Right to be Forgotten: A Tug of War between Right to Privacy and Freedom of Speech

I. Introduction

Cogitation of Right to be forgotten first emerged and gained traction in 2014 when the search engine giant Google was sued by a business in Spain to permanently erase any information and details anent to his precursory bankruptcy. After a four-year-long trial European Court of Justice, on May 13, 2014,² passed a landmark decision preserving an individual right to privacy and the protection of personal data. Although, by virtue of a subsequent judgement, it was established that the 2014 judgement only establishes a binding precedent within its geographical jurisdiction., the AEPD judgement³ has been cited in various national and international courts in several crucial litigations. The milestone judgement by European Union’s highest court has opened a juxtaposed dialogue about various national reverberations on the concept of the Right to be Forgotten.

But with the evolution of the Right to privacy in the wake of increasing online and internet delinquency into the Right to be forgotten, there come unhackneyed complexities. Evident friction between the Right to privacy and freedom of speech and expression and, to that extent, curbing of Right to access to information. Free speech is one of the major pillars of a free democracy and is unquestionable of paramount consideration. Freedom of speech and expression is the essence of a free country. It is the tool through which the citizens and residents of a state freely express their intrinsic views, social, political and otherwise. Free speech is the key to a positive and effective running democracy as it is the mechanism through which the government is held accountable for its actions. In such a way, protection of free speech with a parallel application of Right to be forgotten with an exclusive approach viz. application of one does not jeopardise the exercise of the other is important.

II. What is the Right to be forgotten?

Essentially, the Right to be forgotten empowers individuals, companies or substantially any entity being a social media user to demand organisations to permanently delete their personal data from all the databases accessible through the internet, also coined as Right to erasure. The rule as propounded by the European Court of Justice to a great extent regulates erasure obligations which means that the personal information must be removed or erased when it no longer serves the purpose it originally intended to, or the subject about whom the information persists has withdrawn his consent and there remains no legitimate reason for the processing of such data and no legal reasoning can obstruct the subject’s contention of removing such data or it becomes an obligation to remove the information under a statutory stipulation

The Right to be forgotten, according to the global dialogue surrounding it, is a natural right guaranteed and protected under the Right to Privacy.

Right to be forgotten: European union

As mentioned above, the concept of the Right to be forgotten was addressed by the European Court of Justice for the first time. In addition to the landmark judgement, the rule is also enshrined in the General Data Protection Regulation (GDPR)⁴ that governs the collection, processing and ensuing removal of information that is of personal nature.

The Right to be forgotten can be found in Recital 65⁵ and 66⁶ , which talk about ‘right to rectification and erasure’ and ‘right to be forgotten’, respectively. Additionally, Article 17⁷ of the GDPR also stated the Right to be forgotten.

While articles provide the procedural law that has to be followed and ensured while applying the Right to be forgotten, Recitals provide additional information and some context that is important for proper application of the Articles. It is of essence that we understand what the recitals provide for a comprehensive understanding of the European Union’s concept of the Right to be forgotten.

Recital 65

Recital 65⁸ of the GDPR is titled Right to Rectification and Erasure. This recital confers on a data subject the right to have any personal information or any crucial data that concerns the individual requesting for their exercise of Right to be forgotten. The data subject also has the Right to get his personal information rectified or corrected. In essence, according to recital 65, a data subject shall have the right to have its personal data erased and no longer processed. It is essential to note that to exercise the Right as given under recital 65, it is important to determine that the data in question is no longer necessary for the purpose it was originally collected and was otherwise being processed. In particular, the Right comes into play when the data subject has initially given his consent for such processing of the said information as a child at the time of giving consent; he or she was not fully aware of the risks that the processing of such data includes. The subject should be able to exercise his or her Right in spite of the fact that he or she is no longer a child. However, the Right provided under recital 65 is exhaustive in nature. It says that this Right shall not prevail if the processing of the information in question is essential for the operation of the Right to freedom of speech and expression or for complaisance with a legal obligation. Additionally, the GDPR enumerates various other circumstances where the Right is not operational, and the processing of the data is necessary.

