The Horizons Of Privacy And The Right To Be Forgotten

In the era of data-based surveillance, the target often surfaces from the data collected, stored, or archived against a person or group of persons. The right to be forgotten refers to the power or competence of individuals to limit, de-link, delete, or correct the disclosure of personal information on the internet that is misleading, embarrassing, irrelevant, or anachronistic. This digitally surfaced right emerged explicitly as a fledged lawful right in the Google Spain v. AEPD judgement wherein the court pre-empted the extended territorial scope and the right to erasure in the GDPR, and discussed the agitation between the right to privacy and data protection on the one hand, and freedom of expression and access to information to the public on the other.

In common parlance, the right to be forgotten provides a data principal (as defined in Personal Data Protection Bill 2019) with the right against the disclosure of an individual's data when the processing of such personal data has become unlawful or futile. The Indian Personal Data Protection Bill 2019 ("PDPB") provides for rights of correction and erasure of personal data wherein the data fiduciary receives a request from a data principal to correct, update or erase personal data. The right to be forgotten has gained substantial spotlight in the Indian jurisdiction in the absence of a data protection law that curtails the fundamental right to remove useless and defamatory personal data from the internet space.

Aftermath Of Puttaswamy: Contours Of Privacy And Legitimate Interest

With the advent of Aadhar, the conceptual right to determine forms through which identity is expressed has put forth another diaspora of technological self-determination where the identifier's only identity is stored in the government database. Justice Kaul, in his concurring opinion, in K.S. Puttaswamy v. Union of India ("Puttaswamy") emphasized upon preservation as a norm in the digital world whereby forgetting the trial struggle. He further identified the right to be forgotten as an inherent aspect of privacy, stating removing unnecessary, irrelevant or incorrect information from the internet if there is 'no legitimate interest' in such data. Similarly, such an intervention with the right to be forgotten is permissible if the legitimate interests include exercising freedom of speech, information, and expression in the public interest, scientific or historical or statistical research purposes, or establishing legal claims. However, there must be a balance between the right to be forgotten and the legitimate interests.

The majority opinion authored by Justice DY Chandrachud in Puttaswamy lays down the legitimate interest test whereby to intervene with a person's privacy, the first prong of the test says there must be a law. The requirement of a 'law' is also an explicit condition of Article 21 (from which the right to be forgotten vis-à-vis privacy emerges) to restrict the right. Without any law in operation, constitutionally, there cannot be any intervention with the right. The second arm of the test states that there must be a legitimate aim or legitimate object if the state wants to enact a law. The state may have particular objectives to intervene with the said right, but such objectives must be legitimate, non-arbitrary, and reasonable. Lastly, the legitimate aim of the state and the means adopted to fulfil those objectives must be proportionate with the right to privacy. The extent of intervention with the right to privacy must not dilute the right from its existence. Unrestricted intervention violates a person's right to be forgotten and the right to be left alone.

If the unfettered intervention, without any law continues, it will cause irreparable prejudice to a person in her social life and career prospects, as recently stated by Justice Pratibha Singh in the case of Jorawer Singh Mundy v. Union of India and ors. Unless it is not defined by law, it will remain vague and inconsistency in judicial pronouncements will prevail. For instance, recently, the Karnataka High Court in Petitioner v. the Registrar General held that the petitioner's name may be redacted from the search engines like google.com or yahoo.com, but it cannot be removed from the certified copies of the judgment of the courts. Such an order defeats the philosophy behind the right to be forgotten as the petitioner in the case as mentioned above argued that if her name is visible on any search engine or in any court's order, then 'it would have repercussions even affecting the relationship with her husband and her reputation that she has in the society.' Therefore, it is a need of the hour to have legislation that will lay down the rules and procedures to protect citizens' rights to be forgotten and without which there will be a grave injustice.

Privacy Almighty: Right To Erasure And The Right To Be Forgotten In PDPB 2019

Slavery comes in all forms, and in recent times of technological advancement, data collection encompasses digital inequality and the illegality of a new era. The right encompasses certain rights of correction and erasure namely the right to (i) correct inaccurate or misleading personal data, (ii) to complete any incomplete personal data, (iii) update personal data that is out-of-date, and (iv) erase personal data which is no longer necessary for the purpose for which it was processed. Moreover, right to erasure did not circumferent the bill of 2018, but only emanated in the Personal Data Protection Bill of 2019 which talks about erasure of personal data belonging a data principal held any data fiduciary if the data doesn't serve any purpose

Furthermore, it is pertinent to compare Clause 18 and Clause 20 of the PDPB Bill, 2019. While as per the latter, every data principal has the right to restrict or prevent continuing disclosure of personal data by data fiduciary if such disclosure has served the purpose for which it was collected, the consent of such data has been withdrawn, or contrary to the provisions of the personal data protection law or any such law in force; the former surfaces a person's right to be forgotten enforceable only by order of the Adjudicating Authority. Prima facie Clause 20 does not grant the right to erasure, but a person via an application to the adjudicating authority can claim the erasure of such data. In doing so, the data fiduciary needs to determine whether such personal data is sensitive, the degree of restriction on such data, and the role of such data in a person's public life.

Trial, Torture, And Tenacious Clutch Of Data Control

Recently, the Madras High Court observed how a first impression depending upon the data provided on the internet make or mar the characteristics of a person in the eyes of Society and the untying clutches of social media in today's digitally advanced yet lawlessly paralyzed technological world. The court ultimately recognized the right to be Forgotten as a new right that should be included in the list of rights that are already available under Article 21 of the Constitution of India while deliberating upon the urgent need to pass the data protection bill in India. However, Justice N. Anand Venkatesh of Madras High Court held that the right to be forgotten cannot exist in administrative justice, particularly in the erasure of judgments. While reiterating upon the validity of interim orders passed in favour of petitioners in such cases, Justice Venkatesh has deliberated upon the position of constitutional courts as riding an unruly horse in the absence of statutory backing leading to counterproductive damage in the existing system.

In another case of X v. Yotube.com, Asha Menon J. of Delhi High Court while relying on the judgment of Zulfiqar Ahman Khan observed that "the right to privacy includes the right to be forgotten and the right to be left alone as inherent aspects" and it was noted by the court that in the case where the "person is being exhibited" against his/her will, the person will have protection of the Court (¶17).

'The citizen's rights have to be protected, the responsibilities of the states have to be defined, but the data protection cannot be done at the cost of trade and industry', stated Justice Srikrishna while urging the Government of India to adopt the PDPB, 2019 as expeditiously as possible. The integral part of Puttaswamy is the direct proportionality of dignity to an individual's privacy to determine how their personal data is to be collected, shared, or used with anyone, public or private. A democratic state's responsibility is to protect the individual interest and emerging need to safeguard personal data. The digitally emerged right to be forgotten is a soul's plea to untangle an individual from past mistakes, for; every saint has a past, and every sinner has a future.

Views are personal.