The sands of the internet do not forget the footprints that we leave. They remain hidden in the matrix of the internet. This information, if surfaced, can easily make a person infamous for something he did in the past.
This thought led to the revolutionary ‘Right to be Forgotten’ Movement.
Past of ‘Right to be Forgotten’
The thought of the ‘right to be forgotten’ had originated in the west. In 2014, the case of Google Spain SL, Google Inc v. Agencia Española de Protección de Datos, Mario Costeja González laid the foundation stones for the law. In this case, a Spanish Citizen, Mr Costeja Gonzalez, informed the Spanish National Data Protection Agency that when his name was entered into the Google database, some parts of the Barcelona paper, La Vanguardia, appeared, dated 9 March 1998. These articles contained a statement relating to a property of which he was a joint owner.
He contacted the newspaper and requested them to remove the article from the public domain. The newspaper refused to do it. Then Gonzalez approached Google not to bring up the article whenever his name is searched. He filed a complaint against the publisher of the newspaper and Google with the Spanish National Data Protection Agency.
In response, the company rejected the complaint regarding the newspaper as it was legally justified. On the other hand, it took up the case against Google. The European Court of Justice held that individuals have a right to be forgotten if the data is no longer needed for the purpose it was collected. However, the request will be rejected if it contradicts the right to freedom of expression and information or when it goes against the public interest in the area of public health, scientific or historical research, or statistical purposes.
The Personal Data Protection Bill, 2019
This new Data Protection Bill has introduced the concept of ‘Right to be Forgotten,’ which was a right not available to citizens of India under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
The Bill aims to:
“Provide for the protection of the privacy of individuals relating to their data
Specify the flow and usage of personal data
Create a relationship of trust between persons and entities processing personal data p
Protect the fundamental rights of individuals whose personal data are processed
Create a framework for organisational and technical measures in the processing of data
Lay down norms for social media intermediaries
Ensure accountability of entities processing personal data
Provide remedies for unauthorised and harmful processing, and
Establish a Data Protection Authority of India for the said purposes and matters connected therewith or incidental thereto.”
Section 27 of the PDP Bill deals with the right to be forgotten by which a ‘data fiduciary’ can be restricted from disclosing their data by the ‘data principal.’ There are conditions to restrict this usage too:
Their data has served the purpose for which it was collected
They withdraw their consent for the collection of their data
The disclosure of their data violates any existing legislation
However, to exercise this right, we would be required to submit an application form before the Adjudicating Officer. The adjudicating officer will ensure that this right does not override the Right to Freedom of Speech and Expression and the Right to Information. Plus, there are a few more things that the adjudicator has to keep in mind, such as the sensitivity of personal data, the data principal’s role in the public sphere, the relevance of the data in the public domain, etc.
Though this Bill has been accepted by many, our nation still lacks knowledge in data security. The Supreme Court had once said that the Right to be Forgotten could not be an absolute right. The Data Protection Committee Report has also pointed out that granting the Right to Erasure under ‘Right to be Forgotten’ can hamper other rights of the people of India, like the right to know, freedom of the press, etc. There are varied views on this Bill. Nevertheless, this Bill is crucial for a democracy like India to sustain itself in a world where data has become the new currency.