“RIGHT TO BE FORGOTTEN- WORLD WIDE OVERVIEW WITH SPECIAL EMPHASIS ON INDIAN CONTEXT” BY - AISHWARY THAPLIYAL
“RIGHT TO BE FORGOTTEN- WORLD
WIDE OVERVIEW WITH
SPECIAL EMPHASIS ON INDIAN CONTEXT”
AUTHORED BY - AISHWARY
THAPLIYAL
ABSTRACT
This paper deals with worldwide
overview of the right to be forgotten which is an evolving right. This paper deals with position of
this right in various countries. In this paper author has tried to make a special
emphasis of this evolving right
in respect to Indian laws. The author
has used various
case laws where judiciary has developed the Doctrine of Right to be forgotten
like Zulfiqar Ahman Khan v.
Quintillion Business Media (P) Ltd. (Delhi HC, 2019) 2019 SCC OnLine Del. 8494, Sri Vasunathan v. The Registrar
General (Karnataka HC) (2020), Subhranshu Rout Gugul v. State of Odisha, 2020 (Orissa HC), 2020 SCC OnLIne Ori. 878, X
v. YouTube (2021), Jorawer Singh
Mundy v. Union of India & Ors [Delhi HC, 2021), 2021 SCC OnLine De. 2306 and various legal provision of Indian laws
or legislative bills like Personal Data Protection
Bill, 2019 to explain the position of this right in
India.
Keywords - Right to be forgotten, Doctrine of Right to be
Forgotten, Personal Data Protection Bill 2019
INTRODUCTION
The Right to be forgotten
is evolving concept.
This right allows
people to request
that their data should be deleted that data which include any personal information from online platform.
As it is an evolving right, it is not recognized in many countries.
Media platforms like X formerly known
as twitter has seen a rising number of requests for the data to be removed. The
case in which Right to be forgotten
has been enforced are mainly related to defamatory social media posts, information related to legal
convictions, allegation from newspapers which were later termed as disproven, images of individuals used to attract
disparaging comments, images or videos
of the individuals used without there consent.
World Economic Forum’s Global Coalition
for Digital Safety has taken concern
of this matter and has developed Global Principles
on Digital Safety. They stated in their Translating International Human Rights
for the Digital Context report that “The principle encourages deeper collaboration and cooperation
recognizing that we all have a responsibility to help build a safe, rewarding
and innovative digital world.” The
organization like Google and X have established their own online request forums.[1]
In India, In July 2022 a plea
was moved before the bench of Justices Sanjay Kishan Kaul and MM Sundresh which was moved by the
estranged wife who stated that the availability of the names, addresses and her other personal information on the web violates her right to forgotten[2]. In
Europe regulators believe that there is difficulty which is faced by the all the
citizens i.e., escaping from their memories and because of Internet
everything is record and there is difficulty for them to forget these
memories. Especially the teenagers who due to their teen memory released their compromising information and they regret
it for later. Europe on January 22, 2012, released the EU Data
Protection Reform 2012 where the country stated about the “Right to be Forgotten” which stated that
“If an individual no longer want his personal to be processed or stored by a data controller, and if there is no
legitimate reason for keeping it, the data should be
removed from their system[3].”
“Position of Right to be forgotten
in Various World Countries”
1-
EUROPE
This right was first established in EU in a ruling
Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD)
And Mario Costeja González [4]in this case the key
points which were highlighted were-
1. “Article 2(b) of Directive
95/46 on the protection of individuals with regard to processing
of personal data and on the free movement of such data is to be interpreted as the meaning that the activity of
search engine consisting in finding information published or placed
on the internet by third parties, indexing
it automatically, storing
it temporarily and finally,
making it available to internet users according to a particular order of preference must be classified as processing of personal data when that information contains
personal data.”
“This interpretation is not affected by the fact that the data have already been published on the internet and are not altered by the search engine.
The operation referred
to in that provision must
also be classified as such processing where they exclusively concern material
that has been already
published in unaltered form the media.”
2. “Furthermore, the operator of a
search engine must be regarded as the controller in respect of that processing of personal data, within the meaning
of Article 2(d) of Directive 95/46. Inasmuch as the activity
of a search engine is liable to affect significantly, and additionally compared
with that of publishers of the website, the fundamental rights
to the privacy and to the protection of personal data,
the operator of the search
engine as the person determining the purpose and means of that activity
must ensure within the
framework of its responsibilities, power and capabilities that the activities meets the requirement of
Directive 95/46 in order that the guarantees laid down by Directive may have full effect and that effective and
complete protection of data subjects,
in particular of their right to privacy,
may actually be achieved.”