1. When it is necessary for the performance of any task carried out in public welfare

2. Scientific and historical research purpose

3. Legal impetus

4. In exercise of official authority vested in the controller

5. Archiving purposes in the public interest⁹

Recital 66

GDPR coherently expands the application of the Right to Rectification and Erasure with the promulgation of the Right to be forgotten, which is provided in Recital 66¹⁰. According to which in an effective application of the Right to Right to Rectification and Error in the prevalent online environment, GDPR makes it necessary that the removal of information is done in such a way that the first controller who has primarily made the data public is obligated to direct the succeeding controllers which are personal data in question to remove and permanently as far as possible erase ant links, copies, replications developed of that personal data. Recital 66 additionally ensures that reasonable steps are taken in erasing the data, keeping in mind the availability and viability of the technology and other means.

Article 17

Under Article 17¹¹ of the GDPR, individuals have a right to have their personal data erased, which is termed the Right to be forgotten. The GDPR states that the Right guaranteed under Article 17 is not absolute and can only be exercised in certain circumstances. According to Article 17, a data subject has the right to have its data erased without any undue delay by the data controller if the underlisted grounds apply-

1. Where your personal data are no longer necessary in relation to the purpose for which it was collected or processed.

2. Where you withdraw your consent to the processing, and there is no other lawful basis for processing the data.

3. Where you object to the processing, and there are no overriding legitimate grounds for continuing the processing

4. Where you object to the processing and your personal data are being processed for direct marketing purposes.

5. Where your personal data have been unlawfully processed.

6. Where your personal data have to be erased in order to comply with a legal obligation.

7. Where your personal data have been collected in relation to the offer of information society services (e.g., social media) to a child.¹²

As specified by the GDPR, ‘Data controllers’ are defined as “people or bodies that collect and manage personal data.¹³ In substance, Article 17 contains the ground upon which the ‘right to be forgotten’ can be claimed.

Conclusively, the Right to be forgotten as promulgated and applied in the European Union is neither an absolute nor an unconditional right. Data controllers have certain rights while they are being obligated to remove personal data on request by the data subject. Enabling the right to be forgotten is multitudinous and has with its genesis a number of complexities, and it is crucial that this Right be executed and applied on a granular level and is dealt with by the courts subjectively keeping into account technology, purpose and overriding legal grounds involved.

Right to be forgotten: India

The 2018 legislature- The Personal Data Protection Bill¹⁴ had introduced the concept of the Right to be forgotten in the Indian law arena. This Right or concept was not a part of India’s prevailing data protection regime as provided under the Information Technology Act, 2000¹⁵ and its subsequent rules in 2011. The emergence of this Right is in India is a result of extensive debate and increasing judicial disparity. The bill is based on the report compiled by Justice B.N. Srikrishna committee.

III. Evolution through precede-nts

In India, there exists a grave inconsistency as to the interpretation and application of the Right to be forgotten. State High Courts steer in different directions when it comes to the execution of this Right. Gujrat High Court, in its dissenting judgement,¹⁶ insinuated at obscuring this Right. In the case dealt with by Gujrat high court, the petitioner had previously been held liable for certain criminal offences under the Indian Penal Code but, in due course, was acquitted of all charges. The petitioner then filed a petition to restrict the public exhibition of his name on criminal justice as it was violating his right under Article 21 of the Constitution.¹⁷

In a similar petition, Karnataka high court took a conflicting approach and delivered an opposing judgement. In Sri Vasunathan v. the Registrar General,¹⁸ the Hight court bench, in a judgement of its kind, acknowledged the ‘right to be forgotten’ as a right available to individuals when dealing with private data. In this particular case, the court allowed the petitioner to have his request of removal of his daughter’s name from digital records so that his daughter’s name would not appear in search engines and cause list maintained by the hight. The court, in this case, aligned its views to the view of the European Court of Justice in this matter and observed owing to the Right to Privacy as guaranteed by the constitution, it is imperative to provide Right to be forgotten in highly sensitive cases, especially those which involve protecting modesty and reputation of women.

