The Right to be Forgotten: India's Digital Eraser for Privacy Under Article 21

Introduction: The Digital Shadow and the Quest for Anonymity

In the digital age, every click, search, and transaction contributes to an indelible digital footprint. While this data-driven world offers unprecedented convenience, it also creates a permanent, publicly accessible record of an individual’s life, often without their consent or control. This “digital shadow” can haunt individuals long after past events have lost their relevance, impacting their reputation, employment prospects, and personal dignity. In response to this challenge, the legal concept of the Right to be Forgotten (RTBF) has emerged as a crucial pillar of modern privacy jurisprudence. It is the right of an individual to have their personal information removed from the internet, search engines, and other public databases, effectively allowing them to erase a part of their digital past and move forward without being perpetually defined by it.

The RTBF is not an absolute right to delete all information. Instead, it represents a complex and delicate balancing act. It pits an individual’s claim to privacy, dignity, and autonomy against countervailing public interests, most notably the Right to Information and the Freedom of Speech and Expression. The core question is: when does an individual’s desire to be left alone outweigh the public’s right to know and the media’s right to report? This tension is at the heart of legal debates surrounding the RTBF across the globe, from the European Union’s landmark regulations to its nascent development in India.

In the Indian context, the journey of the RTBF is intrinsically linked to the evolution of the Right to Privacy. For decades, privacy was a penumbral right, inferred from other fundamental rights but not explicitly guaranteed. This changed dramatically with the Supreme Court’s historic nine-judge bench ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), which unanimously affirmed that the Right to Privacy is a fundamental right, intrinsic to the Right to Life and Personal Liberty guaranteed under Article 21 of the Constitution. This judgment became the constitutional bedrock upon which the Right to be Forgotten could be built, transforming it from a theoretical concept into an enforceable claim. More recently, the enactment of the Digital Personal Data Protection Act, 2023 (DPDPA) has provided a statutory framework for this right, codifying it as the “Right to Erasure” and setting a new course for data governance in India.

The Constitutional Foundation: Article 21 and the Puttaswamy Judgment

The legal and philosophical basis for the Right to be Forgotten in India is Article 21 of the Constitution, which states: “No person shall be deprived of his life or personal liberty except according to procedure established by law.” Through decades of progressive judicial interpretation, the Supreme Court has expanded the meaning of “life” and “personal liberty” to include a wide array of rights that are essential for a meaningful existence, such as the right to a clean environment, the right to education, and, most importantly for this context, the right to live with dignity.

The watershed moment for privacy rights came with the Puttaswamy judgment in 2017. The Supreme Court, while examining the constitutional validity of the Aadhaar scheme, declared that privacy is not merely a common law right but a fundamental right protected by the Constitution. The Court held that privacy is an essential facet of human dignity and is indispensable for the exercise of other fundamental freedoms. It recognized that in an era where technology permeates every aspect of life, the protection of personal data is crucial to safeguarding individual autonomy.

Justice Sanjay Kishan Kaul, in his concurring opinion in the Puttaswamy case, specifically addressed the Right to be Forgotten. He noted that the RTBF is a critical aspect of the broader right to privacy, particularly in the digital realm. He argued that individuals should have the ability to “control the portrayal of their life and identity on the internet” and to “delete certain data and get it deleted from third parties so that they are no longer traceable.” This judicial recognition provided the first strong constitutional anchor for the RTBF in India, empowering individuals to approach courts seeking the removal of irrelevant, outdated, or harmful information from the public domain.

Following the Puttaswamy verdict, several High Courts began to apply its principles to specific cases involving the Right to be Forgotten. For instance, the High Court of Karnataka, in Sri Vasunathan v. The Registrar General (2017), allowed a woman’s request to have her name removed from a judgment copy available online, recognizing the potential harm to her reputation and marital prospects. Similarly, the Delhi High Court, in Zulfiqar Ahman Khan v. Quintillion Business Media (2019), granted an interim order restraining the republication of articles against the petitioner, acknowledging his Right to be Forgotten pending the final adjudication of the case. These judgments, while not creating a uniform law, demonstrated the judiciary’s willingness to carve out a space for the RTBF by balancing it against the right to freedom of expression on a case-by-case basis.

Fun Fact: The concept of the Right to be Forgotten gained global prominence after the 2014 case of Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos, Mario Costeja González. The Court of Justice of the European Union ruled that search engines are data controllers and must de-link search results containing inadequate, irrelevant, or excessive information about a person if requested, even if the original publication was lawful.

