From Digital Shadows To Erasure - Exploring The Right To Be Forgotten
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
FROM DIGITAL SHADOWS TO ERASURE: EXPLORING
THE RIGHT TO BE FORGOTTEN
Vidushi Verma, Assistant Professor (Law), IPEM Law Academy
ABSTRACT
In our contemporary world, the advent of digital era has transformed not only our societal structures, but also the very fabric of our existence. In order to empower an individual to avoid unnecessary intrusion, the Right to be forgotten emerged in most of the data privacy regulations around the world. The foundational stone of data privacy rests on the premise of digital forgetting by way of deletion. Thus the right pin points to the fact that as much as an individual has the right to express herself, she also has the right to request erasure of her data. . This right introduces a profound question: In the era of perpetual connectivity, do individuals possess the power to erase certain aspects of their digital past, similar to a magical spell, in order to exercise their control and autonomy over their data?
Delving into the intricacies of this concept unveils a fascinating intersection of freedom of speech of an individual along with the right to reputation and privacy an increasingly interconnected world. The research work will thus aim is to examine the historical development of the right along with a theoretical analysis to examine its basic premise. Further, the right will be juxtaposed with similar sounding legal protections like Right to privacy and Doctrine of practical obscurity and its rival Freedom of speech and expression, to study their interrelations and focus will also be drawn to the contours of this right in the present Indian legal system.
INTRODUCTION
“Nothing fixes a thing so intensely in memory as the wish to forget it” - Michel De Montaigne Imagine stepping into the world of Jorge Luis Borges' fictional story, where Ireneo Funes1, a fourteen-year-old boy, is blessed or cursed—with the gift of total memory. In such a world, existence would undoubtedly pose significant challenges as every detail is permanently etched into consciousness, and forgetting becomes impossible. While Borges’ tale was a fiction, technological advancement in today’s world mirrors this closely. The Internet has become our modern-day Funes, recording every action, search, and interaction without the luxury of forgetting. Humans may forget but machine never does. 2 Historically, memory has been vital for preserving culture and advancing society, but in today's age of information overload, the balance has shifted.
As technology continues to evolve, so too have the tools developed to combat the challenges posed by this relentless memory. 3 Due to this sudden shift, a series of modern-day rights took the main stage position in our constitutional realm. Rights like Right to data protection, Right to be forgotten which was not even conceived by the scholars in historic era has become a reality. In the matrix of digital world, where digital footprints leave an indelible mark on an individual’s reputation, there emerged a legal concept that sounds almost whimsical – the "Right to be forgotten. " The Right to be forgotten is a tangible and evolving legal principle, crafted to navigate the complexities of privacy and personal data protection in digital era. It has gained cynosure recently due to extensive debate and discussions on importance to preserve personal information.
The birth of the modern privacy debate around the globe stems from opposition to comprehensive digital memory. Thus, it emerged as a tool given to the citizenry to maintain balance. This research aims to explore the historical evolution of the right while providing a theoretical analysis to understand its fundamental principles. Additionally, it will compare this right with related legal protections, such as the Right to Privacy, while also examining its relationship with the competing principle of Freedom of Speech and Expression. The study will further
1 Jorge Luis Borges, Ficciones (Anthony Kerrigan (ed.), Grove Press, 1994).
2 Viktor Mayer-Schönberger, delete
The Virtue of Forgetting in the Digital Age (1st ed., Princeton University Press, 2009) 1. 3 Vrinda Bhandari, ‘Privacy Concerns in the Age of Social Media’ [2019] 45 India International Centre Quarterly 66, 67 accessed on November 23, 2024. analyse the scope and application of this right within the contemporary Indian legal framework.
HISTORICAL
BACKGROUND
The European Data Protection Directive, 19954 mentioned the right for the first time but rather than providing a full blanket protection to retract any sort of personal data like Right to be forgotten, this provision provided a right to get the information erased conditionally. The year 2010-2011 saw a noticeable boost in the growth of this right when a lot of scholarship began to pop up recognizing the need of a right of this sort. It was Viktor Mayer-Schönberger’s book, Delete: The Virtue of Forgetting in the Digital Age that initiated the discussion about the importance of digital forgetfulness. 5 His work proved to be Bible for privacy experts to brainstorm about right to be forgotten. In 2011, Prof. Dr. Rolf Weber in his much celebrated work, highlighted that individuals should have the right to make potentially damaging information disappear after a certain time has elapsed.
6 In November 2009, the French Secretary of State in charge of the digital economy, Nathalie Kosciusko-Morizet, launched a wide-ranging campaign designed to secure the “Right to be forgotten” on the Internet (“droit à l’oubli”). 7 The campaign primarily aimed to inform Internet users about the potential privacy risks they face online. The result of this campaign was adoption of Code of Good Practice on the Right to Be Forgotten on Social Networks and Search Engines by France in October 2010. 8 Taking inspiration from France, in the year 2012, during the 41st British Parliament meeting, Elizabeth Denham, the Columbia Information and Privacy Commissioner proposed Right to be forgotten as “a basic privacy principle”. 9 The idea was to incorporate the right to ensure that the organizations and institutions retain data only for the desired and necessary purposes and eliminate thereafter.
These campaigns and discussions proved to be successful in voicing out the importance of digital redemption. Thus, European Union also began brainstorming about bringing changes to its pre-existing data protection framework by setting up a Model digital code suited for globalized needs of digital regulation. As a result of this, the European Commissioner for 4 Directive 95/46/EC of 24 October 1995 on the protection of Individuals with regard to the processing of personal Data and on The Free Movement of such data [1995] OJ L281/31.
5 Mayer-Schönberger (n. 2).
6 Rolf H. Weber, The Right to Be Forgotten
More Than a Pandora’s Box? (2011) 2 JIPITEC 120, 120.
7 Andrew Kurth, ‘French Government Secures “Right to Be Forgotten” on the Internet’ (Hunton & Williams’ Privacy and Information Security Law Blog, October 21, 2010) accessed on January 20, 2025.
8 Charte Du Droit A L’oubli Dans Les Sites Collaboratifs Et Les Moteurs De Recherche, 2010 (FRN)
9 Select Committee on Communications, Regulating in a Digital World (HL 2017-19, 2) 71.
Justice, Fundamental Rights, and Citizenship, Viviane Reding, proposed to formalise the Right to be forgotten in EU’s legal realm. 10 The subsequent European Parliament’s approval of the Committee on Civil Liberties, Justice and Home Affair’s amendments suggested that the right should be considered as one of “erasure”. 11 However, it was the celebrated case of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González12 which gave birth to the concept of Right to be forgotten. In this case, one Mario Costeja González lodged a complaint with the Spanish Data Protection Agency (AEPD) against Google Spain and Google Inc. , as well as La Vanguardia, a magazine widely popular in Spain.
