamental privacy rights. 14 It also realized at once the importance of balancing the legitimate worries of Internet users with the rights of data suppliers. Although private rights are of great significance, the decision of balance in particular situations may depend on elements including the kind of material, its degree of sensitivity, and the public's interest in accessing it, particularly given the individual's public role. 15 The court underlined the significance of protecting an individual's privacy and personal data, prioritizing them over the public’s right to access information. The court did make a special provision for material that captures the public's attention, like information about prominent Ashish S.
Joshi, “Leave me Alone: Europe’s Right to be Forgotten” 41 (2) Litigation 17 (Winter 2015). individuals. This ruling had a significant influence on the enforcement of data protection regulations in Europe. Finally, under the EU GDPR implemented in 2018 replacing the Directive, an individual has the recognized right to get his personal information erased then he can directly approach search engines such as Google and Yahoo and ask them to remove the information from search results. Under certain specific circumstances, a website can be asked to bring down the data or information about a person thereby enforcing this facet of individual privacy. It grants individuals the authority to demand the deletion of their personal information. There are several grounds for which the erasure request might be submitted.
Article 17 of the EU GDPR permits a person to get data removed that is no longer necessary, data for which consent has been withdrawn or objected to, unlawfully processed personal data, and data that must be erased due to a legal obligation under EU law or the laws of member states. As per the relevant provisions16 of the EU GDPR, such deletion must be made by the data controller after a comprehensive investigation has been conducted. In addition, as per Article
5 of the EU GDPR, data controllers have a responsibility to swiftly correct or delete any
incorrect data by carrying out the required actions and the same is to be done without delay. Right to be Forgotten in Russia The Russian law 264-FZ17 recognizes this right of Russian citizens. Since January 1, 2016, Russian citizens have had the option to get the link removed from a search engine if it violates their privacy by disclosing personal data, any information disseminated in violation of Russian laws, providing inaccurate or unverified information, or including content that is no longer relevant.18 The Search engines are to respond to takedown requests within a maximum of ten days. If they do not respond within this specified period or unjustly decline to remove the content, they could Recitals 65, 66, and Art. 17 of the EU GDPR. Federal law 264-FZ dated 13 July 2015.
Brittany Doyle, “Russia’s “Right to be Forgotten” and China’s Right to be Protected: New Privacy and Security Legislation” Jolt Digest (Jul. 2015) available at: Russia’s “Right To Be Forgotten” and China’s Right To Be Protected: New Privacy and Security Legislation - Harvard Journal of Law & Technology (last visited on Feb. 22, 2024). potentially be subject to legal consequences and potential financial implications. 19 The only exclusions are to material about incidents that exhibit indications of criminal activity. The word refers to the period during which legal action may still be taken, and it includes information regarding a crime that has not yet been resolved.
20 The Russian law is different from the EU GDPR in the sense that under EU GDPR this right has been conferred on the individuals based on the principles of data protection whereas the Russian law is introduced as sui generis right without any direct connection to data protection. 21 Right to be Forgotten in the United States of America In the USA, there is no recognized legal right to be forgotten, and there is also no comprehensive method for efficiently regulating data privacy. There is no direct legislation ensuring or recognizing such rights however, the data protection laws are enacted on an asneeded basis and are often customized to address situations or activities. 22 A major hindrance to enforcing this right in the United States is the highly held constitutional protection of freedom of speech as guaranteed under the First Amendment.
Typically, where there is a conflict between the right to privacy and the right to free speech, the dominant principle in the United States is that the right to free expression is given more importance than private rights. Although the USA has been hesitant to enact comprehensive data privacy legislation, there are still many policies and legal frameworks in place that provide privacy protections for Americans. The Health Insurance Portability and Accountability Act of 199623, is generally acknowledged as the key legislation ensuring data privacy. Its primary objective is to safeguard the privacy of individuals' medical data. Typically, the law forbids healthcare practitioners and organizations from disclosing protected information to anybody other than the patient and their authorized representatives without their specific consent.
24 Ruslan Nurullaev, “Right to be Forgotten in the European Union and Russia: Comparison and Criticism” National Research University Higher School of Economics (2015) available at: https://www. hse. ru/data/2015/10/05/1077099117/54LAW2015. pdf (last visited on Jan. 22, 2024). Savanna Shuntich, “The Life, the Death, and the Long-Awaited Resurrection of Privacy: How Americans Can Reclaim Their Lives from the Internet with a Right to Be Forgotten” 41(4) HUMAN RIGHTS 3 (2016). Pub. L. No. 104-191, 110 Stat. 1936 (1996). Supra note 22.