3. “Processing of personal data carried
out by the operator of a search engine is liable to affect significantly the fundamental rights to privacy and to
the protection of personal data when the search by means of that engine is
carried out on the basis of an individual’s name, since that processing enables
any internet user to obtain
through the lists of results a structured overview
of the information relating to that individual that can be found on the internet. Information which potentially
concerns vast number of aspects of
his private life and which without the search engine, could not have been interconnected or could have been only with
great difficulty and thereby to establish a
detailed profile about him. That is more the cases because the internet
and search engines render the
information contained in such a list of result ubiquitous. In the light of its potential
seriousness, that interference can’t be justified be merely the economic
interest which the operator of such an engine has in that processing. A fair balance
must be sought in particular
between the legitimate interest of internet users in access to information and the data subject’s
fundamental rights under Article 7 and Article 8 of the Charter of
Fundamental Rights of the
European Union.”
4. “Article 4(1)(a) of the Directive
95/46 on the protection of individuals with the regard to the processing of the personal data and on the free
movement of such data is to be interpreted
as meaning that processing of personal data is carried out in the context of the activities of an establishment of the
controller on the territory of the Member state within the meaning
of that provision when the operator of a search
engine set up in the Member
state a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which
orients its activity towards the inhabitants of that member states.”
“In such circumstances, the
activities of the operator of the search engine and those of its establishment situated
in the member state, although
separate are inextricably linked since the
activities relating to the advertising space constitutes the means of rendering the search engine at issue economically
profitable and that engine is at the same time
the means enabling those activities to be performed.”
5. “Article 12(b) and subparagraph (a)
of the first paragraph of Article 14 of Directive 95/46 on the protection of individuals with regard to the processing of the personal
data and on the free
movement of such data are to be interpreted as meaning that, in order to comply with the right laid down in
those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the
operator of a search engine is obliged to remove from the list of the results displayed
following a search
mode on the basis of a
person’s name links to web pages, published by the third parties and containing information related to that
person, also in the case where the name or information
is not erased beforehand or simultaneously from those web pages, and even, as
the case may be, when its publication in itself on those pages is lawful.”
“Since the inclusion in the list of results,
displayed following a search made on the basis of person’s name, of a web page and of
the information contained on it relating to that person makes access to that information appreciably easier for any internet user making a search in respect of the person
concerned and may play a decisive
role in the dissemination of that information, the data processing carried out by the operator of a search engine is liable to constitute a
more significant interference with the data subject’s fundamental right to privacy
than the publication on the web page.”
6. “It follows from the requirement laid
down in Article 6(1)(c) to (e) of Directive 95/46 on the protection of individuals with regard to the processing
of personal data and on the free movement
of such data that even initially lawful processing of accurate data may, in course
of time, become
incompatible with the directive where those data are no longer necessary in the light of the purposes for which they were collected or processed. Therefore, if it is found, following a request by the data subject pursuant
to Article 12(b)
of Directive 95/46, that the inclusion in the list of results displayed
following a search made on the basis
of his name of the links to the web pages published lawfully by the third parties and containing true
information relating to him personally is, at this point in time, incompatible with Article
6(1)(c) to (e) of the directive because
that information appears, having regard all circumstances of the case, to be inadequate, irrelevant, or no longer relevant, or excessive in relation to the purposes
of processing at the issue
carried out by the operator
of the search engine, the information and links concerned in the lists must be erased.”
“In this context, it is not
necessary, in order to find a right of the data subject that the information relating to him personally should no longer be linked by his name by a list of
results, that the inclusion of the information in question in the list causes
prejudice to him.”
“As the data subject may, in the light of his fundamental right under Article
7 and Article 8 of the
Charter of Fundamental Rights of the
European Union, request that the information
in question no longer be made available to the general public by its inclusion
in such a list of results, those rights override, as a rule, not only the economic
interest of the operator of the search
engine but also the interest
of the general public in finding
that operation upon a search relating to the data subject’s name. however, it would not be cease, if it appeared
for a specific reasons which is justified
by preponderant interest
of general public to have
that data.”
Article 17 of General Data
Protection Regulation which was adopted by European Union in the year of 2018 states about “right to
erasure” which is like right evolved by the European court of Justice in old law which has been replaced by this new GDPR law[5].