Codification and Recent Developments: The Digital Personal Data Protection Act, 2023

While judicial pronouncements provided a constitutional basis for the RTBF, the absence of a specific legislative framework created ambiguity and inconsistency. This gap has been addressed by the Digital Personal Data Protection Act, 2023 (DPDPA), which represents India’s first comprehensive law on data protection. The DPDPA formally codifies the Right to be Forgotten under the title of the “Right to Erasure.”

Chapter III of the DPDPA outlines the rights of a Data Principal (the individual to whom the data relates). Section 12 of the Act grants the Data Principal the “right to correction and erasure of personal data.” Specifically, a Data Principal can request a Data Fiduciary (the entity that collects and processes the data) to erase their personal data upon the fulfillment of two key conditions:

1. The data is no longer necessary for the purpose for which it was collected and processed.
2. The Data Principal has withdrawn their consent for the processing of the data.

This statutory right empowers individuals to directly approach companies, social media platforms, and other data-collecting entities to demand the deletion of their data once the original purpose of its collection is served. For example, if a user provided their data to an e-commerce platform for a one-time purchase, they can later request the platform to erase that data under the DPDPA.

However, the Right to Erasure under the DPDPA is not absolute. The Act provides several exemptions where a Data Fiduciary can refuse an erasure request. Section 17(4) of the Act states that the provisions for erasure do not apply if the processing of data is necessary for:

• Enforcing any legal right or claim.
• The performance of any judicial or quasi-judicial function.
• Preventing, detecting, investigating, or prosecuting any offense.
• Processing of personal data of a Data Principal not within the territory of India pursuant to any contract entered into with any person outside the territory of India.

Furthermore, the central government holds the power to exempt certain activities from the purview of the Act, such as for reasons of national security, public order, or for research, archiving, or statistical purposes. This creates a framework where the individual’s right to erasure is balanced against broader public and state interests.

The implementation of the DPDPA is overseen by the Data Protection Board of India (DPBI), a new regulatory body established under the Act. The DPBI will adjudicate disputes between Data Principals and Data Fiduciaries, including those related to the Right to Erasure. If a Data Fiduciary fails to comply with a valid erasure request, the Data Principal can file a complaint with the Board, which has the power to impose significant financial penalties on non-compliant entities. The penalty for a breach of obligations towards a Data Principal can extend up to ₹10,000 per instance.

The Inherent Conflict: Balancing Privacy with Public Interest

The most challenging aspect of implementing the Right to be Forgotten is navigating its inherent conflict with two other fundamental rights: the Right to Information and the Freedom of Speech and Expression.

1. RTBF vs. Right to Information (RTI Act, 2005): The RTI Act empowers citizens to access information held by public authorities, promoting transparency and accountability in governance. The RTBF, in contrast, seeks to restrict access to information. A conflict arises when an individual requests the removal of information from a public record, such as a court judgment or a government report, which is otherwise accessible under the RTI Act. For example, a public official convicted of corruption in the past might invoke the RTBF to have news reports and records of their conviction removed from the internet, arguing that they have served their sentence and the information is no longer relevant. This directly clashes with the public’s right to know about the integrity of its officials.

The judiciary has to perform a delicate balancing act here. The courts typically weigh factors such as:

• The nature of the information and its relevance to the public.
• The role of the individual in public life (e.g., a public figure has a lower expectation of privacy).
• The time that has elapsed since the event.
• The potential harm to the individual versus the benefit to the public.

2. RTBF vs. Freedom of Speech and Expression (Article 19(1)(a)): This right is the cornerstone of a democratic society and includes the freedom of the press. The RTBF can be seen as a form of censorship, as it can compel media organizations, publishers, and online platforms to take down content that is factually accurate and was lawfully published. Journalists and historians argue that allowing individuals to selectively erase parts of the public record could lead to a sanitized and distorted version of history. It could also create a “chilling effect” on investigative journalism, as reporters may become hesitant to publish stories for fear of future takedown requests.

To address this, the DPDPA includes an exemption for journalistic purposes. Section 17(1)(c) of the Act states that the rights of the Data Principal (including the Right to Erasure) do not apply where the data is processed “for journalistic purposes and for the purpose of exercising the right to freedom of speech and expression.” However, the scope of “journalistic purposes” is not explicitly defined, which may lead to future litigation.

Mnemonic for Balancing RTBF: To remember the key factors courts consider when balancing the Right to be Forgotten against public interest, one can use the acronym P-R-I-M-E:

• Public Figure Status: Is the individual in the public eye?
• Relevance: Is the information still relevant to the public?
• Information Nature: Is the data sensitive, private, or related to a crime?
• Motive for Removal: Is the request to prevent harm or to hide wrongdoing?
• Elapsed Time: How long ago did the event occur?