He complained that on searching his name on Google, the notification of a forced sale of his property due to social debts published by La Vanguardia popped up which resulted in long term implication on the sale of that property. Thus he demanded the deletion of notification by La Vanguardia and deletion of the link to that notification by Google since the purpose was now fulfilled. The Court after due consideration of facts and data reached the conclusion that search engines engage in the practise of collecting, indexing, storing and sharing of data related to identifiable individuals, which qualifies as "personal data" under Article 2(a) of the Directive. These activities qualifies as "processing" under the Directive.
Court held that such data “affect [s] the fundamental rights to privacy and [search engines] are obliged to protect personal data when the search by means of that engine is carried out on the basis of an individual’s name. ”13 The Court upheld the basic essence of privacy and held that “the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful. ”14 This case initiated a whole new debate about concerns of transparency and open information
10 Ashley Nicole Vavra, ‘The Right to be Forgotten’ [2018] 81(1) The American Archivist 100.
11 Aurelia Tàmo and Damian George, ‘Oblivion, Erasure and Forgetting in the Digital Age’ [2014] 5(2) Journal of Intellectual Property, Information Technology and E-Commerce Law 23, 25. 12 Case C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González [2014] ECJ 317.
13 ibid [80].
14 ibid [88].
vis a vis the general right of the public to know.15 The right got formalized in 2016 with the adoption of General Data Protection Regulation16 [hereinafter referred to as ‘GDPR’]. GDPR became inspiration to many countries and thus the provision was mirrored by many jurisdictions.
THEORETICAL
ANALYSIS
Right to be forgotten was initially conceived as “an individual’s ability to request that a search engine (or other data provider) remove links to information about himself or herself from search results.”17 As such, the right is nothing more than a way to give (back) individuals control over their personal data and make the consent regime more effective.18 Prof Mc Nealy defines it as “as an amorphous privilege that would allow individuals more control over their personal information, particularly that information collected and connected with new technology.”19 Peter Fleischer initially defined it as ‘an attempt to give people the right to wash away digital muck, or delete the embarrassing stuff, or just start fresh.’20 However, the concept is much more complicated than it appears. Thus, Fleischer draws a three pronged hypothesis to understand the Right to be forgotten-
1. If I post something online, should I have the right to delete it again?
2. If I post something, and someone else copies it and re-posts it on their own site, do I
have the right to delete it?
3. If someone else posts something about me, should I have a right to delete it?
While the first scenario is the most fundamental function of digital privacy, the other two is a bit complicated. Le Droit a l’Oubli or French equivalent to the Right to be Forgotten referred to the first instance, but with the progress of technology now the other two aspects are more important. The second aspect is what Right to be forgotten aims to cover. If I post something about myself, I can delete it but if somebody else has reposted it, then either I can ask that person or the platform to delete it. While the former depends on the subjective will of the
15 Binoy Kampmark, ‘To Find or be Forgotten
Global Tensions on the Right to Erasure and Internet Governance’ [2015] 2(2) Journal of Global Faultlines accessed on February 01, 2025. 16 Regulation (EC) 2016/679 of 27 April 2016 on Protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L119/1 (GDPR).
17 Angelo Maietta, ‘The Right to be Forgotten’ (2020) 12 (2) RECHTD 206, 207.
18 Jef Ausloos, ‘The ‘Right to be Forgotten’ – Worth Remembering?’ [2012] 28 (2) Computer Law & Security Review 143, 143.
19 Jasmine McNealy, ‘Emerging RTBF’ [2011] 12 Insights on L. & Soc'y 14.
20 Peter Fleischer, ‘Privacy? Foggy thinking about the Right to Oblivion’ (Blogspot, March 09, 2011)
accessed on January 20, 2025. person who reposted, the latter can be ensured by way of policy. Right to be forgotten is a tool to put such policy in action. The third instance is where the right to privacy clashes with freedom of speech and expression. There are censorship laws and laws against defamation to cover such acts. Thus, the present conceptualization of the Right to be forgotten most closely resembles with the second instance. The right is explicitly provided in EU’s GDPR21 which provides “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.” As per the provisions of GDPR, Right to be forgotten exists in following situations-
1. Data Redundancy
2. Absence of any legitimate interest or purpose for data storage
3. Withdrawal of consent
4. Illegal processing of data
This provision of GDPR has been mirrored by several jurisdictions around the globe. ORIGIN AND EVOLUTION As discussed previously, Right to be forgotten blesses the person with the gift of autonomy. Autonomy is an inalienable concept. Scholars often conclude that data protection is a specie of right to privacy22 having mere formal distinctions. 23 This is so because just like privacy right, right to be forgotten also seeks to preserve the inherent right of an individual to maintain his personal sphere. However, in order to conclude whether it is just an extension of privacy or a new concept altogether one needs to dig deeper. PHILOSOPHICAL EVOLUTION Initially, only basic fundamental rights were acknowledged, but societal evolution has led to their transformation, birthing new rights grounded in age-old philosophical premises. Contemporary rights stem from philosophical principles.
This is very well illustrated by Samuel Warren and Brandeis when they noted; ‘in very early times, the "right to life" served
21 GDPR, art 17.
22 Gloria Gonzales Fuster, The Emergence of Personal Data Protection as a Fundamental Right of the EU (Springer, 2014) 21.
23 Shradhha Kulhari, Building-Blocks of a Data Protection Revolution
The Uneasy Case for Blockchain Technology to Secure Privacy and Identity (Nomos Verlagsgesellschaft Mbh & Co, 2018) 24. only to protect the subjects from battery in its various forms; liberty meant freedom from actual restraint; and the right to property secured to the individual his lands and his cattle. ’ 24 However, as society underwent myriad political, social, economic transformations, the content of these rights also expanded. Now, Right to life does not mean mere animal existence,25 it entails the whole bouquet of rights that help an individual to enjoy her life in complete sense. Similarly liberty is not restricted to physical restraint, rather includes complete liberty of thought, expression, belief, profess etc. The right to property also includes myriad forms of possession which is not restricted to mere tangible property.
