The Right to Be Forgotten: A New Frontier in India’s Data Privacy Laws

In the digital age, where personal data is constantly shared, stored, and processed across numerous online platforms, individuals face the challenge of protecting their privacy and managing the information available about them. One of the most important privacy rights that has emerged in recent years is the Right to Be Forgotten (RTBF), which allows individuals to request the removal of outdated, irrelevant, or potentially harmful personal information from digital platforms. While this right has gained legal recognition in Europe under the General Data Protection Regulation (GDPR), India is still in the process of defining its legal framework for RTBF. The recent decision by the Supreme Court of India to hear a case related to RTBF marks a pivotal moment in shaping India's approach to data privacy laws.

What is the Right to Be Forgotten?

• The Right to Be Forgotten refers to an individual's ability to request the deletion or de-indexing of personal data from search engines and digital platforms when that data is outdated, irrelevant, or infringing upon their privacy. This right allows individuals to regain control over their personal information online, ensuring that their past actions, events, or mistakes do not continue to negatively impact their current or future opportunities.
• For example, if an individual has committed a crime in the past, but has rehabilitated or served their sentence, they might wish to have that information removed from search results to protect their reputation and privacy. The RTBF empowers individuals to request the deletion of such outdated or irrelevant information.

International Perspectives on the Right to Be Forgotten

Globally, the RTBF has become an important aspect of data privacy, with several countries recognizing its significance:

1. The European Union and GDPR
The concept of the Right to Be Forgotten became a cornerstone of data protection in Europe with the Google Spain SL v. Agencia Española de Protección de Datos ruling by the Court of Justice of the European Union in 2014. The case set a precedent by ruling that individuals could request the removal of personal data from search engines if it was deemed "inadequate, irrelevant, or excessive." This ruling was incorporated into the General Data Protection Regulation (GDPR) in 2018, which grants individuals the right to erasure under Article 17. The GDPR provides a robust framework for erasure, allowing individuals to request the deletion of personal data when:

• The data is no longer necessary.
• The individual withdraws consent.
• The data processing is unlawful.

2. Other Jurisdictions
Several other regions and countries have recognized and applied versions of the RTBF:

• Canada: In 2023, Canadian courts upheld the right of individuals to request the removal of outdated personal data from search engines.
• United Kingdom: The UK Data Protection Act 2018 aligns with the GDPR and provides individuals the right to request erasure of personal data.
• California, USA: The California Consumer Privacy Act (CCPA) includes provisions for data deletion. The Online Eraser Law of 2015 allowed minors to remove content they posted online, and the DELETE Act (2023) extends the right to adults.

The Right to Be Forgotten in India: Current Status and Legal Context

India’s data privacy landscape has evolved with significant developments in recent years, although there is no comprehensive statute specifically addressing the RTBF yet.

1. Judicial Recognition to Right to Privacy: The Right to Privacy was formally recognized as a fundamental right under Article 21 of the Indian Constitution in the landmark case of Justice K.S. Puttaswamy v. Union of India (2017). While the Supreme Court did not directly address the RTBF in this case, the right to privacy was acknowledged as an integral part of the right to life and liberty. This ruling created the foundation for discussions around data protection, including RTBF.

2. Digital Personal Data Protection Act (DPDPA), 2023: In 2023, the Indian government passed the Digital Personal Data Protection Act (DPDPA), which provides a framework for protecting personal data. The law recognizes the right to erasure but lacks clarity regarding specific scenarios, such as the application of RTBF to court records, public records, or information that is in the public domain. These unresolved issues have led to uncertainty in the law’s application.

3. Information Technology Rules, 2021: The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules of 2021 require intermediaries like social media platforms and search engines to take down content that violates privacy within 24 hours. However, these rules focus more on removing unlawful content (such as defamatory material) and do not directly address the Right to Be Forgotten.

The Need for the Right to Be Forgotten in India

As India becomes more digitalized, personal data is increasingly exposed, leading to risks such as reputational damage, privacy violations, and data breaches. The RTBF addresses these concerns by empowering individuals to regain control over their digital footprints. Key reasons for recognizing the RTBF in India:

1. Control Over Online Presence: It allows individuals to manage their online identities and reputations, ensuring that outdated or irrelevant information does not impact their current life.
2. Mitigating Digital Damage: Outdated or incorrect information can have long-lasting negative effects, and the RTBF helps individuals mitigate these damages, especially those who have rehabilitated from past mistakes.
3. Reputational Protection: Protects individuals from carrying the stigma of past actions that no longer reflect their current circumstances.
4. Protecting Privacy: Prevents unlawful disclosure of personal information that may have been shared without consent or that is no longer relevant.

Challenges and Way Forward: Legislation and Policy Recommendations

India faces several challenges in implementing the Right to Be Forgotten, and there is a need for a comprehensive framework that addresses these issues while balancing privacy with public interest.

1. Enact a Comprehensive Data Protection Law: India should develop a robust and clear legal framework for data protection that specifically addresses the RTBF. This framework should:
   
   • Define clear criteria for data erasure.
   • Establish guidelines for dealing with public records and information in the public interest.
   • Create an independent data protection authority to oversee enforcement.
2. Balancing Privacy with Public Interest: Legislation should focus on balancing the right to privacy with the public interest, ensuring that the RTBF is not misused to suppress important or legitimate public information.
   
   
3. Industry Self-Regulation: Platforms, particularly social media companies, should implement robust internal data deletion processes to ensure the smooth and transparent removal of outdated personal data.
   
   
4. Public Awareness: Educating the public on their data privacy rights, including the RTBF, will foster a culture of responsible digital behavior and empower individuals to manage their personal information effectively.

Conclusion

The Right to Be Forgotten is an essential aspect of protecting personal privacy in the digital era. While India has yet to develop a comprehensive legal framework for RTBF, there are significant signs of progress through judicial recognition and evolving data protection laws. As India moves forward in developing these laws, it must carefully consider the balance between individual privacy, public interest, and freedom of expression. With the right legal and regulatory structures in place, India can ensure that its citizens are empowered to safeguard their personal data while contributing to a digital environment that respects privacy and transparency.