Another example is the Driver's Privacy Protection Act of 1994. This law makes it illegal to intentionally acquire or reveal the data of an individual from a motor vehicle record. The law prohibits the disclosure of personal information without the express permission of that individual, save in certain situations as mentioned in the legislation. 25 Right to be Forgotten in India & Judicial Approach In India, this right is not explicitly recognized by legislation to the same extent as it is in Europe. The issue of recognition and enforcement of this right has, however, come up before many High Courts in India time and again. The High Courts in India have mixed views about the right to be forgotten. Few courts have enforced this right despite the absence of a concrete law on the same. Whereas in a few cases, the High Courts have denied recognizing any such right.
The courts enforcing this right have discussed the need to have this right recognized in India in modern times. In K. S. Puttaswamy v. Union of India, the Supreme Court made a statement addressing a citizen's supposed right to be forgotten like the right that is available to the EU citizens, wherein the Court touched upon the nature and scope of such right and the restrictions that can be there on the exercise of such right and its enforceability. The Apex Court Observed: “If we were to recognize a similar right, it would only mean that an individual who is no longer desirous of his personal data to be processed or stored, should be able to remove it from the system where the personal data/information is no longer necessary, relevant, or is incorrect and serves no legitimate interest.
Such a right cannot be exercised where the information/data is necessary, for exercising the right of freedom of expression and information, for compliance with legal obligations, for the performance of a task carried out in public interest, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. Such justifications would be valid in all cases of breach of privacy, including breaches of data privacy. ”26 Although being a facet of privacy rights, the status and concrete recognition of this e right to be forgotten as a basic legal right in India remains uncertain. The B.
N Shri Krishna Committee's report under the PDP Bill had the potential to transform this right into a legally mandated right and the right found its mention in Section 20 proposed PDP Bill. “20. Right to be Forgotten: (1) The data principal shall have the right to restrict or prevent the continuing disclosure of his personal data by a data fiduciary where such disclosure— (a) has served the purpose for which it was collected or is no longer necessary for the purpose; (b) was made with the consent of the data principal under section 11 and such consent has since been withdrawn; or (c) was made contrary to the provisions of this Act or any other law for the time being in force.
(2) The rights under sub-section (1) may be enforced only on an order of the Adjudicating Officer made on an application filed by the data principal, in such form and manner as may be prescribed, on any of the grounds specified under clauses (a), (b) or clause (c) of that sub-section: Provided that no order shall be made under this sub-section unless it is shown by the data principal that his right or interest in preventing or restricting the continued disclosure of his personal data overrides the right to freedom of speech and expression and the right to information of any other citizen. (3) The Adjudicating Officer shall, while making an order under sub-section (2), having regard to— Supra note 1 para 636.
(a) the sensitivity of the personal data; (b) the scale of disclosure and the degree of accessibility sought to be restricted or prevented; (c) the role of the data principal in public life; (d) the relevance of the personal data to the public; and (e) the nature of the disclosure and of the activities of the data fiduciary, particularly whether the data fiduciary systematically facilitates access to personal data and whether the activities shall be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.
(4) Where any person finds that personal data, the disclosure of which has been restricted or prevented by an order of the Adjudicating Officer under sub-section (2), does not satisfy the conditions referred to in that sub-section, he may apply for the review of that order to the Adjudicating Officer in such manner as may be prescribed, and the Adjudicating Officer shall review his order. (5) Any person aggrieved by an order made under this section by the Adjudicating Officer may prefer an appeal to the Appellate Tribunal. ”27 The PDP Bill drew inspiration from the EU GDPR, nevertheless, the right recognized under the PDP Bill was not identical to the one provided under the EU GDPR. Under the EU GDPR, individuals can demand the removal of their personal information and for that matter, they may directly contact search engines like Google and Yahoo and make a request in that regard.
In contrast, the right stipulated by the PDP Bill mandated under Section 20 that individuals must approach the Adjudicating Officer appointed28 to have their information deleted. The responsibility to determine whether such material should be erased lies with the Adjudicating Officer, based on certain criteria mentioned in Section 20 of the PDP Bill. The right recognized under the PDP Bill was narrower in scope as the data principal was to take recourse i. e. to move Section 20, PDP Bill, 2019. Adjudicating Officers appointed under Section 62 of the PDP Bill, 2019. the application before the Adjudicating Officer as provided under the PDP Bill and he could not have directly moved to the search engines for the removal of data.
According to the provision in Section 20 sub-section (2) of the PDP Bill, the order may only be given if the data principal can demonstrate that their interest in limiting or minimizing the ongoing publication of their data surpasses the rights to freedom of expression and access to information of any other citizen. The PDP Bill demonstrated the Indian Parliament's commitment to giving priority to the public interest and protecting the right to freedom of expression and information, rather than prioritizing the right to be forgotten. The PDP Bill mandated that the authority consider various factors when issuing an order.
