RIGHT TO BE FORGOTTEN

INTRODUCTION

The importance of data protection is gaining a lot of attention these

days both nationally and internationally. Much has been talked

about GDPR and Data Protection Act which covers everything, from

reporting data breaches to ensuring security online security. One

component that is gaining a lot of attention currently is the new data

subject right- ‘right to be forgotten’ also known as right to erasure.

This article shall cover the meaning of this right and its current status

and effects in India.

How it all began?

The right to be forgotten has its genesis in a decision handed out by

the European Court of Justice in the year 2014 in the case of Google

Spain SL, Google Inc v Agencia Espanola de Proteccion de Datos,

Mario Costeja Gonzalez. So, in this case a newspaper had put up an

article in 1998 regarding a forced property sale that was needed to

be done by Mr. Gonzalez in order to settle a social security debt. In

the year 2009 he contacted the newspaper company and asked them

to remove the details of the property sale because searching his

name brought up this old article. When the company denied to do

so, he requested Google Spain SL to take down the search result. The

European court judges ruled that under the present EU data

protection laws Google is bound to erase the link that led to the

search results of Mr. Gonzalez. The Judges further said that in their

opinion the inclusion of links in the Google results related to an

individual who wanted it removed “ on the grounds that he wishes

the information appearing on those pages relating to him personally

to be ‘forgotten’ after a certain time” was incompatible with the

existing data protection law. Hence, this ruling came to be known as

“right to be forgotten” and has been reinforced in data protection

laws and regulations in the EU, including EU’s General Data

Protection Regulation (GDPR).

GDPR’s APPROACH TOWARDS RIGHT TO BE FORGOTTEN

General Data Protection Regulation (GDPR) is the core of Europe’s

digital privacy legislation. GDPR’s article 17 outlines the

circumstances under which EU citizens can exercise their right to be

forgotten or right to erasure. The article also provides six conditions

for erasure, which include:

a) The personal data are no longer necessary in relation to the

purposes for which they were collected or otherwise

processed.

b) The data subject withdraws consent on which processing is

based according to point (a) of Article6 (1) and where there is

no other legal ground for processing.

c) The personal data have been unlawfully processed.

d) The personal data have been collected in relation to the offer

of information society services referred to in Article 8.

e) There are no overriding legitimate grounds for processing the

data.

However, the request may not be entertained in some situations

like if the request contradicts right of freedom of expression and

information, or in conditions where it goes against public interest

in the area of public health, scientific or historical research or

statistical purposes.

THE INDIAN LEGAL STATUS ON RIGHT TO BE FORGOTTEN

The B.N. Srikrishna Committee report has laid importance on

obtaining the approval of an individual to process and use

personal data. The Personal Data Protection Bill, 2018 has

introduced in India the EU’s concept of right to be forgotten but it

is currently not available under India’s data privacy regime.

Section 27 of the new DP Act, which comes under chapter IV of

the new DP Act, speaks about right to be forgotten. According to

this section, every data principle shall have the right to restrict or

prevent continuing disclosure of personal data or any data for that

matter, of such disclosure meets any of the following conditions:

1) Has served purpose for which it was made or no longer

necessary.

2) Was made on the consent of the principle and the principle has

now withdrawn the consent.

3) Was made contrary to the provision of New DP Act or any other

law in force.

If one wants to avail this right, an application should be made in the

prescribed format and submitted to the Adjudicating officer. Then

the officer should draw conclusion as to whether the demand meets

the above-mentioned conditions and also make sure that the request

of the principle does not override right to freedom of speech and

expression and right to information of any citizen. In order to make

sure that right to be forgotten does not conflict with right to

information and right to freedom of speech and expression the

adjudicating officer can consider reasons like:

1) The sensitivity of the personal data.

2) The scale of disclosure and degree of accessibility that is being

requested to be restricted or prevented.

3) The role of the principle in the public life.

4) The nature of disclosure and of activities of data fiduciary.

5) The relevance of personal data to the public.

However, section 27 of the new DP Act has a journalistic exemption.

That is the right to be forgotten will not be applicable if the personal

data is required for a journalistic purpose. The term ‘journalistic

purpose’ has also been defined under the section.

This is the entire process that one must undergo to avail the right of

right to be forgotten. The right is still in the form of a bill and is

waiting for approval.

EFFECTS OF RIGHT TO BE FORGOTTEN IF PASSED

The impact of right to be forgotten if passed is humongous, the

entire data privacy regime of India will undergo a huge makeover.

The individuals will have control over their personal information and

hence keeping their right to privacy intact. The procedure of availing

the right is also quite simple and people who feel that they are

entitled to this right based on the three conditions prescribed can go

ahead and do so. But further a balance should be stroked between

such removal and right to freedom of speech and expression and

right to information of any other citizen must be weighed in favour

of the individual requesting for the removal. The right to be

forgotten shall also be effective if the data fiduciary who processes

the data is a public figure. Hence, there will be a kind of equality that

is being maintained with regards to personal data online.

CONCLUSION

The main objective for now is to have a satisfactory balance between

individual’s privacy interests and public’s interest in free expression.

The passing of right to be forgotten can either be a blessing or a

curse. There is no such estimate as to how many might requests for

data erasure once the right is passed and hence it is too early to

judge the impact of this particular legislation. But if things go well

then, this right shall completely change the face of data protection

regime in India.

BIBLOGRAPHY

1) https://www.mondaq.com/india/privacy-protection/860598/the-right-to-be-forgotten--

under-the-personal-data-protection-bill-2018

2) https://www.livemint.com/Money/yO3nlG7Xj4vo2VJsmo8blL/What-is-the-right-to-beforgotten-in-India.html

3) https://www.theguardian.com/technology/2014/may/13/right-to-be-forgotten-eu-courtgoogle-search-results

4) https://gdpr-info.eu/art-17-gdpr/

5) https://economictimes.indiatimes.com/small-biz/startups/newsbuzz/gdpr-the-implicationsof-the-right-to-be-forgotten-aspect-of-the-data-protectionlegislation/articleshow/64329304.cms