Thus, the law evolved to keep at pace with the society’s transformation. The advent of the digital era, raised certain questions as to its regulation. While earlier the focus of the law was an individual’s reputation, privacy etc. The changing dimensions brought in concepts like preservation of digital reputation or informational privacy. These are not a new concept but a branch of age old conceptualization of importance of a personal sphere. ‘Individual shall have full protection in person and in property,’ is a principle as old as the common law. 26 In his work, The Politics, Aristotle delves into the origins of political communities, exploring the elements necessary for the creation of an ideal society. Rather than focusing solely on political structures or policies, he emphasizes the significance of partnerships.
Notably, Aristotle's vision of an ideal city is not solely built on political considerations but extends to partnerships between two crucial spheres: the public sphere, or polis, and the domestic sphere, or oikos. It is essential to recognize that Aristotle, in his pursuit of an ideal city, underscores the clarity and distinctness of partnerships between these two spheres, thereby highlighting the necessity to keep ones domestic life apart from the public life. His idea was furthered by scholars like John Locke and John Stuart Mill. John Locke in his much celebrated work, Second Treatise of Government, lays down his idea of property rights. According to him, the most fundamental property right that one possesses, is ‘property in himself.
’27 In the words of Locke “Though the earth, and all inferior creatures, be common to all men, yet every man has a property in his own person: this nobody has any right to, but
24 Samuel D. Warren, Louis D. Brandeis, ‘The Right to Privacy’ (1890) 4(5) HLR 193, 195.
25 Francis Coralie Mullin vs. The Administrator, Union Territory Of Delhi & Ors., 1981 AIR 746.
26 Warren and Brandeis (n. 24) 190.
27 John Locke, Second Treatise of Government (Prometheus Books, 1986) ch V.
himself. ”28 Further, he stated that the foremost role of the state is to secure one’s property. 29 Thus, he laid down a principle which places an exclusive responsibility on State to preserve the right of an individual to protect his own self as a property. An additional Locke’s work, An Essay Concerning Human Understanding, reveals that to Locke, liberty entails not merely freedom from intrusion or security in one’s person within a particular boundary, but a more positive sense of control of all that lies within that boundary. 30 Further, an analysis of Kantian philosophy also helps us to draw a contemporary origin. Kant laid down the concept of an ‘innate right’ i. e. rights that are owned by a man naturally, without any action on behalf of the state. 31 Thus similar to Locke he also goes forward to establish right of a person in himself as fundamental.
Kant’s conception of freedom, is a life devoid of opinions of others. “Each person is entitled to be his or her own master, not in the sense of enjoying some form of special self-relation, but in the contrastive sense of not being subordinated by the choice of any other particular person. ”32 This is the basic philosophy behind Right to be forgotten, a tool to ensure non-interference of others. Like Kant drew a bubble for an individual with no interference by others, John Stuart Mill aimed to establish non-interference from State. In his much celebrated work, On Liberty, Mill stated “In the part which merely concerns himself, his independence is, of right, absolute. Over himself, over his own body and mind, the individual is sovereign. ”33 Mill’s conception is very similar to the conception of right to privacy as adopted by States.
The Right to be forgotten rests on the premise of data ownership and data autonomy. The data uploaded by a person or about a person is the property of that person and that person has the right to remove such data whenever he so desires, in order to protect his digital reputation and to exercise his autonomy. Thus, it must be recognized as one of the innate right of an individual. RELATION WITH RIGHT TO PRIVACY Right to be forgotten is often termed as an extension of Right to privacy. Warren and Brandeis were the forerunners to recognize the need of right to privacy. In their seminal work published
28 ibid 27.
29 ibid, ch IX.
30Tara Mehra, ‘Behind Locke and Key: A Philosophical Reorientation of Privacy as Property in Oneself and its Applications to Personal Consumer Data’ (CMC Senior Theses, Claremont Mckenna College 3160, 2008) accessed 19 January 2025.
31 Immanuel Kant, The Metaphysics of Morals (Lara Denis (ed.), Cambridge University Press, 2017) 30.
32 Arthur Ripstein, Force and Freedom
Kant’s Lega land Political Philosophy (Harvard University Press,
2009) 10.
33 John Stuart Mill, On Liberty (Penguin UK, 2000) 13.
in 1890, they drew the concept of right to privacy from the right to personality. They opined that “the principle which protects personal writings and all other personal productions, not against theft and physical appropriation, but against publication in any form, is in reality not the principle of private property, but that of an inviolate personality. ”34 The principle that ensures inviolate personality is according to them the ‘right to be let alone’35 or ‘right to privacy’. Similarly, Thomas Cooley proposed the concept of right to be let alone as ‘the right of one’s person may be said to be a right of complete immunity; the right to be alone. ’36 Privacy is a concomitant of the right of the individual to exercise control over his or her personality.
37 It is a claim of individuals, groups or institutions to determine for themselves when, how and to what extent information about them is communicated to others. 38 The ‘right to be let alone’ or Right to privacy is “the condition or state of being free from public attention to intrusion into or interference with one’s acts or decisions”. 39 It encompasses a wide range of rights including protections from intrusions into family and home life, control of sexual and reproductive rights, and communications secrecy. However, the concept of privacy has undergone a paradigm shift due to ‘murky conceptual waters’ between what should be made public and what should be kept private. 40 The advent of technological era has proved to be ‘death of privacy. ’41 The advent of technology has given birth to privacy issues that appear to fall outside the bounds of our traditional analysis.
42 Technology fosters intrusion rather than privacy. 43 Thus, there cannot be straitjacket formula for a concept which is as diverse as privacy is in current era. Sociologists and privacy advocates, now follow a multi-dimensional approach consisting of a three pronged categorisation of privacy- physical, interactional and psychological. A fourth prong had to be added to this categorisation in digital age i. e. informational privacy. 44 When
34 Warren, Brandeis (n. 24) 205.
35 ibid.
36 Thomas Cooley, Treatise on the Law of Torts (2nd ed., Callagham Co., 1888) 29.
37 Justice K.S. Puttaswamy vs. Union of India, (2017) 10 SCC 1.
38 Alan F. Westin, ‘Privacy and Freedom’ [1967] 25(1) Washington and Lee Law Review, 7
accessed November 20, 2024.
39 Bryan A Garner, A Dictionary of Modern Legal Usage (3rd ed., OUP 2011).
40 Marx Gary, ‘Murky Conceptual Waters
The Public and The Private’ [2001] 3 Ethics and Information Technology 157.