1.
“The data subject shall have right to obtain from the
controller the erasure of personal data
concerning him or her without undue delay and the controller shall have the obligation to erase personal data without
undue delay which one of the following grounds
applies:
a.
The personal data are no longer necessary in relation
to the purposes for which they were collected or otherwise processed;
b.
The data subject
withdraws consent on which the processing is based according to point of Article
6(1), or point (a) of
Article 9(2), and where there is no other legal ground of processing;
c.
The data objects to the processing pursuant to Article 21 (1) and there are no overriding legitimate grounds for the processing, or data subject
objects to the processing pursuant
to Article 21(2);
d.
The personal data have been unlawfully processed;
e.
The personal data have to be erased for compliance
with a legal obligation in Union or Member State law to which
the controller is subject;
f.
The personal data have been collected in relation to
the offer of information society services
referred to in Article 8(1)
2.
Where the controller has made the personal data public
and is obliged pursuant to paragraph 1 to erase the personal data, the
controller, taking account of available technology and the cost of the
implementation, shall take reasonable steps, including technical measures, to
inform controllers which are processing the personal data that the data subject
has requested to erasure by such controllers of any links to, or copy or
replication of, those personal data
3.
Paragraphs 1 and 2 shall not apply to the extent that
processing is necessary:
a.
for exercising the right of freedom of expression and
information;
b.
for compliance with the legal obligation which require
processing by Union or Member State law to which the controller is subject or
for the performance of a task carried out in the public interest or in the
exercise of official authority vested in the controller;
c.
for reasons of public interest in the area of public
health in accordance with point (h) and (i) of Article 9(2) as well as Article
9(3);
d.
for achieving the purpose in the public interest,
scientific or historical research purposes or statistical purposes in
accordance with Article 89(1) in so far as the right referred to in paragraph 1
is likely to render impossible or seriously impair the achievement of the
objectives of that processing ; or
e.
for the establishment, exercise, or defence of legal
claims.”
“In the case Google
LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)[7], commission nationale de
l’informatique et des libertés (CNIL) which French Data Protection
Authority imposed a penalty of 100000 euro on Google Inc. due to its denial granting a de-referencing request, to
apply it to all its search engine’s domain
name extensions. The company was given a formal notice by the CNIL on 21st
May 2015 to apply de-referencing to
all the extensions which the company had refused to do and confined
itself to the removing the links in questions
from only the results displayed following
searches conducted from the domain names corresponding to the versions
of its search engine in the Member states.
The company requested the Counsil d’Etat
(Council of States
France) to annul the adjudication of 10th
March 2016, it considers that the right of de-referencing doesn’t necessarily requires that the link at the issue
is to be removed, without
geographical limitations, from all its search engine’s domain
names. The conseil referred several issue to the Court of Justice
for seeking preliminary seeking to ascertain whether the rules of EU law relating
to the protection of personal data are to be interpreted as the
meaning that, where search engine operator
grants a request for de-referencing, that operator is required to carry out
that de- referencing on all the
versions of its search engine corresponding to all the Member state or only on the version corresponding to the
Member state of residence of the person benefitting from the de-referencing. The court emphasised that in the globalised world
internet users access
also include those who are outside the EU, making a reference to the
information regarding to the person
who has his interest situated in EU and is likely to affect his interest and
have immediate and substantial effect on him, then the global de-referencing would need to be meet the
objective of EU laws. The courts also stated that Right to the protection of personal data is not an absolute right, and the balance
should be made between right to privacy and the protection of personal
data on one platform and the freedom
of information of internet user on another
platform.”
2-
UNITED STATES
Right to be forgotten is not
recognized right in US but there are some judicial decisions from which we can analysis there some rights which are nearly in similar nature
to this right to some
extent. Like in the case of Gracia v. Google[8], “where Gracia in her cameo role for
upcoming movie spoke two sentences
for total airtime of five seconds. But unknowingly her lines were misused by the director in his different
movie named Innocence of Muslims. Film producers showed Gracia but dubbed her lines and due to this dubbing,
which was broadcasted over You Tube, Gracia started receiving death
threats. Gracia asked the Google to remove the film and later she sued the Google for the invasion of her privacy,
intentional infliction of emotional distress,
copyright infringement, and other causes of action. In result Nineth U.S. Court
of Appeals dismissed her lawsuit, and
court stated that Right to Forgotten is recognized by the Court of Justice
for the European
Union but not in United States”. Also, in the case of Martin
v.
