Last week, the Orissa High Court (“Court”) in the matter of Subhranshu Rout @ Gugul v. State of Odisha,¹ emphasized the importance of ‘right to be forgotten’ (“RTBF”), a concept that has been upheld by courts abroad and recently encouraged by courts in India.

Generally speaking, RTBF is the right to have personal information removed from publicly available sources, including the internet and search engines, databases, websites etc. once the personal information in question is no longer necessary, or relevant. Interestingly, and to the best of our knowledge, this judgement is also the first time the provisions of the Personal Data Protection Bill, 2019 (“PDP Bill”) (the proposed privacy law in India currently under Government consideration), has been discussed by a Court.

The Petitioner is alleged to have raped a woman and uploaded photos and videos of this act on Facebook after blackmailing her. Upon police intervention the Petitioner deleted this content from Facebook. A bail application (order for release from arrest) was filed by the Petitioner. The Court dismissed the bail application, and made certain observations on the requirement for RTBF to be recognized in India. We have covered these observations below.

While hearing the bail application, the Court noted that while the Indian criminal justice system prescribes strong penal action against the heinous crime of rape, but that there is currently no mechanism whereby any individual may get the objectional material deleted from Facebook servers. The Court also recognized that the harassment, threats and assault that citizens receive with regard to their online presence pose serious concerns for citizens. The Court noted that in situations such as the present one, victims ought to be able to get their photos deleted permanently from the servers of social media platforms such as Facebook, and that there was no statute that provided for this right. The Court went on to note that instituting the RTBF in India would play a role in protecting women’s interests on the internet.

The Court noted that RTBF has been recognized as a statutory right in the European Union under the General Data Protection Regulation (GDPR), and has been upheld by a number of courts in the United Kingdom, and in Europe.

The Court noted that even though there is now a “widespread and seemingly consensual convergence towards an adoption and enshrinement of the right to get deleted or forgotten”, hardly any effort has been made in India until recently to recognize the concept of RTBF. Importantly, the Court also recognized that while there is a need to implement RTBF in India, it is a “thorny issue in terms of practicality and technological nuances”.

The Court noted that RTBF has been discussed in the following Indian cases:

1. The Supreme Court in the case of K.S. Puttaswamy v. Union of India,² had held that the right to be let alone is an essential part of the autonomy and the privacy of an individual. The Supreme Court had also highlighted the importance of RTBF in this case, and stated that if India were to recognize RTBF as it exists under the GDPR today, “it would only mean that an individual who is no longer desirous of his personal data to be processed or stored, should be able to remove it from the system where the personal data/information is no longer necessary, relevant, or is incorrect and serves no legitimate interest”.
   
   The Supreme Court had also observed that RTBF was subject to certain limitations, it could not be exercised where the information in question was necessary for (1) exercising the right of freedom of expression and information; (2) compliance with legal obligations; (3) the performance of a task carried out in public interest, or public health; (4) archiving purposes in the public interest; (5) scientific or historical research purposes or statistical purposes; or (6) the establishment, exercise or defence of legal claims.

1. The concept of RTBF has been discussed in recent ordered passed by various high courts in India.³ The first case in India to deal with the concept of the right to be forgotten was the case of Dharmaraj Bhanushankar Dave v. State of Gujarat in the Gujarat High Court. While the Court didn’t per se recognize the ‘right to be forgotten’; the case arose as the petitioner had filed a case for the removal of a published judgment in which he had been acquitted. The Court did not grant an order for the removal of the judgement, as the petitioner had not been able to point out specific provisions of law that had been violated.⁴

1. A decision by the Karnataka High Court made references to the “trend in the Western countries” where they follow the “right to be forgotten” in sensitive cases. This Case was filed to remove only the name of the Petitioners daughter from the cause title as it was easily searchable and would cause harm to her reputation. The Court held in the Petitioner’s favour, and ordered that the name be redacted from the cause title and the body of the order.⁵

There is no statutory provision at present that provides for a RTBF. As noted by the Court, the current draft of the PDP Bill recognizes RTBF,⁶ and gives individuals the right to restrict or prevent the continuing disclosure of their personal data when it (1) has served the purpose for which It was collected, or is no longer necessary for said purpose; (2) was made with the consent of individual, which consent has since been withdrawn; or (3) was made contrary to the PDP Bill or any law in force. Importantly, the form of RTBF as recognized under the PDP Bill is not an unfettered right, and may be granted only once the ‘Adjudicating Officer’ appointed under the PDP Bill passes a favorable order on an application made by the individual. Hence, the RTBF under the PDP Bill is a limited right and is subject to approval by the Adjudicating Officer.

There were no orders passed on the removal of the photos and videos of the Informant from Facebook servers as the present case was a bail application, and the Informant had not raised the issue of her right to privacy and for the content to be deleted. Though, the Court was seemingly in favour of an individual’s RTBF in India.

The Court was also quite categorical in stating that due to the lack of appropriate legislation, the rights of the victim to have this content erased from Facebook servers remained unaddressed. The Court however held that in cases such as this, either the victim herself or the prosecution may, seek appropriate orders to protect the victim’s fundamental right to privacy, by seeking appropriate orders to have such offensive posts erased from the public platform, irrespective of the ongoing criminal process. For instance, even though an individual does not have an explicit RTBF under current law, they may seek recourse for removal of their data in public domain under other legal provisions such as defamation libel, indecency, intellectual property laws (if applicable), etc.

As highlighted above, there has been a recent trend of court decisions highlighting the importance of preventing the disclosure of personal information to prevent harm to the individual, and specifically recognizing the existence of RTBF. The Court observed that “information in the public domain is like toothpaste, once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away”.

It would be interesting to see the final scope of the RTBF right under the PDP Bill which provides for the right to restrict or prevent the continuing disclosure of personal data. While the PDP Bill was introduced in Parliament close to a year ago, in December 2019, there have been substantial delays in its movement towards enactment into law. In fact, recent news reports⁷ mention that the purpose and scope of the PDP Bill is set to be redefined and broadened, which may further delay its progress towards enactment.