Introduction

The present data protection regime in India, under the Information Technology Act, 2000 and the rules framed thereunder, does not recognise an individual’s “right to be forgotten”.  After an extensive debate and judicial inconsistency on the subject, the Personal Data Protection Bill, 2019 (“PDP Bill”), based on the Report of the Justice B.N. Srikrishna Committee, finally seeks to give statutory recognition to this right.

Judicial History of the Right to be Forgotten in India

Prior to the introduction of the PDP Bill, different High Courts were inconsistent in their interpretation of this right. The Gujarat High Court in the case of Dharamraj Bhanushankar Dave v/s State of Gujarat & Ors.[1], refused, albeit indirectly, to recognise this right.  In this case, the petitioner was held liable for various criminal offences and was eventually acquitted by the Sessions Court and the High Court. He therefore filed a petition asking the Court to restrain the public exhibition of a non-reportable judgment which was displayed on several websites. However, the Court observed that no case of a violation of Article 21 of the Constitution of India had been made out by way of such a publication.

Taking a contrary approach, in Sri Vasunathan v/s The Registrar General & Ors.[2], the Karnataka High Court granted the Petitioner’s prayer for removal of his daughter’s name from the cause title of cases based on searches for the case conducted on the internet. In doing so, the Court observed that it was acting “in line with the trend in the western countries where they follow this as a matter of rule in sensitive cases involving women in general and highly sensitive cases involving rape or affecting the modesty and reputation of the person concerned.”

The Delhi High Court has also recognised the said right in Zulfiqar Ahman Khan v/s Quintillion Business Media Pvt. Ltd. and Ors.[3] when granting an interim injunction on re-publication of articles written and published by the respondents against the plaintiff on the basis of harassment complaints received by the respondents (against the Plaintiff) as a part of the #MeToo movement.  In this instance, the Court recognised the “right to be forgotten” as an integral part of the right to privacy.

The concept was also acknowledged by Justice S. Kaul in his concurring opinion in Justice K.S. Puttaswamy (Retd.) & Anr. v/s Union of India & Ors.[4] wherein he observed that “right of an individual to exercise control over his personal data and to be able to control his/her own life would also encompass his right to control his existence on the Internet.” This would, however, be subject to exceptions in the interest of the freedom of expression and information, for compliance with legal obligations, on the grounds of public interest and the like.

Analysis of the Right to be Forgotten under the PDP Bill

The PDP Bill now seeks to give statutory recognition to this right. This is largely inspired by the ‘right to erasure’ under the General Data Protection Regulation, 2016 (“GDPR”). Section 20 of the PDP Bill, allows a data principal[5] to prevent or restrict the continuing disclosure of personal data, in three situations i.e. when (a) the data has served its purpose; or (b) the data principal withdraws his consent for collecting his personal data; or (c) when the disclosure of personal data is in violation of any existing legislation.

To exercise the above right, the data principal must make an application to the Adjudicating Officer to be appointed by the Central Government under Section 62 of the PDP Bill who shall allow/reject such application subject to the criteria laid down is Section 20 (3) of the PDP Bill. The criteria to be used by the Adjudicating Officers to determine whether or not such right should be exercised, include; the sensitivity of the personal data, the scale/degree of accessibility sought to be restricted, the role of the data principal in public life, the relevance of such data to the public and the nature of the disclosure and activities of the data fiduciary.

Application to Adjudicating Officer (PDP Bill)

The decision of whether an individual should be allowed to exercise his “right to be forgotten” vests with the Adjudicating Officer under the PDP Bill. Pertinently, this is the only right provided for in the PDP Bill which requires an application before the Adjudication Officer. This is also a departure from the approach taken by the GDPR wherein an application for the exercise of a ‘right to erasure’ has to be made with the controller of such data.

Segregation of the Right to be Forgotten and of Erasure

In addition to the “right to be forgotten”, the PDP Bill, under Section 18 also recognises the “right of erasure” which is available to data principals. This was not recognised under the Personal Data Protection Bill, 2018 (under which the right to correction of data did not include this right of erasure). Under this newly inserted provision, a data principal may request data fiduciaries to correct, complete, update or even erase personal data when such data is no longer necessary for the purpose of processing. If the data fiduciary refuses to do the same, the data principal may require that the data fiduciary take reasonable steps to indicate, alongside the relevant personal data, that the same is disputed by the data principal.

Under the GDPR, the ‘right to be forgotten’ forms a part of the ‘right of erasure; in fact Article 17 of the GDPR is titled ‘Right to Erasure (Right to be Forgotten)’. Under the PDP Bill, the two have been treated as separate and independent concepts. Not only are they recognised under two separate heads; the criteria and manner of their enforcement is also entirely different. While the former is implemented by applying to the Adjudicating Officer, the latter is enforced by making a request to the data fiduciary directly.

Since the two rights are intrinsically connected, there appears to be no reasonable justification for differential treatment of the same.

Conclusion

The PDP Bill does go a long way in giving statutory recognition to an individual’s ‘right to be forgotten’. The PDP Bill also lays down objective criteria to be employed by the Adjudicating Officer before making a determination on the exercise of such a right’ thereby preventing the potential abuse of discretion by such Adjudicating Offices. At the same time, this very requirement under the PDP Bill (i.e., for a data principal to file an application before the Adjudication Officer for exercise of such a right) may also have the potential of seriously impeding the exercise of the same. In view of the above it becomes all the more necessary to consolidate the right of erasure along with this right to be forgotten.

Authors:
Nandan Pendsey, Partner
Aashna Sheth, Associate

Footnotes:
[1]Judgment of Gujarat High Court dated January 19, 2017 in Special Civil Application 1854 of 2015.
[2] Judgment of Karnataka High Court dated January 23, 2017 in Writ Petition No. 62038 of 2016.
[3] Order of Delhi High Court dated May 9, 2019 in CS (OS) 642 of 2018.
[4] Judgment of Supreme Court dated September 26, 2018 in Writ Petition (Civil) 494 of 2012.
[5] Under Section 3(14) of the PDP Bill, a data principal means the natural person to whom the personal data relates.