Hearst Corporation [9]in this case “federal Court dismissed the Martin’s
case, when she appealed in the Second
Circuit provided the decision which was explained
by the legal scholar Eric Goldman who explained that the court’s
decision clearly showed that there is no recognized claim for
right to forgotten.”
“Position of Right to be Forgotten in India”
In India Right to be Forgotten
has been recognized either thorough judicial
decision pronounced by the
various Hon’ble Courts or
through legislations.
a.
Judicial
Decisions
In India court have played various
roles in emerging
or developing or recognizing various
rights which is beneficial for the individuals. Right to be forgotten lays its foundation or its emergence
from Article 21 of the Constitution of India which
states that “No person shall
be deprived from
his life or personal liberty except according to the procedure
established by law.” This right emerged
out from the judgement pronounced by Hon’ble Supreme Court of India in the case of Justice KS Puttaswamy v. Union of India[10] where
various postulates of Right to Privacy were
described and one of them was Right to be let alone, Supreme Court stated that
‘Privacy also includes
the reservation of private space for
the individual.”
In India, where the question of
the recognition of right to be forgotten was raised was in the case of Dharamraj Bhanushankar Dave v.
State of Gujrat[11], “in this case the petitioner was charged
for committing the offence related
to criminal conspiracy, murder, and kidnapping. He was acquitted
by Sessions Court
and his acquittal
decision was supported
by the Division bench of Gujrat High Court. The petitioner
therefore claimed that respondent should be banned from publishing it from internet as it will jeopardise the image of
the petitioners in his personal life as
well as in his professional life. Court in its decision didn’t acknowledge the
right to be forgotten”.
In case of V. v. High Court of Karnataka[12], “Right to be forgotten was recognized by
Kerala High Court, the case was
related to the removal of the name of the petitioner’s daughter from the title cause as it defamed her
reputation. The court decided in the favour of the petitioner and court stated that this would be a
consistent with the trend in western countries, where the right to be forgotten is applied in
sensitive cases concerning women in general as well as in sensitive
cases which involves rape or harming modesty and reputation of the individual”.
In X vs YouTube Delhi HC 2021[13], “in this case plaintiff was a well-known
actor in TV and film world of India.
She was asked for her participation in the creation of a suit video and the project
was drooped. But plaintiff found that producer
of the suit video has uploaded the video on YouTube and website. On the request
of plaintiff, producer
removed the video.
But without consent of plaintiff the defendants in
the suit uploaded the suit video on various websites. The suit related to anonymity and against
the publication, streaming, or other broadcasting, on the ground
that the suit video violated
her privacy, and it
negatively affected her reputation, and it harmed her career. The court held that the suit video
comes within the scope of Rule 3(2)(b)
of the I.T. Rules, 2021 and
Court highlighted that Right to be forgotten and the Right to be left Alone are inherent
aspects of the right to privacy.”
In Jorawer Singh Mundy v. Union of
India and Ors[14], “The
Delhi HC Justice Prathiba M. Singh
upheld the doctrine of right to be forgotten. The petitioner was the American
citizen of Indian origin who
travelled India during 2009. A criminal case under NDPS Act, 1985 was registered against him from which he was
acquitted from all the charges. Appeal which was filled by Customs was also dismissed by court. But the
petitioner has to face disadvantages as his
case was available on the Google search. Due
to this availability, he was denied of employment
under his expectations. The notice was issued to Google India Pvt. Ltd., Google LLC, Indian Canon etc by the petitioner
then also they didn’t remove the judgement. As a last option petitioner filed a petition to recognize his right to
privacy under Article 21 Indian Constitution. As a result,
High Court by issuing an interim order directed Google India Pvt. Ltd and Google LLC to remove the judgement
from search results and it also directed the Indian Cannon to block the said judgement from being accessed
by using search
engines like Google,
Yahoo etc.”
In case Subhranshu Rout Gugul v. State of Gujrat[15], “in this case petitioner was charged with various offence
which included rape of the classmate. When the court
was considering the bail
application, the question revolved around the recognition of the Right to be
forgotten in Indian law as the video
was used to threaten and blackmail the victim. The court has to take cognizance of the impact of the
publication of the videos in Facebook and while considering this situation the question of recognition
of right to be forgotten was put forward before the court. In this case, right to be forgotten was upheld.”
In case of Sri Vasunathan v. The Registrar General (Karnataka HC), court “in this case stated that right to be forgotten should keep
in line with the trend in western countries where it is recognized.”
