In India's Right to Privacy, a Glimpse of a Right to be Forgotten

While Justice Kaul's opinion identifies a 'right to be forgotten', India's upcoming data protection framework needs to resolve a number of hurdles before we carve out such a right.

The landmark right to privacy judgment delivered by the Supreme Court in Justice Puttaswamy v. Union of India is significant for a lesser known holding – the right to be forgotten.

The concurring opinion delivered by Justice Sanjay Kishan Kaul affirmed the ratio of the case, namely that right to privacy is a fundamental right and not merely a common law right. It went a step further and identified the right to be forgotten, in physical and virtual spaces such as the internet, under the umbrella of informational privacy. The right to be forgotten puts individuals in control of the information they put out, and to seek erasure of data concerning them. Kaul stated, “The right of an individual to exercise control over his personal data and to be able to control his/her own life would also encompass his right to control his existence on the Internet”. This ties into his reasoning that the public does not have a claim to access all truthful information.

The ambit of the envisaged right to be forgotten would not be absolute extending to an unqualified erasure of history. The opinion subjects it to restrictions on the basis of a) other fundamental rights (especially freedom of speech and expression) b) compliance with legal obligations (such as taxes) c) public interest d) public health e) archiving f) scientific, historical or statistical research and g) defence of legal claims. Individuals would be enabled to control dissemination of their information in physical and virtual spaces. Recognising that people may make mistakes in the past which should not be held against them through the digital footprint left behind, Justice Kaul seeks to bolster the ability of the right to privacy to nurture the ability to evolve.

The court places reliance on the 2016 European Union Regulation (Article 17) that created the right to erasure.

However, any attempt to carve out a right to be forgotten would need to be cognisant of several caveats. In the absence of a data protection law in India, many of these concerns would remain unresolved and dependent on ad-hoc judicial attention of the courts. First, even accounting for the restrictions outlined by Kaul, what would be the ambit of a proposed right to be forgotten? Would it only remove a search result from a search engine, or the very source itself? For instance, in a recent Karnataka high court judgment (Sri Vasunathan v. Registrar), the remedy was extended only to copies of the order yielded on an internet search. It did not erase certified copies of the order on the high court website. This is a limited right to erasure via delinking, and not a broader right to be forgotten. Kaul’s judgment does not appear to account for this distinction.

Second, the conceptual thicket is aggravated by the lack of dedicated statutory provisions in the IT Act, 2000 and the IT Rules, 2011. Rejecting a request for erasure, the Gujarat high court (Dharamraj Dave v. State of Gujarat) pointed out the petitioner’s inability to establish which provisions of law were attracted and how the uploading of the concerned judgment constituted a violation of Article 21. Even though section 69A of the IT Act and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 hold relevance, there is a dearth of clarity about the parameters of an individual’s right to be forgotten and what restrictions can be imposed on the same.

These statutes only relate to virtual information and do not extend to physical spaces as envisaged by Kaul. Furthermore, in what manner would the right to be forgotten apply to public figures such as politicians and actors?

The lack of a legal framework in the form of a data protection law addressing the issue has meant that the right to be forgotten, in the nascent form it exists at present, is primarily enforceable by approaching the court. Alternatively, an individual can resort to requesting the search engine to take down the contentious result. Google has a case to case mechanism for the same. In the former route, the courts are entrusted with ad-hoc resolution of a probable ‘right’ whose content is nebulous. In the latter, adjudication of fundamental rights, incursions on free speech and public access to information are left to the good sense of a private entity.

As India awaits a data protection law, calls for the right to be forgotten must acknowledge the hurdles in its path. The pronouncement of a fundamental right to privacy does not resolve them.

Sohini Chatterjee is Research Fellow, Vidhi Centre for Legal Policy.