41 A. Michael Froomkin, ‘The Death of Privacy?’ [2000] 52 Stanford Law Review 1461, 1478.
42 Lisa Austin, ‘Privacy and the Questions of Technology’ [2003] 22(2) Journal of Law and Philosophy 119, 164.
43 Howard B.White, ‘The Right to Privacy’ [1951] 18 (2) Social Research 171, 174.
44 Judee K. Burgoon, ‘Maintaining and restoring privacy through communication in different types of
relationship’ [1989] 6 Journal of Social and Personal Relationships 131, 132. evaluated in reference to the digital realm, physical privacy means right to be uninvolved and not accessible to the world at large. Interactional privacy deals with the ability of an individual to alter, restrict, expand its social interactions, whereas psychological privacy refers to the decisional autonomy to choose the aspect and content of information to be shared and received. As far as informational privacy is concerned it ‘addresses an individual’s right to reveal personal information to another. ’45 Informational privacy refers to ‘control over information, accessibility privacy focuses on central observations of physical proximity’46 Right to be forgotten acts like a tool to ensure informational privacy. It satisfies the need for an entire ‘clean slate’.
47 Roger Clarke pointed out a clear categorization of privacy, as per Clarke’s Taxonomy, known as privacy of the person; of behaviour; of data; and of communication. 48 Scholars are progressing towards a multi-dimensional approach of data privacy wherein “informational privacy, accessibility privacy, and expressive privacy [must be] combined together, to provide a right to have control over information, right to allow limited access, and right of personhood”. 49 Recent informational threats seem to come from everywhere at all times but can be organized into four categories: threat of limited foresight, threat of rational ignorance, threat of others, and threat of others like us. The right to be forgotten is a modern day solution for the modern day problem as it attempt to address these threats.
50 However to say that Right to be forgotten is a subset of right to privacy is not entirely true. Privacy concerns information that is private and sensitive and provides autonomy over such data. Right to be forgotten provides blanket cover not only to sensitive private information, but also public information shared by the individual51 which lacks ‘right to control’52 because of dearth of jurisprudence. Further, right to privacy is a broader concept that encompasses a wider range of control over personal information. This includes the right to decide who has access to your information, how it is used, and the right to prevent its dissemination without your consent etc. whereas Right to be forgotten deals only deals with deletion of data.
Thus, while focus of the former is 45 Ulrike Hugl, ‘Approaching the Value of Privacy: Review of Theoretical Privacy concepts and Aspects of Privacy Management’ [2010] 248 AMCIS 1, 4.
46 ibid.
47 L Costa and Y Poullet, ‘Privacy and the Regulation of 2012’ [2012] 28 Computer Law & Security Review 254, 257.
48 Kulhari (n. 23) 3.
49 Judith Wagner DeCrew, In pursuit of privacy (Cornell University Press, 1997).
50 Meg Leta Jones, Ctrl + Z The Right to be Forgotten (New York University Press, 2016) 83.
51 Weber (n. 6) 120.
52 Allan F. Westin & Michael A. Baker, Databanks in a Free Society
Computers, Record-keeping and Privacy (New York: The New York Times Book, 1972) 42. on an individual’s control over data as a whole, the latter is concerned about individual’s wish to delete the specific data. For better understanding, think of the right to privacy as a fence around your property. It controls who comes in and what information is kept within the fence. The right to be forgotten, on the other hand, is like removing unwanted objects from your yard that are already visible from the street. Thus, while the genesis of both the rights are the same, the advent of technological era has disconnected two formerly twin rights. CLASH WITH FREEDOM OF SPEECH AND EXPRESSION Freedom of speech and expression is one of the most basic right of an individual. It finds its place in almost all the democracies of the world, be it India53, USA54 or European Union.
55 Even international conventions like European Union Convention on Human Rights,56 UDHR57 and International Covenant on Civil and Political Rights58 enshrines freedom of speech and expression. The right empowers an individual to use his gift of gab to his full benefit but is subject to some restrictions. Courts have evaluated this right to include the expression of opinions and the freedom to receive and impart information. 59 However when society’s desire to know is juxtaposed with an individual’s desire to hide his information, a clash is evident. This clash is nothing new. Matt Ford, a renowned scholar remarked “I do not know of a similar case where on the one hand a government publishes information, and on the other hand punishes people by stopping them to read it. ”60 However, law believes in setting up harmonious balance between all the provisions to ensure a well ordered society.
The legal bull of free speech is not always allowed to run unchecked in the china shop. Thus, it is clear that both the rights should be balanced with each other and not put against each other. What is undecided is how much weight one right should carry in relation to the other, and who should conduct the balancing. 61 While some scholars dispose right to be forgotten as being a threat to freedom of
53 Constitution of India 1951 (IND) (Constitution), art. 19(1).
54 Human Rights Act 1998 (UK).
55 Charter of Fundamental Rights of the European Union [2000] OJ C346/1, art. 11.
56 European Convention on Human Rights, opened for signature 4 November 1950, 213 UNTS 222 (entered into force 3 September 1953) art 10. 57 Universal Declaration of Human Rights, GA Res 217A (III), UN Doc A/RES/217(III) (10 December 1948) art 19. 58 International Covenant on Civil and Political Rights, opened for signature 16 December 1966, [1966] 999 UNTS 171 (entered into force 23 March 1976) art 19.
59 Case C-73/07 Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy [2008] ECR I-9831 [39].
60 Matt Ford, ‘Will Europe Censor This Article?’ (The Atlantic, May 05, 2014)
accessed on February 12, 2025. 61 Shaniqua Singleton, ‘Balancing A Right To Be Forgotten With A Right To Freedom Of Expression In The Wake Of Google Spain V. AEPD’ [2015] 44 GA. J. INT’L & COMP. L 165, 178. speech and expression,62 others treat it as a balance between transparency and privacy. 63 The question regarding this was raised in the case of Mario Costeja, first case of Right to be forgotten. The tussle between public access to information with right to privacy was discussed and CJEU held that a right to be forgotten cannot exist without balancing other relevant interests like the freedom of expression64 i. e. the right to be forgotten shall not hold precedence over any other right. However the balancing is more dependent on case to case basis. While in some public access to information is given importance, in others an individual’s autonomy wins the battle.
The other issue in this tussle lies in the fact that Right to be forgotten tends to remove the information that has been published and forms a part of public record. Even in AEPD case, CJEU held that an individual’s interest in removing personal data outweighs the public’s interest in accessing his or her information and ordered search engine operator to remove unwanted links to sites with information relating to a person that appear after a search of their name. 65 However, the Right to be forgotten cannot be an absolute right ensuring total deletion of all the information. In 2012, Vice President of the European Commission, Viviane Reding, suggested that, “It is clear that the right to be forgotten cannot amount to the total erasure of history. ”66 Absolutism of Right to be forgotten might negate its basic objective.
