New Delhi: The Gujarat High Court observed last week that once a court quashes a First Information Report (FIR) against an individual, the press should delete all news items connected to it.
The division bench of Chief Justice Sunita Agrawal and Justice N.V. Anjaria made these observations while hearing an appeal filed by an NRI businessman, who wanted tech giant Google and news publications to remove news items related to a 2020 FIR that was eventually quashed.
“If the person is acquitted in the criminal case, you should delete those articles. That ends the matter,” Agarwal had said then, shedding light on a significant aspect of the right to privacy — the right to be forgotten.
On Thursday, the central government tabled the much-publicised Digital Personal Data Protection Bill, 2023, in Parliament. Among its other features, the bill codifies the right to be forgotten.
The proposed law comes six years after a landmark Supreme Court case, K.S.Puttaswamy vs Union of India, recognised the right to to be forgotten as an aspect of the right to privacy that emanates from Article 21.
Chief Justice of India D.Y. Chandrachud — who was part of the 9-judge bench — had said that informational privacy is a facet of the right to privacy and called for a law on data protection.
“The dangers to privacy in an age of information can originate not only from the State but from non-State actors as well. We commend to the Union government the need to examine and put into place a robust regime for data protection. The creation of such a regime requires a careful and sensitive balance between individual interests and legitimate concerns of the State,” he had said.
Here’s what you need to know about the right to be forgotten, the judiciary’s stand on it, and what the Digital Personal Data Protection Bill 2023, says.
Also Read: India is the sixth most data-breached country in world, says study by cybersecurity firm
What 2023 Bill says about right to be forgotten
India’s first attempt at codifying the right to be forgotten was in 2019, with the now-shelved Personal Data Protection Bill. That bill was eventually withdrawn to bring a more comprehensive framework to regulate personal data online.
The Digital Personal Data Protection Bill 2023 provides for the right to be forgotten under the heading ‘right to correction and erasure of personal data’. According to Section 12 of the proposed law, a data principal — an individual to whom the personal data relates — will have the right to correction, completion, updating, and erasure of their personal data for the processing of which they have previously given consent.
This includes consent given for the specified purpose for which the data principal has voluntarily provided their personal data to the data fiduciary — the entity that collects and stores the data.
According to the provision, a data fiduciary is required to correct the inaccurate or misleading personal data, complete as well as update the personal data upon receiving a request.
However, the proposed provision is subject to the condition that retaining the data is necessary for the specified purpose or for compliance with any existing law.
What Gujarat HC said in businessman’s case
The case in the Gujarat HC pertains to a 2020 FIR in which a 30-year-old businessman had accused the petitioner of cheating him of Rs 3.55 crore. Among other things, the petitioner had been accused of taking away the businessman’s luxury Porsche Cayenne SUV worth Rs 1.5 crore.
According to LiveLaw, one news organisation also claimed that the petitioner had been involved in hawala and cricket betting.
The FIR was eventually quashed but news articles remained on the internet, prompting the petitioner to approach the high court for its removal.
In February 2022, a single-judge HC bench dismissed the petition saying no writ can be issued against private respondents. The petitioner then approached a division bench against the ruling.
In its observations last week, the division bench said that once an FIR is quashed, all news articles on it should be deleted. “If there’s press freedom then there needs to be transparency too,” Chief Justice Sunita Agrawal said, listing the case for 7 August.
What court rulings say
Successive judicial rulings have recognised the right to be forgotten. In 2017, the Supreme Court held in the Puttaswamy case that the right to be forgotten was inherent to the right to privacy under Article 21 of the Constitution.
“The right of an individual to exercise control over his personal data and to be able to control his/her own life would also encompass his right to control his existence on the internet,” the court’s nine-judge bench headed by then Chief Justice of India J.S. Khehar had said.
The bench referred to the European Union’s General Data Protection Regulation (GDPR) — considered one of the toughest data protection laws in the world — in its ruling. It said that an individual who no longer wants their personal data to be processed or stored should be able to remove it from the system when it’s “no longer necessary, relevant, or is incorrect and serves no legitimate interest”.
The court, however, qualified this by saying that the right cannot be exercised where the information or data is necessary for exercising the right of freedom of expression and information, for compliance with legal obligations, or for the performance of a task carried out in public interest.
Such grounds, according to that ruling, includes public health, for archiving purposes in public interest, scientific or historical research purposes, statistical purposes, or for the establishment, exercise, or defence of legal claims.
In the 2019 Zulfiqar Ahman Khan vs M/S Quintillion Business Media, the petitioner wanted two articles written about him on a news website removed. The articles were part of reportage on the #MeToo campaign. The Delhi High Court recognised “right to be forgotten” and the “right to be left alone” as being inherent aspects of the right to privacy and the articles were eventually pulled down.
The right to be forgotten once again came up in the 2021 Jorawer Singh Mundy vs Union of India. In that case, Jorawer Singh, an American citizen, approached the Delhi High Court seeking removal of all public records of a case registered against him under the Narcotics Drugs and Psychotropic Substances Act, 1985. In his petition, Singh said that even though he was acquitted by the trial court in 2011, he was unable to find employment in the US because records of the ruling were available on Google, which put off employers who ran background checks on him.
The high court then directed respondents, which included law search engine Indian Kanoon, to block the judgment from being accessed.
What Indian laws say
While the ‘right to be forgotten’ isn’t a law yet, there are existing provisions in Indian laws that seek to prevent private data from being compromised.
For instance, the Information Technology Act 2000 has a provision for compensation for failure to protect data. Under Section 43A of the law, an organisation is liable to pay damages to a person whose sensitive personal data has been compromised.
Meanwhile, the 2022 amendment to Information Technology Rules, 2021, provides for the establishment of Grievance Appellate Committee(s) to allow individuals to appeal against the inaction of, or decisions taken by intermediaries on user complaints. The amendment also gives users the right to approach courts for remedy.
Where other countries stand
Some countries have already put the concept of ‘right to be forgotten’ into practice. It was the Court of Justice of the European Union that first raised the subject in its 2014 ruling in Google Spain SL, Google Inc v Agencia Española de Protección de Datos, Mario Costeja González. The case pertains to a Spanish man’s request that a 1998 advertisement on the forced sale of his house be taken down.
In its ruling, the Court of Justice of the European Union ruled that it was incumbent upon an internet search engine operator “for the processing that it carries out of personal data which appear on web pages published by third parties”, thus upholding the right of erasure.
The 2014 judgment set the precedent for the right of erasure under the European Union’s GDPR, which, under Article 17, provides the specific circumstances under which it can be applied. This includes situations such as when the data is no longer necessary for the purpose that it was collected, consent is withdrawn, when the individual objects to their data processing by an organisation and when there is no overriding legitimate interest to continue with it.
The Philippines also recognised the right under its Data Privacy Act, 2012. Under the law, data subjects — that is, the people to whom the data pertains — had the right to suspend, withdraw, or order the blocking, removal, or destruction of their personal information from the personal information controller’s filing system.
The right, according to the law, can be exercised upon discovery and substantial proof that the personal information is incomplete, outdated, false, unlawfully obtained, used for unauthorised purposes, or is no longer necessary for the purposes for which it was collected.
An Argentinian trial court judge had fined search engines Google and Yahoo in 2009 and ordered them to delink the sites having racy photos of pop star Virginia Da Cunha. But in 2010, an appeals court reversed the decision, and in 2014, the country’s Supreme Court of Justice ruled in favour of the search engines.
This is an updated version of this report
(Edited by Uttara Ramaswamy)