These factors include the sensitivity of the personal data, the extent and restrictions of its disclosure, the public status of the individual to whom the data pertains, the importance of the data to the public, and the nature and consequences of the data fiduciary's actions, especially regarding systematic data access and any potential barriers arising from limited disclosures. 29 The right to get the order of the Adjudicating officer reviewed and appeal against such an order to the Appellate Tribunal was also provided under the PDP Bill. 30 Although the PDP Bill explicitly included this right as a proposed statutory right, the Bill could not be converted into legislation and was later withdrawn. The PDP Bill was withdrawn due to many criticisms of other provisions hurled against it, yet the explicit recognition of this right was a salutary move.
Right to be Forgotten and the Digital Personal Data Protection Act, 2023 The DPDP Act enacted by the Indian Parliament is a law that aims, as the name suggests, to protect an individual's personal data in a digital form. Like the PDP Bill, the DPDP Act does not specifically provide the ‘right to be forgotten’ however, Section 12 (1) of the DPDP Act confers, among other things, a right to a data principal to get the personal data erased from the servers of the data fiduciary. Therefore, the DPDP Act only recognizes the right to erasure but does not specifically recognize the right to be forgotten. The DPDP Act recognizes such right for the removal of the data for processing, for which Section 20 (3), PDP Bill, 2019. Section 20 (4) & (5), PDP Bill, 2019. consent was given previously by the data principal.
The application for the erasure of such data can be moved before the data fiduciary directly and there is no such procedure to move the application before any adjudicating officer as one could have seen under the PDP Bill. On receipt of the request, the data fiduciary is to delete the personal data as per the request received except in cases where the retention of the same is required for the purpose that has been mentioned or to comply with any legislation. Right to be Forgotten and Right to Erasure The rights of erasure and the right to be forgotten have distinct objectives in safeguarding personal privacy, however, they vary considerably in terms of their extent and implementation.
The right to erasure, as stipulated by regulations like the EU's GDPR in Article 17, gives people the authority to demand the removal of their data from data controllers when it becomes unnecessary, permission is revoked, or the processing is deemed illegal. This particular right is explicitly defined in laws and entails making direct requests to individuals or organizations responsible for managing data, asking them to delete the data. Whereas the right to be forgotten goes beyond just deleting data and includes removing data from public platforms such as search engines. This ensures that obsolete or irrelevant personal information does not unfairly impact people's lives. Although the right to be forgotten may not be specifically stated in laws, it is acknowledged via court decisions and often enforced on search engines and internet platforms.
The enforcement of the right to be forgotten may become more complex since it requires striking a balance between privacy, public interest, and freedom of speech. In the Indian context, the DPDP Act places particular emphasis on the right to erasure, rather than the broader right to be forgotten. While the DPDP Act permits individuals to demand the deletion of their data from a data fiduciary's servers, it does not explicitly guarantee the right to be forgotten. The right to erasure, as granted by the DPDP Act, empowers a person to claim the removal of their data from the data fiduciary’s servers. Conversely, the right to be forgotten pertains to the removal of information from public platforms such as search engines and has a broader scope, including the elimination of outdated or irrelevant content to prevent undue harm.
The DPDP Act lacks specific provisions on this overarching concept, leading to a more limited and procedural understanding of the right to erasure in contrast to the broader and multifaceted right to be forgotten.
Judicial Approach in India The issue of the right to be forgotten has been raised in many matters before the various High Courts in India. In Dharamraj Bhanushankar Dave v. State of Gujarat & Ors31, the petitioner charged with criminal conspiracy, murder, and kidnapping, was acquitted. Consequently, the petitioner sought to prevent the respondent from publishing the non-reportable judgment on the Internet, as it could have negative consequences for his personal and professional life. However, the High Court of Gujrat did not acknowledge the existence of the right to be forgotten in favour of the petitioner. In Jorawar Singh Mundy v. Union of India &Ors. 32, the right was invoked before the High Court of Delhi. The Single Judge bench presided over by Justice Pratibha M.
Singh, while recognizing privacy rights also acknowledged the public's right to information and the need to maintain transparency in judicial records. Nevertheless, the court acknowledged the petitioner's paramount right to privacy and determined that it had been violated. As a result, the court ordered the respondents to eliminate access to the ruling from their portals. In Subhranshu Rout @ Gugul v. State of Orissa33 The High Court of Orissa has reiterated the significance of legally recognizing the right to be forgotten. The court held that in situations where an individual's privacy has been violated, the victim or the prosecution can seek redress from the court to have the content removed from public platforms.