Thus, like every right, it should also be subjected to certain restriction. In order to ascertain a balancing test, one must seek inspiration of balancing criterion propounded by Courts while analyzing other clashes. For example, in Axel Springer AG v Germany,67 court tried to strike a balance between freedom of speech and expression and right to privacy. Court held freedom of speech to be ‘one of the essential foundations of a democratic society and one of the basic conditions for its progress and for each individual’s selffulfilment. ’68 Court held that freedom of expression can be limited in view of the rights of others, such as privacy and laid down an ‘essential criterion... of general interest. ’69 Further in
62 Robert G. Larson, ‘Forgetting the First Amendment
How Obscurity-Based Privacy and a Right to be Forgotten are Incompatible with Free Speech’ [2013] 18 COMM. L. &POL'Y 91, 95. 63 Woodrow Hartzog, Evan Selinger, ‘Obscurity: A Better Way to Think about your Data than "Privacy," (The Atlantic, January 17, 2013) accessed on January 13, 2025.
64 Google Spain (n. 12).
65 ibid.
66 ibid.
67 C- 39954/08 Axel Springer AG v Germany [2012] ECR 238.
68 ibid [90].
69 ibid [91].
Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy70, the court relied on literal interpretation of statute to lay down a criterion for balancing the two rights. CJEU, in this case held that both, individual privacy rights and the freedom of expression can be restricted, provided that any imposed limitations are laid down by law. 71 The usual tests of “substantial relevance” when it comes to personal data and “proportionality” (regarding deletion requests) may also be used for tailoring the need. 72 The usage of such balancing tests not only solve the clash between the two rights but also keeps a check on misuse of the provision. For example, after the landmark judgment of Mario Costeja, convicted murderers have attempted to remove references to their crimes under privacy laws, and duly failed. 73 In M. L. and W. W. v.
Germany,74 two brothers Wolfgang Werle and Manfred Lauber were convicted for the murder of Walter Sedlmayr and served 15 year prison sentences. Upon their release in 2008, they sued Wikipedia and other media outlets for publishing the news of their crime and claimed their Right to be forgotten. The German Court, upheld the constitutionally guaranteed Freedom of the press. Court held that Werle and Lauber would have to accept a certain degree of intrusion into their privacy since the act they did cannot be given the protection of Right to be forgotten. Since the current data protection of regime in India, only provides a substantive content to right to be forgotten and not procedural, we shall deal with each case on the basis of facts provided.
Thus, one step towards harmonizing the Right to be forgotten with the existing Right of Freedom of speech and expression would be to provide clearer standards for the data fiduciary while taking individuals’ removal requests. In Google Spain, the CJEU noted that any information will be deemed to be longer necessary when it appears “to be inadequate, irrelevant or no longer relevant, or excessive”75 but this test is too subjective. Similarly, the proportionality balance is something for Courts to do but for easy disposal of removal requests without any clash between the two rights, clarity in the law is the essence. Therefore, uniform guidelines and standards are necessary to ensure that every individual is aware of when their rights can be invoked.
70 Tietosuojavaltuutettu (n. 59) [55]–[56].
71 ibid 55.
72 Ausloos (n. 18) 151.
73 Kampmark (n. 15) 12.
74 M.L. and W.W. v. Germany, App. Nos. 60798/10.
75 Google Spain (n. 12) [93].
RIGHT TO BE FORGOTTEN: INDIA'S JOURNEY TO A MORE PRIVATE
INTERNET India is currently experiencing a digital revolution. In the matter of last few decades, India took major steps to establish itself as a digital economy. However the dream of having a digitized society cannot be achieved without having a robust data protection regime. The earlier information technology regime in India consisted of a patchwork of outdated laws which failed to cater the dire need of data protection of the country during the digital revolution. In India, the existing jurisprudence of a data protection regime stemmed from the landmark judgment of Justice K. S. Puttaswamy vs. Union of India76, wherein the ambit of Article 21 was extended to recognize right to privacy as an intrinsic part of ‘life and dignity’. Kaul J. while rendering his opinion gave impetus to a new debate on the emergence of a novel right— the 'Right to be forgotten.
' Since at that time Srikrishna Committee was constituted to gift India its first data protection legislation, judges left this matter to the wisdom of our Legislature. Little did they know, that India's dream of having a data protection legislature would be transformed into a five-year struggle of blood, sweat, and toil for us to adopt such legislation. Finally, in August 2023, we succeeded in enacting the Digital Protection of Personal Data Act, 202377 [hereinafter referred to as ‘DPDP Act’]. JOURNEY PAVED BY COURTS IN INDIA On January 19th, 2017 the tussle to understand the Right to be forgotten started with the case of Dharamraj Bhanushankar Dave,78 wherein for the first time Right to be forgotten was claimed in India and its existence was denied by Gujarat High Court. However four days later on 23rd January, 2017 Karnataka High Court in Sri Vasunathan v.
The Registrar General,79 Judge Byrrareddy recognized the existence of the right and ordered retraction of name from online copy of concerned judgement. He concluded the judgement by affirming the existence of the right by saying ‘This would be in line with the trend in the Western countries where they follow this as a matter of rule "Right to be forgotten" in sensitive cases involving women in general and highly sensitive cases involving rape or affecting the modesty and reputation of the person concerned. ’80
76 Puttaswamy (n. 27).
77 The Digital Protection of Personal Data Act 2023 (IND) (DPDPA).
78 Dharamraj Bhanushankar Dave v. State Of Gujarat, 2015 SCC OnLine Guj 2019.
79 2017 SCC OnLine Kar 424.
80 ibid.
The question yet again came up in front of Delhi High Court in Zulfiqar Ahman Khan v. M/S Quintillion Business Media Pvt Ltd. 81 While deciding the merits of this case, the High Court recognised that the Plaintiff's Right to privacy, of which the `Right to be forgotten' and the ‘Right to be left alone' are inherent aspects, was violated. 82 Thus, they restricted the publication and republication of impugned articles and ordered deletion by upholding the claim of Right to be forgotten. Delhi High Court upheld the ratio of this case in Jorawer Singh Mundy v. Union of India. 83 The contours of the right was discussed in depth by Justice S. K. Panigrahi in Subhranshu Rout @ Gugul v. State of Odisha. 84 Panigrahi J.
observed ‘There is a widespread and seemingly consensual convergence towards an adoption and enshrinement of the right to get deleted or forgotten but hardly any effort has been undertaken in India till recently, towards adoption of such a right, despite such an issue has inexorably posed in the technology dominated world... It is also an undeniable fact that the implementation of right to be forgotten is a thorny issue in terms of practicality and technological nuances. In fact, it cries for a clear cut demarcation of institutional boundaries and redressal of many delicate issues which hitherto remain unaddressed in Indian jurisdiction. ’85 The court referred to the data protection framework of various countries and relied on judgments by foreign Courts.