The Delhi High Court, at par with the views of the Karnataka High Court, recognised the importance of the Right to be forgotten in Zulfiqar Ahman Khan v. Quintillion Business Media Pvt. Ltd.,¹⁹ where the court granted an interim injunction on publication of articles that contained the plaintiff’s name. The article affiliated the plaintiff’s name to a harassment complaint in the wake of the #metoo movement. The court endorsed the ‘right to be forgotten’ as an essential part of the Right to Privacy.

The notion of the Right to be forgotten was also carried forward by Justice S Kaul by his dissenting opinion in Justice KJ Puttaswamy v. Union of India and ors.²⁰ In which he stated that the “right of an individual to exercise control over his personal data and to be able to control his/her own life would also encompass his right to control his existence on the internet”. The Supreme Court, in this case, ruled that the Right to be forgotten was an intrinsic part of the Right provided under Part III.

The status of the Right to be forgotten was also analysed in Rout v State of Orissa.²¹ In this case, the victim had been raped, and a video of the incident was uploaded by the accused. Justice S.K. Panigrahi is relying on various landmark judgements, including Google Spain v. AEPD²², Google LLC v. CNIL²³ and Indian precedents like Vasunathan and Puttaswamy case, expressed that it is of pressing significance that the Indian Courts take a stand on the Right to be forgotten. The courts should realise that in this day and age right to be forgotten makes up for a very integral part of the Right to Privacy. For its protection, it is important that this Right is acknowledged by the Indian judiciary.

Legislation of Right to be forgotten

The new Data Protection Bill 2019²⁴ lays out the Right to be forgotten in written legislation for the first time. Section 20²⁵ of the bill is titled ‘right to be forgotten’. As per the provision under Section 20, a data principal (data subject) has the Right to restrict and prevent continuing disclosure of personal data which corresponds to the data principal claiming this Right by any data fiduciary (the data controller) if such request fulfils one of the three grounds prescribed

1. Disclosure of the personal data has served its purpose, or it is no longer necessary to process the data

2. The data principal no longer consents to such disclosure

3. The disclosure is contrary to the provisions provided in the new Data Protection Bill or any other in force at the time

The procedure for application for requesting the exercise of the Right to be forgotten is given under Section 62 ²⁶of the act.

The bill of 2019, unlike the draft Bill of 2018, further draws a line of segregation between the concepts of Right to be forgotten and Right to erasure and correction. The Right to erasure and correction is given under Section 18 of the 2019 Act.

As per Section 18²⁷ of the new Act, data principals have also been conferred upon the Right to erasure, completion, modification or correction of their personal data. The GDPR has comprehensively made the Right to erasure a part of the Right to be forgotten under Article 17²⁸. The new Data Protection Bill, however, has not only provided two separate provisions for the two allied rights, but the procedure for their execution is also different. For the purposes of Section 20, the data principal has to file an application to the adjudicating officer howbeit, for the enforcement of the Right under Section 18, the data principal can forthwith request the data fiduciary which controls or processes the information in question.

The new bill gives a much-needed statutory binding to the ‘Right to be Forgotten’; however, with the emergence of this Right, the judiciary and the legal industry prospects more complexities. The clash between the Right to be forgotten and the Right to access, furthermore the violation of freedom of speech and expression, will bring forth more complex dialogues and judicial debate for the Indian legal scheme to ascertain.

IV. Gdpr and the personal data protection bill: a comparison

The GDPR of the European Union and Indian Legislature’s Personal Data Protection Bill, 2019, both enactments have taken an exemplary step forward by providing statutory backing to the Right to be forgotten. But there is a magnitude of difference between the procedure and scope for the exercise of the Right. As per the provisions of GDPR under Article 17, the scope and extent of the Right are wider than that of the provision given in the PDP Bill.

