December 02, 2020
High Court in India Reaffirms the Need for an Individual’s ‘Right to be Forgotten’
Last week, the Orissa High Court (“Court”) in the matter of Subhranshu Rout @ Gugul v. State of Odisha,1 emphasized the importance of ‘right to be forgotten’ (“RTBF”), a concept that has been upheld by courts abroad and recently encouraged by courts in India.
Generally speaking, RTBF is the right to have personal information removed from publicly available sources, including the internet and search engines, databases, websites etc. once the personal information in question is no longer necessary, or relevant. Interestingly, and to the best of our knowledge, this judgement is also the first time the provisions of the Personal Data Protection Bill, 2019 (“PDP Bill”) (the proposed privacy law in India currently under Government consideration), has been discussed by a Court.
Facts of the Case
The Petitioner is alleged to have raped a woman and uploaded photos and videos of this act on Facebook after blackmailing her. Upon police intervention the Petitioner deleted this content from Facebook. A bail application (order for release from arrest) was filed by the Petitioner. The Court dismissed the bail application, and made certain observations on the requirement for RTBF to be recognized in India. We have covered these observations below.
While hearing the bail application, the Court noted that while the Indian criminal justice system prescribes strong penal action against the heinous crime of rape, but that there is currently no mechanism whereby any individual may get the objectional material deleted from Facebook servers. The Court also recognized that the harassment, threats and assault that citizens receive with regard to their online presence pose serious concerns for citizens. The Court noted that in situations such as the present one, victims ought to be able to get their photos deleted permanently from the servers of social media platforms such as Facebook, and that there was no statute that provided for this right. The Court went on to note that instituting the RTBF in India would play a role in protecting women’s interests on the internet.
Recognition of RTBF in India
The Court noted that RTBF has been recognized as a statutory right in the European Union under the General Data Protection Regulation (GDPR), and has been upheld by a number of courts in the United Kingdom, and in Europe.
The Court noted that even though there is now a “widespread and seemingly consensual convergence towards an adoption and enshrinement of the right to get deleted or forgotten”, hardly any effort has been made in India until recently to recognize the concept of RTBF. Importantly, the Court also recognized that while there is a need to implement RTBF in India, it is a “thorny issue in terms of practicality and technological nuances”.
The Court noted that RTBF has been discussed in the following Indian cases:
Provision of RTBF in the PDP Bill
There is no statutory provision at present that provides for a RTBF. As noted by the Court, the current draft of the PDP Bill recognizes RTBF,6 and gives individuals the right to restrict or prevent the continuing disclosure of their personal data when it (1) has served the purpose for which It was collected, or is no longer necessary for said purpose; (2) was made with the consent of individual, which consent has since been withdrawn; or (3) was made contrary to the PDP Bill or any law in force. Importantly, the form of RTBF as recognized under the PDP Bill is not an unfettered right, and may be granted only once the ‘Adjudicating Officer’ appointed under the PDP Bill passes a favorable order on an application made by the individual. Hence, the RTBF under the PDP Bill is a limited right and is subject to approval by the Adjudicating Officer.
There were no orders passed on the removal of the photos and videos of the Informant from Facebook servers as the present case was a bail application, and the Informant had not raised the issue of her right to privacy and for the content to be deleted. Though, the Court was seemingly in favour of an individual’s RTBF in India.
The Court was also quite categorical in stating that due to the lack of appropriate legislation, the rights of the victim to have this content erased from Facebook servers remained unaddressed. The Court however held that in cases such as this, either the victim herself or the prosecution may, seek appropriate orders to protect the victim’s fundamental right to privacy, by seeking appropriate orders to have such offensive posts erased from the public platform, irrespective of the ongoing criminal process. For instance, even though an individual does not have an explicit RTBF under current law, they may seek recourse for removal of their data in public domain under other legal provisions such as defamation libel, indecency, intellectual property laws (if applicable), etc.
As highlighted above, there has been a recent trend of court decisions highlighting the importance of preventing the disclosure of personal information to prevent harm to the individual, and specifically recognizing the existence of RTBF. The Court observed that “information in the public domain is like toothpaste, once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away”.
It would be interesting to see the final scope of the RTBF right under the PDP Bill which provides for the right to restrict or prevent the continuing disclosure of personal data. While the PDP Bill was introduced in Parliament close to a year ago, in December 2019, there have been substantial delays in its movement towards enactment into law. In fact, recent news reports7 mention that the purpose and scope of the PDP Bill is set to be redefined and broadened, which may further delay its progress towards enactment.
– Inika Charles, Aaron Kamath & Gowree Gokhale
You can direct your queries or comments to the authors
1 BLAPL No. 4592 of 2020, High Court of Orissa.
2 (2017) 10 SCC 1.
3 Vasunathan v. The Registrar General, High Court of Karnataka (2017 SCC OnLine Kar 424); Zulfiqar Ahman Khan vs. Quintillion Business Media Pvt. Ltd. and Ors (2019 (175) DRJ 660).
4 Special Civil Application No. 1854 Of 2015.
5 [Name Redacted] v. The Registrar, Karnataka High Court, Writ Petition No.62038 Of 2016.
6 Section 20, PDP Bill.
7 https://www.livemint.com/news/india/nothing-personal-about-data-protection-bill-11 606194232029.html (last accessed December 2, 2020).