In Zulfiqar Ahman Khan v. Quintillion Business
Media (P) Ltd[16], “in this case also it was held by the court that plaintiff’s Right to privacy has Right to
be left alone and Right to be forgotten as its inherent
aspects”.
b.
LEGISLATIONS
1.
Personal Data Protection Bill, 2019
It is based on the recommendations of V.N Sreekrishna Committee in 2019 and in this bill there is legal acceptance of the right
to be forgotten as a recognizable right but this bill is still pending
in the Indian parliament.
2.
Information Technology Rules, 2021
“Rule 3(2) of the Information Technology ( Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 states about Grievance
redressal mechanism of intermediary which states about that the intermediary shall prominently publish on its
website, mobile based application or
both, as the case may be, the name of the Grievance Officer and his contact
details as well as mechanisms by
which a user or a victim may make complaint against the violation of the provisions of this rule or any other matters
pertaining to the computer resources made available by it and the
Grievance Officer shall-
i.
Acknowledge the complaint within the twenty-four hours
and dispose off such complaint within
the period of fifteen days from the date of receipt;
ii.
Receive an acknowledge any order, notice or direction
issued by the Appropriate Government, any competent authority or a court of competent jurisdiction.
b- the
intermediary shall, within twenty-four hours from the receipt of a complaint
made by an individual or any person
on his behalf under this sub-rule, in relation to any content which is prima facie in the
nature of any material which.
·
Exposes the private
area of such individual,
·
Shows such individual in full or partial nudity
or
·
Shows or depicts such individual in any sexual
act or conduct or
·
is in nature of impersonation in an electric
form,
·
including artificially morphed images of such individual,
·
take all reasonable
and practicable measures to remove or disable access to such content
which is hosted, stored, published, or transmitted by it:
c- the
intermediary shall implement a mechanism for the receipt of complaints under clause(b)
of this sub-rule
which may enable
the individual or person to provide details,
as may be necessary, in relation to such content
or communication link.”
CONCLUSION
Right to be forgotten is
evolutionary right which is developing worldwide. This right is recognized in many countries like European Union, US whether through the method of Legislation or through the Judicial Decision or Judicial
Pronouncement. In India, right to be forgotten
is recognized through the Judicial decision, legislative has also done its
efforts to recognize this right by
introducing the Personal Data Protection Bill, 2019 but it is yet to be passed in parliament. Indian Judiciary is
making its whole effort to recognize this developing right in India.
[1] Shine, I. (2023)
The right to be forgotten allows people to ask for
data about them to be removed from the
internet. how does it work? World Economic Forum. Available at: https://www.weforum.org/agenda/2023/11/eu- right-to-be-forgotten-online-data/ (Accessed: 20 April 2024).
[2] Anand, U. (2022)
The right to be forgotten allows
people to ask for
data about them to be removed from the
internet. how does it work?, Hindustan Times. Available at: https://www.hindustantimes.com/india-news/more- power-to-the-right-to-be-forgotten-101658509282031.html (Accessed: 20 April 2024).
[3] Rosen, J. (2012) The right to be forgotten, Stanford Law Review. Available at: https://www.stanfordlawreview.org/online/privacy-paradox-the-right-to-be-forgotten/ (Accessed: 20 April 2024).
[4] Google Spain SL and Google Inc. v Agencia Española
de Protección de Datos
(AEPD) and Mario Costeja González (2014).
[5] Right to be forgotten overview -
legal help (no date) Google. Available at:
https://support.google.com/legal/answer/10769224?hl=en (Accessed: 20 April
2024).
[6] Art. 17 GDPR – right to erasure ('right to be
forgotten’) (2017) General Data Protection Regulation (GDPR). Available at:
https://gdpr-info.eu/art-17-gdpr/ (Accessed: 20 April 2024).
[7] Google LLC, successor in law to Google Inc. v
Commission nationale de l’informatique et des libertés (CNIL) (2019). Case No.
C-507/17
[8] Gracia v. Google, Inc, 786 F.3d
733 (9th Cir. 2015)
[9] Martin vs Hearst Corporation (2015) 777 F.3d 546
[10] (2017) 10 SCC 1
[11] 2017 SCC OnLine Guj 2493
[12] 2017 SCC OnLine Kar 424
[14] 2021 SCC OnLine De. 2306
[15] 2017 SCC OnLine Guj. 2493
[16] 2019 SCC OnLine Del 8494