Under the GDPR, the data controller, on request of the data subject to remove and erase the data until the information is no longer trackable to any database algorithm, which means that if a data controller which is processing the personal information deems that there is yet another fiduciary which controls the publication of the data, then that fiduciary will also be obligated to erase the data for which consent no longer persists. On the contrary, the Data Protection Bill 2018 only had the Right to be forgotten under Section 27²⁹ of the old act wherein the adjudicating officer had the power to decide such removal of the personal information mutadis mutandis the new ill of 2019 has duly included a provision conferring Right of erasure on individuals governed by the act. Although owing to sporadic interpretation of the rights guaranteed under the bill, determination of scope and extent of these rights is yet to be subjectively defined.

On the basis of current inclination and the thought process followed by Indian Courts, it can be inferred that a relatively wider scope will be given to the rights under this bill. The right to be forgotten is gradually but progressively being recognised as an integral part of the fundamental rights guaranteed by the Constitution of India. The GDPR is rightly regarded as one of the sternest data protection laws in the global legal scenario. The Right to be, although it has been deblocked but has influenced many nations in dealing with data privacy.

V. Right to be forgotten and freedom of speech: is mutual exclusivity possible

One of the leading objections against the Right to be forgotten is that some legal experts and jurists believe that recognition of this Right might severely hamper and complicate the praxis of ‘Freedom of Speech and Expression’, and correctly so. A very scrutinised study is needed for determining which data necessitates erasure and entails the right to be forgotten and where the Right to freedom of speech and expression shall be applied. Free speech is and has always been one of the most complex topics of deliberation within the legal realm. The advent of the Right to be forgotten and its increasing recognition only further perplexes the dialogue.

European Union has long held that data privacy and protection of the same are integral and indispensable rights guaranteed to them by the state. The European Court of Justice, in its unprecedented judgement in the case of Google v. AEPD,³⁰ gave a revolutionary and uncommon decision. Hence, the Right to be Forgotten was promulgated, but with this decision, European Union kept data privacy and, by extension, the Right to Privacy on a higher pedestal than Freedom of Speech and Expression. Furthermore, the CJEU did not provide any incontrovertible clarification as to when and to what extent the Right can be exercised. Legal exponents around the world, especially in the United States, where Freedom of Speech surpasses the Right to Privacy, have object European Court’s decision owing to the tension between the Right to be forgotten and free speech. The establishment of the Right to be forgotten is a danger to free speech online. It has the potentiality of being a tool of global censorship, social media and internet users have expressed. The 2014 judgement has seen a blatant attack on Freedom of Speech and Expression. Even the search engine giant Google refused to comply with the decision of CJEU on a global level contending that “no one country shall have the authority to control what content someone in a second country can access”. Other critics of the judgement stated that compliance to this decision by Google or setting it as a precedent would result in blatant censorship over the online content produced worldwide.

It is due to these objections and criticism it can be deduced that the decision fires up a conflict between two very important fundamental rights. This expression of the Right to be forgotten is defective and prone to criticism and objection by a legal virtuoso. Thus, objection led to the case of Google Spain v. CNIL³¹ in which the CJEU, after much-demanded consideration and scrutiny, held that Google does not have to comply with the 2014 judgement on a global level and the information that was requested to be erased shall only be erased within the online databases of European Union’s geographic jurisdiction. The 2019 decision was a victory for not only Google but also for freedom of speech and expression online. Now it is need of the hour that with these developments and an increasing number of conflicts, it is crucial to decide the extent of these rights so that freedom of speech is not on the verge of a dangerous cliff.

The tension between the two rights do not end up at unnecessary censorship; the fundamental issue is that there is an antipathy between an individual’s privacy rights and the problem of access to information by the public or for government research and storage purposes. Not only do people have a right to access information, which might become a subject of the Right to be forgotten request, it is also crucial for the government to be able to regulate and research for state welfare. Journalism is another branch of media that will take a hit, Right to be forgotten if not regulated will severely compromise the nature and thrust of journalism and mass media. Even though the 2019 bill provides for a right to have the information erased on request by the data principal by virtue of the Right to privacy. Thus law comes in direct conflict with the literature of Article 19 of the Indian Constitution.³²

Exclusivity of rights

Undeterred by the rigidity between the two rights, there is an enduring possibility that these rights can co-exist in a legal hemisphere, especially in India. Unlike the European Union’s GDPR, the Indian legislature’s literature on the Right to be forgotten provides for an adjudicating authority that will supervise and decide if the information being requested against is essential to process or not. That is why this decision and authority demands utmost scrutiny because the decision is not merely between what is Right or wrong; there is no black and white division, the choice is between application of two fundamental rights, both of which are ingrained in the essence of our constitution so the decision lies somewhere in the grey area, which means that each and every case shall be dealt with subjectively. Applicability, probity and consequentiality of both the rights shall be balanced, and whenever the scale weighs more, shall be opted for.

