Personal Data Protection Bill: A ‘Right To Be Forgotten’ – Giving Government The Power To CensorBloombergQuintOpinion
One of the most contentious issues in the data protection debate is the ‘right to be forgotten’. The simple logic for the creation of this right is that a person must be able to control their data by seeking erasure of data being processed by a data fiduciary. One aspect of this right is the simple deletion of data that is held by a service provider. For example, requesting Google to delete all your email and associated data regarding location history, etc. While such deletions may pose a technological issue for some data companies, it is not a complex legal issue.
The second aspect of the ‘right to forget’, which is controversial, involves the deletion of information from the internet. The first case in Europe which gave birth to this right resulted in a European court forcing Google to not display search results pertaining to a man’s bankruptcy case published in a newspaper. While the story was accurate at the time it was published, it became a cause of concern for the plaintiff when it continued to show up in search results even after he cleared his debts. The rationale for such a right was that a person should be allowed to flourish without being held hostage to events that took place long ago but which continue to, unfairly, haunt their life because of the internet’s unperishable memory.
In the pre-internet era, such information would have been practically inaccessible after its initial publication unless somebody had the resources to pour over old newspapers in a library. In the digital world, however, with algorithms indexing all available information on the internet, searching for information is not a problem.
It is this ‘ease of searching information’ that necessitates the ‘right to be forgotten’.
The significant downside of this right is the danger of it being used as a tool of censorship by the powerful who will now have a legal tool to scrub the internet of information that has revealed their less than respectable past.
PDP’s Version Of The ‘Right To Be Forgotten’
The Personal Data Protection Bill 2019 contains a provision on the ‘right to be forgotten’. Clause 20 of the Bill allows for any person to “restrict or prevent the continuing disclosure of his personal data by a data fiduciary” if the disclosure of data no longer serves the purpose for which it was collected, or if the original consent provided by the data principal has been withdrawn, or if the disclosure has been made contrary to the provisions of the PDP Bill or any other law in force.
The scope of this right depends to a great extent on how the aforementioned phrases, especially the phrase “no longer serves the purpose”, are interpreted by the adjudicators who will decide the requests for deletion.
For example, how should an adjudicator decide whether information related to a person’s criminal past is relevant 10 years or 20 years after the information was first published on the internet and indexed by search engines?
The remedy – de-indexing or deletion?
The provision on the ‘right to be forgotten’ is silent on the scope of the right. Is it limited to simply de-indexing a link from a search engine or can it extend to deletion of the source information?
For example, in Europe, some of the courts only required search engines like Google to de-index the relevant links to ensure they were not displayed in response to search queries and it was required to do so only for European users. In simple English, ‘de-indexing’ meant deleting only the search result from the index created by Google thereby ensuring that the link was not displayed in response to search queries against the complainant’s name. The actual webpage of the newspaper featuring the story remained untouched. Thus, although it would be impossible to find a link to the story on a search engine like Google after it was de-indexed, a person who visited the webpage that was de-indexed by Google or any other search engine could still find the information.
Subsequent cases in Europe and around the world have vastly expanded the ‘right to be forgotten’ to include not mere de-indexing of search results but deletion of entire news stories from the source websites. In a separate context, de-indexing orders have extended to the entire world by national courts and have not been limited to their national jurisdictions. The PDP Bill should have taken a clear call on the scope of the available remedies in ‘right to be forgotten’ cases, preferably limiting it to de-indexing. By maintaining a silence on this aspect, the PDP Bill is leaving enormous discretion in the hands of the adjudicators who will be deciding these cases.
Bureaucrats with the power to censor?
The second problematic aspect with this provision is regarding the persons who will adjudicate these requests for the ‘right to be forgotten’. The PDP Bill has vested this power with ‘adjudicators’ who are appointed by the Data Protection Authority, whose top brass, in turn, is appointed by the government. In other words, the adjudicators are going to be government appointees and potentially under the control of the government for the duration of their tenure.
Do we, as a country, really want government bureaucrats with the power to order the deletion of information from the internet?
There are almost no precedents to this effect. The only other bureaucrats who wield ‘censorship’ powers are the ones sitting on the ‘Central Board of Film Certification’ although it should be mentioned that many argue that the CBFC should limit itself to certifying rather than censoring films.
It is potentially unconstitutional for a body controlled by the government to adjudicate disputes between private citizens since the separation of powers theory that has evolved in India requires an independent judiciary to adjudicate such disputes. In one of the landmark cases on judicial independence, the Supreme Court concluded the following:
“The fundamental right to equality before law and equal protection of laws guaranteed by Article 14 of the Constitution, clearly includes a right to have the person's rights, adjudicated by a forum which exercises judicial power in an impartial and independent manner, consistent with the recognized principles of adjudication.”
In simple English, the Supreme Court was of the opinion that the rule of law in India provides citizens with the right to have their rights adjudicated by a judicial body that is independent. Although the above dicta of the Supreme Court have not made deep inroads into the court’s own jurisprudence, it is likely that the courts will use either similar rationale, to limit the ability of government bureaucrats to censor the right to be forgotten requests.
T Prashant Reddy is a Bengaluru based advocate and co-author of ‘Create, Copy, Disrupt: India’s Intellectual Property Dilemmas’.
The views expressed here are those of the author and do not necessarily represent the views of BloombergQuint or its editorial team.