Right to be forgotten will be arduous as India frames data protection law

The Personal Data Protection (Draft) Bill, 2018, presented by the Justice B N Srikrishna panel, has a section on the right to be forgotten, even as it does not provide the right to erasure

Google recently emerged victorious when the Court of Justice of the European Union ruled that EU regulations on the right to be forgotten do not apply beyond its boundaries. But this could only be the start of a lengthy legal worldwide conflict. And India is not ready for it: The country still has no personal data protection law, let alone the right to be forgotten.

“In other nations, it usually emerges from their respective data protection law. So we need a data protection law first,” said Raman Jit Singh Chima, senior international counsel and Asia Pacific policy director at Access Now, a non-profit organisation working on digital rights.

The Personal Data Protection (Draft) Bill, 2018, presented to the IT ministry by the Justice B N Srikrishna panel, has a section on the right to be forgotten, even as it does not provide the right to erasure. Section 27 of the draft Bill talks about the right of the individual to restrict or prevent continuing disclosure of personal data. This Section presents three scenarios under which this right may be exercised: 1) If data disclosure is not necessary; 2) consent has been withdrawn; 3) data used contrary to provisions of law. 

Nevertheless, the draft Bill is hanging fire. Matters of individual data protection are currently seen through the lens of the right to privacy under Article 21 of the Constitution. 

There are two legal precedents on this issue: First, the Karnataka High Court ordered the removal of personal details from the judgment, while referring to the "right to be forgotten" in sensitive cases involving women in general. 

Second, the Gujarat High Court rejected the request for “permanent restraint (on) free public exhibition of the judgment and order”.  The main contention of the petitioner, earlier acquitted by both sessions court and high court, was although the decision was classified as “unreportable”, it was published by an online repository and indexed by Google Search. But the court rejected the plea after he failed to show it threatened his constitutional right to life and liberty. 

These two cases present a glimpse into the legal challenges the proposed law may face, in case it clears parliamentary procedure. Experts said the biggest challenge in implementing this right is the trade-off between defamation and freedom of expression. The right to be forgotten cannot be an absolute right and would be ubjected to reasonable restrictions, they noted.  “The right to be forgotten comes within the purview of the right to privacy, which would be at odds with Article 19(1)(a) — freedom of speech and expression,” said Kazim Rizvi, founder of policy think tank The Dialogue.

Besides, while dealing with issues of the right to be forgotten, a line may need to be drawn. “Information about known terrorists cannot be forgotten, but what about those who may have breached a simple traffic law? It’s also about interpretation,” said Rahul Matthan, partner, Trilegal, as he warned against giving businesses like Google the authority to decide on a request related to the right to be forgotten.

But for this, Section 27 of the draft Bill offers for an adjudicator to accept applications and make a decision, but experts said the process would be cumbersome and time-consuming. According to Matthan, the data protection authority would need a big workforce, and it must be ensured this agency receives sufficient resources. 

Also, specific data protection rights must be provided to people. “These must include the provision of know what data is stored about you, the right to update or delete out-of-date information, and the right to delete your private information,” said Chima.

The concept of the right to be forgotten is still evolving worldwide and mostly applies to data accessible on the internet. Rizvi said so far the right largely applies to information present online, which is “inadequate, imprudent, irrelevant, and inaccurate”, but judicial interpretation globally would slowly broaden the ambit.

Matthan’s opinion was that nowadays hardly anyone goes through newspaper archives to obtain data about an individual. “Your reputation is very much governed by online search results.” 

Despite these difficulties, experts think such a provision in India would make companies that use personal data accountable and they may need to review how they gather, use, and share such information.  “They will be accountable to people whose information they collect. It will be implemented by an independent regulator and the courts,” said Chima.

But any such measure would not be simple. Digital giants like Google and Facebook are already promoting the free flow of information in the context of the data localisation debate. 

The answers may lie in how governments and courts around the globe embrace and apply this European notion of the right to be forgotten.

Illustration by Binay Sinha