Data Privacy: Right to be Forgotten(RTBF)

There has been a recent trend of court decisions highlighting the importance of preventing the disclosure of personal information to prevent harm to the individual, However there is no absolute right to be forgotten (right erasure of data) in India. They may seek recourse for removal of their data in the public domain under other legal provisions such as defamation libel, indecency, intellectual property laws etc…

Content:

In news:

• Justice S.K.Panigrahi of Orissa high court recently underscored the need for a legal bulwark against the growing menace of ‘revenge porn’.
• The court said that no person would want to create and display grey shades of his/her character in social media.
• It is therefore their right to enforce the right to be forgotten as a right ‘in rem’.
• The court was hearing a case in which a woman’s images and videos taken with her consent before was misused by a person once their relation got strained.

Law in EU:

• In 2014, the European Court of Justice (ECJ) ruled in favour of Mario Costeja González, a Spanish man who was unhappy that searching his name on Google threw up a newspaper article from 1998.
• He approached the newspaper in 2009 to get the article removed as he felt it was no longer relevant.
• The newspaper felt it was inappropriate to erase the article, and Gonzalez then approached Google to not throw up the article when his name was searched.
• ECJ asked Google to delete “inadequate, irrelevant or no longer relevant” data from its search results, when a member of the public requests so.
• The ruling came to be known as the “right to be forgotten” and has been hence reinforced in data protection laws and regulations in the EU, including the EU’s General Data Protection Regulation (GDPR).
• The Article gives individuals the right to get personal data erased under six conditions.
• The request may not be entertained in some situations such as if the request contradicts the right of freedom of expression and information, or when it goes against  public interest in the area of public health, scientific or historical research or statistical purposes.

What is Right to be Forgotten?

• Also known as the “right to erasure“, the rule gives EU citizens the power to demand data about them be deleted.
• The right to be forgotten appears in Recitals 65 and 66 and in Article 17 of the GDPR.
• It states, “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay” if one of a number of conditions applies.
• “Undue delay” is considered to be about a month.
• The right to be forgotten dovetails with people’s right to access their personal information in Article 15.
• This is not an absolute right. 
• An individual has the right to have their personal data erased if:

The personal data is no longer necessary for the purpose an organization originally collected or processed it.

An organization is relying on an individual’s consent as the lawful basis for processing the data and that individual withdraws their consent.

An organization is processing personal data for direct marketing purposes and the individual objects to this processing.

An organization processed an individual’s personal data unlawfully.

An organization must erase personal data in order to comply with a legal ruling or obligation.

An organization has processed a child’s personal data to offer their information society services.

Status in Indian Law:

RTBF has been discussed in the following Indian cases:

• The Supreme Court in the case of K.S. Puttaswamy v. Union of India, had held that the right to be let alone is an essential part of the autonomy and the privacy of an individual. The Supreme Court had also observed that RTBF could not be exercised where the information in question was necessary for (1) exercising the right of freedom of expression and information; (2) compliance with legal obligations; (3) the performance of a task carried out in public interest, or public health; (4) archiving purposes in the public interest; (5) scientific or historical research purposes or statistical purposes; or (6) the establishment, exercise or defence of legal claims.
• The first case in India to deal with the concept of the right to be forgotten was the case of Dharmaraj Bhanushankar Dave v. State of Gujarat in the Gujarat High Court. The case arose as the petitioner had filed a case for the removal of a published judgment in which he had been acquitted. The Court did not grant an order for the removal of the judgement, as the petitioner had not been able to point out specific provisions of law that had been violated.
• In Karnataka High Court a case was filed to remove only the name of the Petitioners daughter from the cause title as it was easily searchable and would cause harm to her reputation. The Court held in the Petitioner’s favour, and ordered that the name be redacted from the cause title and the body of the order.

The B.N. Srikrishna Committee report laid significant emphasis on obtaining the consent of an individual to process and use personal data. The committee said consent must be “informed”, “specific” and “clear”, and needs to be capable of being withdrawn as easily as it was given.

The draft Personal Data Protection Bill, 2018, had a section on the Right to be Forgotten but does not provide a right to erasure. Section 27 of the bill has listed out three scenarios in which an individual will have the “right to restrict or prevent continuing disclosure of personal data”. This will be applicable if data disclosure is no longer necessary, the consent to use data has been withdrawn or if data is being used contrary to the provisions of the law.