INTRODUCTION
The Right to be Forgotten has evolved as a result of the rise of the internet in the recent past. This right gives individuals the power to have their personal information removed from the internet, websites under specific circumstances. This right was recognized by the European Union Court for the first time in the Costeja case in 2014. Since then, it has been recognized by certain other jurisdictions as well. In India, there was no law prior to the DPDP Act 2023,which referred to the right to be forgotten, though many of the courts took a liberal stance on this issue.
INTERNATIONAL CONTEXT
Prior to the coming up of the Right to be Forgotten, the French had recognized the Right to Oblivion. It allowed convicted criminals to remove particulars of their crimes and other aspects of their criminal life. This was available to the criminals only after they had completed their sentences. The Right to be Forgotten became solidified in the landmark case of Google Spain v. AEPD (2014). This is famously known as the Costeja case. In 1998, Mario Costeja faced financial difficulties and was in dire need of funds. As a result, a newspaper had advertised his property for auction under the orders of the Labour Ministry of Spain to attract bidders. Though his financial situation improved, the news of the sale of his property owing to his financial situation was still up on Google. This had the potential to harm his reputation as people might assume that he is still bankrupt. The matter was taken to court by Costeja who requested the data to be removed by the newspaper and the links to data should be removed by Google. The European Court of Justice held that search engines must consider requests from individuals to remove their names from webpages on the internet. However, the removal of data could only take place under certain conditions. These include when the search results appear to be irrelevant, inadequate or excessive due to the fact that considerable time has passed. In case, search engines deny the request to remove the data, the affected individuals can approach the authorities. They can direct the search engines to remove data under certain circumstances. In 2019, the European Court of Justice held that ruling in the Costeja case is limited only to the jurisdiction of European Union. Google does not have to comply with the Right to be Forgotten outside the territory of the European Union. The Right to Erasure (Right to be Forgotten) was incorporated under Article 17 of the General Data Protection Regulation (GDPR) of the European Union. Certain grounds are included under which erasure of data could be requested. There are also exceptions provided under which data erasure may not be granted. In 2024, Germany enacted a new law which strengthens the Right to be Forgotten. In the USA, there is no federal law which allows for the erasure of personal data of an individual. However, certain states have enacted legislations that allows individuals to have their personal data erased. For example, under California’s Erasure law, minors can request for the removal or obtain removal of information that they posted on the operator’s application, website or online service. The minor has to be a registered user of the website. This law provides enhanced privacy protection to the minors as they can erase the content posted by them on social media.
POSITION OF RIGHT TO BE FORGOTTEN IN INDIA
Prior to the Digital Personal Data Protection Act 2023, there was no law which expressly provided for the Right to be Forgotten in India. Section 43A of the Information Technology Act 2000 provided for damages to be paid to the affected persons if the organisations that process their personal data and fail to provide safeguards to such data, cause wrongful loss to them. While the IT Rules 2021 did not provide for the right to be forgotten , it provided the procedure for filing complaints with the grievance officer for the removal of personal information.
In 2021, the Delhi High Court had recognized the Right To be Forgotten as a part of the Right to Privacy in the case of Jorawer Singh Mundy v. Union of India (2021). A case under the NDPS Act 1985 was filed against the petitioner who was an American citizen of Indian Origin while he was in India in 2009. He was acquitted by the trial court in 2011. The Delhi High Court upheld the decision of the Trial Court in 2013. After returning to the USA, the petitioner claimed that he faced difficulties in securing job opportunities as when the potential employers conducted background checks, his name came up on platforms like Google, IndianKanoon etc. due to the case. Therefore, he filed a writ petition seeking the removal of his name from websites like Google in relation to the NDPS that was filed against him. The Delhi High Court recognized the Right to be Forgotten as an aspect of the Right to Privacy and directed Google and other websites to remove the name of the petitioner in relation to the case that was filed against him.
Section 12 of the Digital Personal Data Protection Act 2023 has recognized the Right to be Forgotten in India. It states that the Data Principal shall have the right to erasure of their personal data for processing for which he/she has already given consent. Other rights with the data principal include the right to correction, completion and updating of their data.
JUDICIAL PRECEDENTS
In the case of Subhranshu Rout v. State of Odisha(2020), the Orissa High Court held that the right to be forgotten would be available to the victims of sexually explicit video or photos posted on social media to harass the victim.
In the case of Zulfiqar Ahmed Khan v. Quintillion Businessman India Pvt Ltd(2019), the respondent had published two articles against the petitioner based on the harassment allegations they received. The Court held that Right to Privacy includes the Right to be Forgotten and Right to be Left Alone and ordered the respondent to remove certain posts against the petitioner.
In the case of Sri Vasunathan v. Registrar General(2016), the petitioner had filed a writ petition, seeking the removal of his daughter’s name from an order passed by the court as it has negative consequences on his daughter’s reputation. The Court ruled in favour of the petitioner and directed the registrar to ensure that the petitioner’s daughter’s name does not appear in the order anywhere.
CONCLUSION
The Right to be Forgotten is an important facet of the Right to Privacy and this has been recognized by the Indian courts in various judgments. This right was first recognized by the European Court of Justice but now has gradually gained acceptance in various other jurisdictions. The Right to be Forgotten was expressly recognized in a statute for the first time in the DPDP Act 2023.
Contributed By : Kritavirya Choudhary (Intern)