Moreover, the 2019 act righteously imposes exceptions for when the Right to be forgotten cannot be exercised and clause 2 of Section 20³³ provides that freedom of speech and expression shall be considered first and foremost by the adjudicating officer while dispensing a request under this Section. This clause is a crucial clause because the 2019 bill clearly provides that there shall be no transgression of freedom of speech and expression.

Determination of the scope and extent of the ‘Right to be Forgotten’ is the need of the hour; the Indian judiciary, by exercising its power of activism and through judicial legislation, shall mark clear boundaries for the reach of this Right so that there is no iniquity with the Right to information and freedom of speech and expression while a coinciding existence of the Right to be Forgotten.

*****

Footnotes

1. Author is a student at Manipal University Jaipur, India.

2. . Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González, ILEC 060 (CJEU 2014) ↩

3. Ibid.1 ↩

4. General Data Protection Regulation, COM/2012/010 final – 2012/0010 (COD) ↩

5. General Data Protection Regulation, supra-Recital 65-2012/0010 (COD) ↩

6. General Data Protection Regulation, supra-Recital 66-2012/0010 (COD) ↩

7. General Data Protection Regulation, supra-Article 17-2012/0010 (COD) ↩

8. General Data Protection Regulation, supra-Recital 65-2012/0010 (COD) ↩

9. General Data Protection Regulation, supra-Recital 65-2012/0010 (COD) ↩

10. General Data Protection Regulation, supra-Recital 66-2012/0010 (COD) ↩

11. General Data Protection Regulation, supra-Article 17-2012/0010 (COD) ↩

12. General Data Protection Regulation, supra-Article 17-2012/0010 (COD) ↩

13. "Who can collect and process personal data? - Justice". Ec.europa.eu. 2014-06-26. ↩

14. The Personal Data Protection Bill, 2018 ↩

15. The Information Technology Act, 2000 ↩

16. Judgment of Gujarat High Court dated January 19, 2017 in Special Civil Application 1854 of 2015. ↩

17. Central Government Act, Article 21 in The Constitution of India 1949 ↩

18. Judgment of Karnataka High Court dated January 23, 2017 in Writ Petition No. 62038 of 2016. ↩

19. Judgment of Karnataka High Court dated January 23, 2017 in Writ Petition No. 62038 of 2016. ↩

20. Judgment of Supreme Court dated September 26, 2018 in Writ Petition (Civil) 494 of 2012. ↩

21. Judgment of Supreme Court dated 1 July, 2014 in criminal appeal nos. 2277-2278 of 2009 ↩

22. Ibid. 1 ↩

23. Court of Justice, judgment of 24 September 2019, case C-507/17, Google Inc. v. Commission nationale de l’informatique et des libertés (CNIL). ↩

24. The Personal Data Protection Bill, 2019 ↩

25. See under Section 20of the PDP Bill, 2019 ↩

26. See under Section 20 of the PDP Bill, 2019 ↩

27. See under Section 18 of the PDP Bill, 2019 ↩

28. General Data Protection Regulation, supra-Article 17-2012/0010 (COD) ↩

29. See under Section 27 of the PDP Bill, 2018 ↩

30. Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González, ILEC 060 (CJEU 2014) ↩

31. Court of Justice, judgment of 24 September 2019, case C-507/17, Google Inc. v. Commission nationale de l’informatique et des libertés (CNIL). ↩

32. Central Government Act, Article 19 in The Constitution of India 1949 ↩

33. See under Section 20(2) of the PDP Bill, 2019 ↩