What is the right to be forgotten in India

In 2014, the European Court of Justice (ECJ) ruled in favour of Mario Costeja González, a Spanish man who was unhappy that searching his name on Google threw up a newspaper article from 1998. He approached the newspaper in 2009 to get the article removed as he felt it was no longer relevant. The newspaper felt it was inappropriate to erase the article, and Gonzalez then approached Google to not throw up the article when his name is searched. 

ECJ asked Google to delete “inadequate, irrelevant or no longer relevant” data from its search results, when a member of the public requests so. The ruling came to be known as the “right to be forgotten” and has been hence reinforced in data protection laws and regulations in the EU, including EU’s General Data Protection Regulation (GDPR). 

EU GDPR

GDPR’s Article 17 has outlined the circumstances under which EU citizens can exercise their right to be forgotten or right to erasure. The Article gives individuals the right to get personal data erased under six conditions, including withdrawal of consent to use data, or if data is no longer relevant for the purpose it was collected. However, the request may not be entertained in some situations such as if the request contradicts the right of freedom of expression and information, or when it goes against  public interest in the area of public health, scientific or historical research or statistical purposes.

Indian draft bill

The B.N. Srikrishna Committee report has laid significant emphasis on obtaining the consent of an individual to process and use personal data. The committee said consent must be “informed”, “specific” and “clear”, and needs to be capable of being withdrawn as easily as it was given. 

The draft Personal Data Protection Bill, 2018, has a section on the Right to be Forgotten. But the proposed bill does not provide right to erasure. 

Section 27 of the bill has listed out three scenarios in which an individual will have the “right to restrict or prevent continuing disclosure of personal data” or the right to be forgotten, in a sense. This will be applicable if data disclosure is no longer necessary, the consent to use data has been withdrawn or if data is being used contrary to the provisions of the law. An adjudicating officer will have to determine the applicability of one of the three scenarios. The officer will also have to determine that the right of the individual to restrict use of her data over-rides the right to freedom of speech or right to information of any other citizen. 

While there is no absolute right to erasure of data in the proposed law, remember that the bill will be going through a parliamentary process of discussion and approval before it becomes law, and changes might be brought in.