The Court observed: “Presently, there is no statute in India which, provides for the right to be forgotten/getting the photos erased from the server of the social media platforms permanently. The legal possibilities of being forgotten online or offline cries for a widespread debate. It is also an undeniable fact that the implementation of the right to be forgotten is a thorny issue in terms of practicality and technological nuances. In fact, it cries for a clear-cut demarcation of institutional boundaries and redressal of many delicate issues which hitherto remain unaddressed in Indian jurisdiction. The dynamics Special Civil Application No. 1854 of 2015, decided on January 19, 2017. W. P. (C) 3918/2021 & CM Appl. 19941/2021 decided on April 1, 2022. Bail Application No. 4592 of 2020, decided on November 23, 2020.
of hyper-connectivity- the abundance, pervasiveness, and accessibility of communication network have redefined the memory and the prescriptive mandate to include in the technological contours is of pressing importance. ” In Zulfiqar Ahmad Khan v. Quintillion Business Media Pvt. Ltd & Ors. 34 Justice Pratibha M. Singh of the Delhi High Court granted relief to the plaintiff allowing the plaintiff to get her information removed from the search engines and observed that the ‘right to be forgotten’ and the ‘right to be left alone’ are integral parts of the privacy rights. In {Name Redacted} v.
The Registrar General35, Justice Anand Byrareddy of the Karnataka High Court adopting a purposive approach ordered the Registry of the Court to ensure that the name of the daughter of the petitioner must not reflect in the case title during a search made in the public domain on the internet, despite the absence of a specific statute conferring the right to be forgotten. It held that this recognition would be in line with the growing significance placed on privacy rights and the right to be forgotten in foreign jurisdictions such as Europe. 36 In 2022, in the case XXXX v. Kacherla Durga Prasad &Ors. 37, the petitioner requested for the enforcement of the "right to be forgotten" and "right of eraser" being privacy rights.
The petitioner prayed that the Supreme Court order the removal or masking of the petitioner's and respondent's names, as well as their address, identifying data, and case numbers, to the degree that they are not accessible to search engines. Granting relief to the petitioner the Apex Court instructed the Registry to hide the names and addresses of the couple so that the same does not appear in any online search on any search engines. This order of the Supreme Court will surely go a long way in having a big impact because the same shall set a standard for future cases before the High Court in India and shall pave the way for the right to be forgotten to take a concrete form.
Conclusion The court rulings and legislative actions have ultimately changed the notion of the right to be forgotten in India, therefore highlighting the intricate and changing character of the legal CS (OS) 642/2018, decided on May 9, 2019. Writ Petition No. 62038 OF 2016 (GM-RES) decided on January 23, 2017. Miscellaneous Application No. 875/2022 in SLP (Crl. ) No. 3211/2022 decided on July 18, 2022. system. Though it is not as protected by law as it is in the GDPR in the European Union, courts have been progressively recognizing and handling privacy issues in the digital era in India. The manner Indian courts have begun to apply this right case-by-case clearly shows this awareness. The K. S. Puttaswamy v. Union of India case clarified the whole picture of privacy rights in India by showing that the basic right to privacy might be much enhanced by the right to be forgotten.
Different High Court rulings indicate, however, uneven execution of such a right. Inspired by international norms, the PDP Bill and the later DPDP Act included procedures for data deletion in India. Still, the DPDP Act upholds procedural complexity and emphasizes greatly the need to balance privacy with other essential rights like public interest in receiving information and freedom of speech. While the DPDP Act provides a framework for the right to erasure, it does not encompass the broader right to be forgotten. The right to erasure under the DPDP Act, allows individuals to request the deletion of data from servers but it is limited to specific conditions such as withdrawal of consent or data becoming redundant.
In contrast, the right to be forgotten entails not only the removal of data from the original data controllers but also public platforms like search engines, addressing the broader impact of personal information on an individual's life. Due to the changing landscape of digital privacy and the growing significance of safeguarding people from the negative consequences of obsolete or irrelevant personal information, it is evident that India needs a stronger and more comprehensive legislative framework. An effective system should expressly acknowledge and establish the right to be forgotten, guaranteeing its enforceability not just by data controllers but also in public and digital spheres.
Creating a well-defined legal structure for this entitlement will aid in harmonizing privacy and public concerns, simplifying methods for enforcing it, and strengthening the safeguarding of personal information in a swiftly progressing digital environment. While India's legal and judicial system is slowly embracing the concept of the right to be forgotten in a broad sense, it is crucial to have a well-defined statutory framework.