The Personal Data Protection Bill 2018: Do you have the Right to be Forgotten from the Internet?

Data, in a way, is the new gold. The pervasiveness of internet and technology into our lives has raised questions on data protection. The right to be forgotten ie. have your information removed from search, has been recognised and accepted by many jurisdictions. JITHENDRA PALEPU writes on its encapsulation by the Indian Supreme Court and Personal Data Protection Bill 2020.

———-

“Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual … the right ‘to be let alone’ … Numerous mechanical devices threaten to make good the prediction that ‘what is whispered in the closet shall be proclaimed from the house-tops.’”

Louis Brandeis wrote these words in 1890, which is probably the very first major work on the advocacy of privacy rights. Brandeis who later went on to become the Chief Justice of the United States Supreme Court, was clearly ahead of his times as his prediction turned true.

The personal information of individuals is no longer restricted to only newspapers, official and government records. It can now be accessed from anywhere around the world through the internet.

This drastic change in both the nature and the quantity of personal information available online is a worrying issue. A person need not be well established or an overachiever to be in the search results of Google or any other search engine for that matter.  Our social media usage, the pages and events we like, photos and videos we upload, the discussions we indulge in, tagging our friends and vice versa- are all ensuring to establish our digital footprint.

The algorithms used by the online search engines and platforms track and analyse the behaviour of each person online so as to provide them with the content which they prefer or get influenced by.

The right to be forgotten is a right that removes one’s personal information from the internet which is a public space. However, while exercising this right, one is curtailing the public’s right to information which is under the freedom of expression.

This data of individuals is often created by both public and private bodies but not by the individuals themselves.

One can even look up and get information on a person who does not possess any online account. In light of this, a system that enables the individuals to get their personal information removed from the eternal memory of the internet is only reasonable and fair.

The right to be forgotten pertains to the right of individuals to erase, restrict, delink, delete or correct deceptive, humiliating, obsolete or anachronistic personal information on the Internet.

(Credit: Cerillion, Source: Common Creative)

This right first originated in a judgment by the Court of Justice of the European Union (CJEU), in the famous Google Spain Case wherein the court ordered Google to remove the online links relating to debt recovery proceedings of a Spanish individual. The court upheld the individual’s right to obtain the rectification, erasure, or blockage of data which is incomplete or inaccurate from search engines.

Although legally recognised in 2014, this right was already present in different forms in other jurisdictions. For example, France has laws, both in civil and criminal matters that impose a limitation on information by having a duration of forgetting. France views the privacy of criminal records very seriously and strives to rehabilitate ex-convicts.

The Indian privacy regime has seen a different wave with the introduction of the new Personal Data Protection Bill (PDP Bill) in 2018. The bill came up with many changes regarding data processing and privacy rights of individuals.  One of the things that the bill seeks to bring in is the right to be forgotten which is not available in the current legal framework under the Information Technology Act 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

The right to be forgotten pertains to the right of individuals to erase, restrict, delink, delete or correct deceptive, humiliating, obsolete or anachronistic personal information on the Internet.

The right to be forgotten is incorporated in Section 27 of the PDP Bill. According to this section, every person has the right to restrict or prevent continuing disclosure of personal data by any data fiduciary if such disclosure meets any one of the following conditions,

1. The disclosure served the purpose for which it was made or is no longer necessary
2. The disclosure was made with prior consent from the individual and such consent has since been withdrawn.
3. The disclosure was made contrary to the provisions of the new bill or any other law in force.T

A request has to be made by the individuals to the ‘adjudicators’ to avail this right to be forgotten. These adjudicators are appointed by the data protection authority whose members are in turn appointed by the government. This essentially vests the adjudication power to the government agencies which is in direct violation of the doctrine of separation powers.

The power to balance the right to be forgotten and the right to freedom of expression

The right to be forgotten is a right that removes one’s personal information from the internet which is a public space. However, while exercising this right, one is curtailing the public’s right to information which is under the freedom of expression. To put it simply, the search query results will disappear gradually if this right is claimed extensively. Hence there is a need to balance both these rights on a case to case basis. The Personal Data Protection Bill is empowering the ‘adjudicators’ to receive the requests from individuals and then to balance out these two rights on a case to case basis.

Whereas in the EU, the law envisages the data controllers (the search engines) to consider the requests of the Right To Be Forgotten and apply the balancing test. This process is criticised on the grounds that the search engines will be more inclined to accept individual requests and will remove the information to avoid legal consequences.

Through this logic, the Right to be Forgotten requests are to be considered by the search engines with a comprehensive framework provided by the law.

The Justice Sri Krishna Committee (formed to recommend suggestions and analyse the bill) also reiterated that the balancing test should be conducted by the adjudicators and not by the search engines.

The committee’s perspective towards this right failed to see the essence of privacy which is the right to be left alone. This does not mean that one is renouncing the world or is exiting from the society. This notion of right pertains to an individual’s choices of how to lead their life. It is an expectation that the society or state will not intervene in the personal choices made by the individual as long as they won’t cause harm to others.

The Supreme Court in Justice K.S. Puttaswamy (Retd) v/s Union of India recognised this so called right as part of the right to life under Article 21:

“Privacy includes at its core the preservation of personal intimacies, the sanctity of family life, marriage, procreation, the home and sexual orientation.  Privacy also connotes a right to be left alone. Privacy safeguards individual autonomy and recognises the ability of the individual to control vital aspects of his or her life. Personal choices governing a way of life are intrinsic to privacy.”

Hence the current bill is going against the judgment of the Supreme Court by empowering the state to adjudicate upon the claims for the Right to be Forgotten. Through this logic, the Right to be Forgotten requests are to be considered by the search engines with a comprehensive framework provided by the law. This will ensure limited intervention by the state in the personal choices of the individuals.

(Credit: StockCatalog, Source: Common Creative)

The limited right to be forgotten

The bill just provides for the restricting of continuing disclosure of information and not a complete erasure from the Internet database. The restrictions in the context of Section 27 refer to the delinking of the personal information from the search results, which means that the web links leading to personal information will be removed from the search results of the search engines but the original source of that information will remain intact.

The Committee also recommended not to have the right to complete erasure of information. The intent behind this is to address free speech concerns. Many scholars argue that the right to be forgotten has the potential to be the biggest threat to freedom of expression in the future. However, the EU is handling the right to erasure effectively as they have barely any state intervention in this matter. The delinking as well as erasure, both can be incorporated if the legislation provides a detailed mechanism on how to approach and consider the Right to be Forgotten claims on a case to case basis and this power shall only be the judiciary’s cup of tea.

With respect to the right to be forgotten, the draft Personal Data Protection Bill and the recommendations of the Sri Krishna Committee are not in line with the judicial developments that took place in the country. Privacy is now part of the right to life and hence is inalienable.

We, as a nation are better off at this moment without this right if at all the power to adjudicate and approve the requests is in the hands of the State. If the Personal Data Protection Bill in its current form is enacted then perhaps, we all need to go Away From Keyboard, to ensure that we do not provide more personal data on the internet which ultimately will be controlled by the State.

(Jithendra Palepu is a final year student at Symbiosis Law School, Pune. He is passionate about Constitution, Jurisprudence, Privacy Laws and International Law. He is an intern at The Leaflet. )