Due to want of statute, the Court instead of relying on a non-existent Right to be forgotten, relied on much celebrated Right to privacy to provide remedy the petitioners but urged the Legislature to adopt with this much necessary right. Yet again the conundrum of acceptance of this right continued when Madras High Court in
2021 in the case of Karthick Theodre v. Registrar General, Madras High Court and Ors.,86
rejected issuing any order to pursue right to be forgotten by concluding that ‘it would, therefore, follow that the “right to be forgotten” cannot exist in the sphere of administration of justice particularly in the context of judgments delivered by Courts.’ High Courts across various states grappled with the quandary of the existence of Right to be forgotten in Indian legal paradigm caused a mayhem of opinions. The question finally reached the doors of Hon'ble Supreme Court in the case of Google India Pvt Ltd. v. Visaka Industries.87
81 2019 SCC OnLine Del 8494.
82 ibid.
83 2021 SCC OnLine Del 2306.
84 2020 SCC OnLine Ori 878.
85 ibid.
86 2021 SCC OnLine Mad 2755.
87 (2020) 4 SCC 162.
However, instead of elucidating the details, the Supreme Court opted to take an easy way. Since the case was related to criminal defamation due to publication of objectionable statements online, the Court constrained its ratio to the matter in hand without delving into the specifics of the rights. It based the judgment on jurisprudence derived from the European Union's General Data Protection Regulation (GDPR). The most recent development in this field is the judgment of Kerala High Court in Vysakh K. G. v. Union of India & Anr. ,88 wherein the Court was called upon to decide the persistent issue of online publication of judgments. The division bench consisting of Justice A. Muhamed Mustaque and Justice Shoba Annamma Eapen observed that the recognition of a right is prerogative of Legislature and not Judiciary.
Judiciary, when faced with question regarding any right can give solutions based on the facts of the case only. The court observed "In individual cases, the Court may, after adverting to time and space, order the erasure of past records. However, nothing prevents the Legislature from bringing in Legislation recognizing the right to be forgotten to erase such records after the expiry of such period as it deems fit to fix. Further, laying down the grounds when such a right to be forgotten can be exercised is the prerogative of the Legislature. As the right to be forgotten is not an absolute right, it is crucial that the legislature enumerates the grounds when an individual can claim this right. ”89 The concept of the Right to be forgotten in Indian jurisprudence remains shrouded in uncertainty despite extensive debates and discussions in various High Courts.
While the Indian judiciary has consistently demonstrated a commitment to upholding and respecting global human rights standards, the acknowledgment and thorough examination of the Right to be forgotten have been conspicuously absent. Despite the increasing relevance of digital privacy concerns and the global discourse surrounding individuals' control over their personal data, the Indian legal landscape lags in providing a clear framework for this right. In conclusion, the evolution of the Right to be forgotten in Indian Jurisprudence is marked by uncertainty, inconsistent court decisions, and a lack of comprehensive engagement by the judiciary.
The absence of a concrete stance raises challenges for individuals seeking protection of their digital privacy rights and highlights the need for a more nuanced and context-specific approach to address the complexities of the evolving digital landscape within the Indian legal system.
88 2022 LiveLaw (Ker) 665.
89 ibid.
POSITION IN INDIAN DATA PROTECTION FRAMEWORK
India faced considerable challenges in establishing a framework for data protection. A Committee of experts was constituted under the chairmanship of Justice BN Srikrishna by Ministry of Electronics and Information Technology to deliberate on data protection framework in India. 90 The committee came up with a comprehensive report on data protection and a draft bill in 2018. Following a succession of unsuccessful draft bills, India ultimately ratified the Digital Protection of Personal Data Act, 2023, on the 11th of August, marking a significant milestone in the country's regulatory approach to safeguarding personal information. The report, submitted by the Committee of experts with Justice BN Srikrishna at its helm, suggested the adoption of Right to be forgotten.
91 The Committee defined the right as ‘the ability of individuals to limit, de-link, delete, or correct the disclosure of personal information on the internet that is misleading, embarrassing, irrelevant, or anachronistic. 92 They relied on the report of Justice Committee for GDPR, which identifies Right to be forgotten as a right against the disclosure of data when the processing of her personal data has become unlawful or unwanted. 93 The said committee took Right to be forgotten as an restatement of existing provisions—‘data shan‘t be kept for longer than is necessary; if it has been processed in breach of the legal requirements it should be deleted, which goes without saying. ’94 Srikrishna Committee not only recommended the adoption of the right, but also highlighted its shortcomings.
According to the Committee report, ‘the right itself is defeasible’95 as the assessment of irrelevancy and unfairness of data principal and fiduciary is often juxtaposed. In order to curb this the Committee also laid down a balancing test. The balancing test for that could be to check whether ‘the interest in discontinuing the disclosure outweighs the interest in continuing with it. ’96 90 Office Memorandum, Government of India, Ministry of Electronics and Information Technology (MEITY), No. 24(4) 2019 CLES accessed on January 18, 2025.
91 Committee of Experts on a Data Protection Framework for India, A Free and Fair Digital Economy:
Protecting Privacy, Empowering Indians (MEITY July 27 2018) 81.
92 ibid 75.
93 Justice Committee, The Committee‘s opinion on the European Union Data Protection framework proposals
(HC 2012-13, 572-1) 26.
94 ibid.
95 ibid 76.
96 ibid.
The Srikrishna Committee additionally published a White Paper97 to present the public input gathered on the essential elements of data protection law. This document outlined the key issues identified by a significant portion of the Committee members that they believe should be incorporated into legislation. The White Paper also gave a green flag for the adoption of the right but recommended a balance between the right to freedom of speech and expression with the right to privacy. 98 It further advised to set clear parameters in the law on the basis of which a controller will carry out the balancing exercise.
99 Thus on the basis of these comments, Srikrishna Committee recommended that the Right to be forgotten may be adopted but under the supervision of the Adjudication Wing, to be established, which will be required to determine its applicability on the basis of the five-point criteria100 inspired by Google’s internal policy framework101 as follows: (i) the sensitivity of the personal data sought to be restricted; (ii) the scale of disclosure or degree of accessibility sought to be restricted; (iii) the role of the data principal in public life (whether the data principal is publicly recognisable or whether they serve in public office); (iv) the relevance of the personal data to the public (whether the passage of time or change in circumstances has modified such relevance for the public); and (v) the nature of the disclosure and the activities of the data fiduciary (whether the fiduciary is a credible source or whether the disclosure is a matter of public record; further, the right should focus on restricting accessibility and not content creation).
