Individual privacy gets into AI tangle: Delhi HC ruling opens a debate

The Delhi High Court’s recent ruling that the “right to be forgotten” forms part of an individual’s fundamental right to privacy has opened a legal and regulatory dimension for artificial intelligence (AI), raising questions about whether AI systems can be forced to erase personal information embedded in their training data. 

The May 29 judgment, which came in the “Laksh Singh Yadav versus Union of India and others” case, allows individuals to seek removing or masking personal information from online judicial records where continued accessibility causes disproportionate harm to their privacy, dignity or reputation. 

While the ruling is fairly easy to implement for most traditional search engines, it has raised a pertinent question: Whether AI systems can be made to forget personal information once they have learned it. 

Most technical and legal experts say the involvement of AI models in the process poses challenges to the court verdict’s operation. In practice, while data may be erased from the system, it is often technically difficult and, in many cases, currently infeasible to require a model to “unlearn” the insights or parameters derived from that data. 

This creates an unresolved tension between data-erasure rights and the technical realities of AI development, the experts said.

“While personal data can be removed from databases and processing pipelines, there remains uncertainty regarding AI models that have been trained on such data. Once a model has learned patterns, relationships, or inferences from personal  information, deleting the underlying data does not automatically eliminate the knowledge embedded within the model,” said Kamesh Shekar, associate director at The Dialogue, a technology-policy advocacy body. 

The ruling could have implications for AI companies beca­use information used to train large-language models (LLMs) is not simply stored in databases but absorbed into complex systems that can continue to generate or infer it long after the original source is removed, according to legal experts. 

“The future of the right to be forgotten in the AI era will depend less on deleting data at the source and more on ensuring that AI systems do not continue to reproduce, infer or amplify personal information after a valid erasure request,” said Nikhil Narendran, partner, Trilegal. 

Unlike traditional databases, AI models distribute information across billions of parameters, making targeted deletion difficult.

As a result, experts say that the focus should shift from achieving perfect erasure to preventing the continued disclosure of information. 

“Currently it is not possible for AI models to completely forget specific data once they have been trained on it,” Narendran said, adding that safeguards should instead ensure that such information was not publicly surfaced or generated. 

According to Anshul Verma, a partner at SKV Law Offices, the conversation must move beyond deleting records, and address the question whether AI systems can be prevented from recreating information about individuals. 

“The legal obligation for AI companies cannot stop at removing data from future training sets. They must go further by implementing output-level filters, maintaining auditable compliance records and, where feasible, evaluating machine-unlearning measures,” Verma said. 

Machine unlearning — techniques aimed at reducing a model’s reliance on specific data — has emerged as a possible solution. However, experts say that the technology remains under development and cannot yet guarantee the complete removal of information from trained models. 

In several cases, compliance may require a combination of measures, including the deletion of source datasets, output filters, model updates, and audit trails, said Shiv Sapra, a partner at law firm Kochhar & Co. 

“The court’s ruling marks a shift from mere deletion to controlled discoverability. The real issue is whether personal data has been absorbed into training weights,” Sapra said. 

The ruling also raises questions about the adequacy of existing data-protection laws. The Digital Personal Data Protection (DPDP) Act, which is the country’s most comprehensive and exhaustive digital privacy law to date, excludes certain categories of publicly available information, including information disclosed through judicial proceedings. 

“The court’s recognition of the right to be forgotten highlights a potential gap between the DPDP Act framework and the broader constitutional protection of informational privacy,” Narendran said. 

While experts agree that stronger safeguards may be required, they say privacy rights must be balanced against freedom of expression, public accountability, research and innovation. 

“The objective should not be to erase history or impede innovation. Rather, it should be to prevent technology from imposing an indefinite digital penalty on individuals long after the original purpose of the information has disappeared,” Narendran said. 

Enforcement is expected to be the biggest challenge because regulators may struggle to determine whether a model was trained on a person’s data or whether an erasure request has been effectively implemented, experts said. As AI systems become increasingly embedded in everyday life, the court’s ruling signals that the next phase of privacy law may focus less on deleting information and more on defining the limits of digital memory. 

Raheel Patel, partner, Gandhi Law Associates, said the future debate was likely to centre on accountability rather than perfect deletion. “The true test of the right to be forgotten will come when courts are asked not to delete information from the internet but to make AI forget what it has already learned,” Patel said.