Based on the recommendation of the Committee, the right found its place in Personal Data Protection Bill, 2019. 102 However, due to implementation and infrastructural challenges, the bill was forwarded to a Joint Committee of Parliament of India for review, which took about 2 years due to the global pandemic. Meanwhile, Ministry of Electronics and Information Technology constituted a Committee of Experts, which submitted their report on Non Personal 97 Ministry of Electronics and Information Technology, White Paper of the Committee of Experts on a Data Protection Framework for India (White Paper, 2017).
98 ibid 141.
99 ibid.
100 Srikrishna (n. 91) 81.
101 Luciano Floridi et al, Report of the Advisory Council to Google on the Right to Be Forgotten (Google, February 2015) accessed on 19/01/2025.
102 Personal Data Protection Bill 2019 (IND), s. 20.
Data Governance Framework in July 2020, to harness the value of non-personal data. With over 1,500 responses, they released a revised NPD Report in January 2021, aligning it with the PDPB. Based on this report the Joint Committee came up with the Data Protection Bill, 2021. This bill adopted Right to be forgotten as elucidated by Sri Krishna Committee under the heading ‘right to erasure’. 103 This right to erasure provided for deletion of data no longer necessary for the purpose for which it was processed unless retention is necessary for a legal purpose. This Bill also met with huge criticisms and paved way for the Digital Protection of Personal Data Bill, 2023 which solidified as an Act on 11 August, 2023. The Act focuses on personal data protection. In India, the legal landscape regarding AI lacks specific legislation.
The closest instance of a government guidelines with reference to AI is the National Strategy for AI by NITI Aayog. 104 However these guidelines, instead of giving any regulation, lays down a holistic plan for the government for ethical development in the field of AI and highlights the importance of AI in different sectors for the development of the Nation. While the Information Technology Act105 exists, it primarily addresses sensitive personal data through the SPDI Rules. 106 Sensitive personal data being a sub category of personal data rules out the possibility of a holistic protection of data. Further, these rules do not encompass all AIrelated issues, leaving gaps in regulation. The Task force on AI for India’s Economic Transformation” is chaired by Prof Dr. V.
Kamakoti in the year 2017, also, recommended drafting of a holistic AI code with reference to economic and personal rights of citizens. However the specific legislation is still awaited and for any personal data related concerns emerging from any technology, the core lex specialis is the DPDP Act, 2023.
AN
ANALYSIS
OF THE PROVISION IN OUR CURRENT DATA PROTECTION REGIME Right to be forgotten is enshrined in Section 12 of the Act as Right to erasure. It provides that ‘a data principal shall have the right to erasure of her personal data for the processing of which she has previously given consent, in accordance with any requirement or procedure under any law for the time being in force.’ Clause (3) of the provision is an exceptional clause that states that ‘data fiduciary shall erase the information unless retention of the same is necessary for the
103 Data Protection Bill 2021 (IND), s. 13.
104 ‘National Strategy for Artificial Intelligence’ (NITI Aayog, 2018)
accessed on March 10, 2025.
105 The Information Technology Act 2000 (IND).
106 Sensitive Personal Data or Information Rules 2011 (IND).
specified purpose or for compliance with any law for the time being in force. ’ In order to analyse this provision, let us first understand the basic glossary used. Data principal is defined as ‘the individual to whom the personal data relates. ’107 She is ‘the focal actor in the digital economy. ’108 The Act defines personal data as ‘any data about an individual who is identifiable by or in relation to such data. 109 Hence, a cohesive reading of both the provisions clearly highlights the test of ‘identifiable’ and ‘relativity’ was taken to be a bench mark. The protection of any data that relates to an identifiable individual, intuitively fitting the objective of protecting an individual‘s identity. 110 Same pattern of pre requisites are visible in different data protection regimes around the globe. For instance, GDPR also uses the ‘identifiable’ test.
111 The Canadian Privacy Regime uses ‘identifiable individual’ test112 while Australian law has added the concept of rationality and devised a “reasonably identifiable test. ’113 Thus the consistency of law is same throughout the globe. Due to the technological development, data does not exist in binary state of identifiable and non-identifiable. 114 At times this test leads under representation and at times it is over representation of the actual scenario. The problem of under representation pops up because it excludes anonymised data. Anonymisation refers to the process of removing identifiers from personal data in a manner ensuring that the risk of identification is negligible. 115 Anonymisation is generally considered as a tool to protect privacy but anonymised data is also not away from the shadow of cyber exploitation.
As per Paul Ohm’s experiment data set of search queries released by AOL, after having removed all identifiers from the data set, the data still resulted in the identification of an individual within days of release of the data set by AI. 116 In this scenario, since data is anonymised, it is not directly identifiable, therefore, will lie outside the purview of Right to be forgotten, but has all the capabilities to harm an individual.
107 DPDPA, s. 2(j).
108 Srikrishna (n 91) 8.
109 DPDPA, s. 2(t).
110 Whitepaper (n. 97).
111 GDPR, art. 17.
112 Personal Information Protection and Electronic Documents Act 2000 (CAN), s. 2(1).
113 Privacy Act 1988 (AUS).
114 OECD, Privacy Expert Group Report on the Review of the 1980 OECD Privacy Guidelines (OECD Digital Economy Papers, No. 229, OECD Publishing, July, 2013) accessed 30 January 2025.
115 Mark Elliot, Elaine Mackey, Kieron O‘Hara and Caroline Tudor, The Anonymisation Decision-Making
Framework (UKAN, 2016) 2. 116 Paul Ohm, ‘Broken Promises of Privacy: Responding to the surprising failure of Privacy’ [2010] 57 UCLA Law Review 1701, 1717.
Secondly, this test fails to stand the test of the modern technologies. The new IoT and AI technology captures unique data. For example, the pedometer measures and captures steps, gait, heart rate, pulse rate etc. of a person which cannot be directly associated but can be uniquely traced. 117 Similarly data collected by AI may appear to be crude data but when trends and patterns of such data is studied, it can easily foretell the entire life history of an individual. AI evaluates a non-personal data sets too. Since these data sets are not directly identifiable, they will never qualify for the protection granted by Right to be forgotten in Indian legal paradigm. Further, personal data encompasses information that can directly or indirectly identify an individual. This extends to details that, either alone or combined, can uniquely pinpoint someone.
However, they leave to interpretation whether it includes information that can be used to identify a person with high probability but not with certainty, e. g. a pictures of a person or browsing history etc. Furthermore, it's unclear if data that identifies individuals within a small group, like a family, falls under this definition. A related question is how aggregated and derived forms of information will be affected when some of the raw data from which statistics are derived are forgotten. While removing forgotten raw data from these forms is technically complex, retaining it poses risks of re-identification through correlation. Striking a balance between privacy and usability is crucial in handling such data intricacies. Further, Right to erasure under the Act lays down the widest possible base for the implementation of the right.
Unlike its predecessors, it does not draw any parameter or balancing test as a benchmark. The only pre requisite for any request of erasure is the pre requisite consent of the data principal. If the information was given by consent, it can be deleted by consent. This analogy seems very feasible but there lies a loophole. When an established legal ecosystem like the European Union, which has already laid down clear guidelines for the implementation of the right to be forgotten and whose courts, through various judgments, have clearly defined the scope of the Act, is still struggling with conflicts of ideas regarding other equally important fundamental rights, a relatively new legislation in India will certainly pose a threat. It is for this reason that Sri Krishna Committee laid a clear guideline which was mirrored in PDP Bill of 2019 but was blatantly removed in its descendants.
The Act failed to 117 Scott R Peppet, ‘Regulating the Internet of Things: First Steps Toward Managing Discrimination, Privacy, Security and Consent’ [2014] 93 (85) Texas Law Review 156. justify the existence of right to be forgotten. When courts were clearly begging the Legislature to come up with a clear structure for implementation, the Legislature failed to do so. NEED OF RIGHT TO BE FORGOTTEN The right to be forgotten has its foundation drawn on the premise of the interrelationship between memory and personal identity. 118 In the digital era, perhaps the most fundamental change occurring in humans is that the original balance is reversed between memories and forgetting. 119 The internet, which is characterized for fluidity and storage of data, enables data travelling in a fraction of second, which makes it harder to lose.
The access of data is eased to myriad levels by advent of technology. While the risk associated with data storage and data leakage is high, the awareness among population for data protection is still weak. As per the Consumer Survey: Data Privacy and Financial App Usage conducted by The Clearing House (TCH) in 2021, 76% of the respondents were unaware that the social networking apps can sell personal data to other parties for marketing, research, and other purposes while 77% were unaware that the apps to retain access to information even after the app is deleted. 120 According to the survey 78% of the respondents were unaware that the apps regularly access personal data even when the app is closed or deleted. 121 The rising awareness about the risks posed by technology is prompting them to take an action and break the digital panopticon.
More and more realization of the risks posed by digital memory is strengthening the need of right to be forgotten in the current era. The Right to be forgotten is crucial in this context as it empowers individuals to control their digital footprint and protect their privacy. It allows individuals to request the removal of outdated or inaccurate information, preventing it from being used against them in the future. Additionally, it provides a mechanism for individuals to disassociate themselves from past actions or events that may no longer be relevant. Further, one of the biggest problem with deletion in respect to modern day technologies is the unwanted exposure resulting into Streisand effect. The Streisand effect, a phenomenon where attempts to suppress information result in its wider dissemination, highlights the paradox of
118 Weber (n.6).
119 He Zhile, Huang Daoli, Lei Yunting, ‘Legislation of “Right to be forgotten” in Big data environment’ [2014]
3 ICSSR 167, 169.
120 ‘2021 Consumer Survey: Data Privacy and Financial App Usage’ (The Clearing House, December, 2021) accessed on March 14, 2025.
121 ibid.
censorship.122 The phenomenon, coined the "Streisand effect" after Barbara Streisand, the American singer and actress, emerged when she sued a photographer for an aerial picture of her home, alleging a privacy violation. However, the litigation inadvertently sparked widespread dissemination of the news, contrary to her intentions. This effect illustrates the paradox where attempts to safeguard something result in increased exposure. Presently, numerous instances demonstrate individuals falling victim to the Streisand effect. Thus, the sole solution to mitigate this, is to enable swift and straightforward data removal without resorting to court proceedings. If individuals can protect their data within their confines by simply submit a form or application, the issue of unwanted attention could be readily addressed.
CONCLUSION
AND SUGGESTION The world that we are living in, is nothing short of a digital Panopticon, where the gaze of technology pervades every aspect of our existence. Right to be forgotten is indisputably a European creation, but there is a great deal to be gained from studying digital redemption beyond European borders. From the analysis, it can be easily concluded that the limbs of the right rests on the inherent values like need to protect an individual’s dignity and autonomy. However, when it comes to Indian legal paradigm, India failed to innovate and include the modern perspectives to the problem. Modification as per latest technologies are the need of the hour. First and foremost, a clear scope of “Personal Data” should be included.
The clarity is required as to data processed by what technologies will fall under the ambit of the Act and if the Act encompasses everything, then a clarification of who has the right to ask for the deletion of personal data under which circumstances, and what are acceptable ways to affect the removal of data is needed. When providing the abovementioned definitions, the technical challenges in enforcing the Right to be forgotten, and the associated costs, for a given choice of definition should also be considered. A substantive law without clear procedures is like a lion without teeth. Thus, first and foremost requirement for proper implementation is the presence of clear procedures. EU adopted its Guidelines for implementation of Right to be forgotten123 in 2019.
Many countries like United 122 Brian Martin, Sue Curry Janeson, ‘The Streisand Effect and Censorship Backfire’ [2015] 9 International Journal of Communication 656. 123 Guidelines 5/2019 of July 7, 2020 on the criteria of the Right to be forgotten in the search engines cases under the GDPR [2022] OJ L119/1.
Kingdom, France etc. adopted national guidelines based on the same framework. Thus, Indian legislation should take inspiration from these guidelines but should go ahead and make a comprehensive Rules under Section 40 of the DPDP Act, 2023 to ensure proper implementation and complete protection from all sorts of digital menace. Further, guidelines can also be adopted for Data Fiduciaries ensuring ethical data collection, data storage and processing. Directions for capping the data storage limitations, purpose driven processing requirements, secured storage and initiatives to foster awareness about the risks of data leakage etc. can be included in the law. Thus, an approach encompassing technological innovation, legal reform, and philosophical inquiry, all aimed at crafting a more nuanced, effective, and humane digital future is necessary.
Only through such a comprehensive and interdisciplinary effort, can the Right to Be Forgotten realize its full potential, transforming from a noble concept into a practical tool for safeguarding digital dignity in an increasingly interconnected world and help us to surpass the boundaries of the digital Panopticon and navigate a path toward a future where technology empowers rather than controlling. accessed on March 10, 2025.