Global Perspectives: A Comparison with GDPR

India’s approach to the Right to Erasure in the DPDPA has been influenced by global standards, particularly the European Union’s General Data Protection Regulation (GDPR). However, there are notable differences in their scope and application.

This comparison shows that while India has taken a significant step by codifying the Right to Erasure, its framework is more state-centric and provides broader exemptions compared to the individual-centric approach of the GDPR.

Critical Policy Appraisal

Fun Fact: It is estimated that by 2025, the total amount of digital data created worldwide will reach 175 zettabytes. A zettabyte is equivalent to a trillion gigabytes. This explosion of data underscores the monumental technical challenge of locating and erasing specific personal information when a “Right to be Forgotten” request is made.

Analytical Lens: UPSC Focus (Mains & Prelims)

Conceptual Basis: The legal foundation for the Right to be Forgotten in India rests on two pillars:

1. Constitutional: Article 21 (Right to Life and Personal Liberty), as interpreted by the Supreme Court in the K.S. Puttaswamy v. Union of India (2017) judgment, which established the Right to Privacy as a fundamental right.
2. Statutory: The Digital Personal Data Protection Act, 2023, which codifies the right as the “Right to Correction and Erasure” under Section 12.

UPSC Integration: Connecting the Dots

• Polity and Governance (GS Paper II): The topic is central to Fundamental Rights, the role of the judiciary in expanding these rights (judicial activism), the legislative process (enactment of the DPDPA), and the functioning of regulatory bodies (Data Protection Board of India).
• Economy (GS Paper III): It has significant implications for the digital economy, including compliance costs for startups and corporations (Data Fiduciaries), the growth of e-commerce, and India’s position as a global IT hub. It is also linked to the concept of building a trusted and secure digital marketplace.
• Science and Technology (GS Paper III): The technical aspects of data erasure, data anonymization, blockchain’s immutability (which poses a direct challenge to the RTBF), and the architecture of the internet are all relevant.
• Ethics (GS Paper IV): The topic presents a classic ethical dilemma: individual privacy vs. public interest. It involves questions of personal dignity, accountability, and the potential for the powerful to manipulate information.

Long-Term Impact and Policy Relevance: The formalization of the Right to Erasure through the DPDPA marks a paradigm shift in India’s approach to data governance. In the long term, this will force all entities, from large tech giants to small businesses, to adopt a “privacy-by-design” approach, where data minimization and user consent become core operational principles. The law’s success will depend heavily on the institutional capacity and independence of the Data Protection Board of India. The ongoing judicial interpretation will be crucial in resolving the inherent tensions with the RTI Act and freedom of speech. As India’s digital economy aims to reach $1 trillion, the DPDPA and the Right to Erasure will be critical in ensuring that this growth is inclusive, equitable, and respects the fundamental rights of citizens.

Prelims Practice Question (MCQ):

Question: With reference to the Digital Personal Data Protection Act, 2023, a Data Principal can request the erasure of their personal data if:

1. The Data Principal has withdrawn their consent.
2. The data is no longer necessary for the purpose for which it was collected.
3. The data is being used for journalistic purposes.
4. The processing is necessary for a judicial function.

Select the correct answer using the code given below: (a) 1 and 3 only (b) 1 and 2 only (c) 2, 3 and 4 only (d) 1, 2, 3 and 4

Answer: (b) 1 and 2 only Explanation: Section 12 of the DPDPA specifies that the Right to Erasure can be invoked when consent is withdrawn or the original purpose is fulfilled. The Act provides exemptions for journalistic purposes (Section 17(1)(c)) and for the performance of judicial functions (Section 17(4)), meaning the right to erasure does not apply in those situations.

Mains Sample Question (15 Marks):

Question: “The Right to be Forgotten, now statutorily recognized as the Right to Erasure under the Digital Personal Data Protection Act, 2023, creates a fundamental conflict with the Right to Information.” Critically analyze this statement, discussing the constitutional basis of both rights and suggesting a framework for harmonizing them in the Indian context.

Mind Map Outline (Revision Structure)

• The Right to be Forgotten (RTBF) in India
  • Core Concept:
    • Definition: Right to have personal data removed from public access.
    • Objective: Protect individual dignity, privacy, and autonomy from a permanent digital past.
    • Inherent Tension: Balancing privacy with Right to Information and Freedom of Speech.
  • Constitutional & Legal Foundations:
    • Article 21 (Right to Life and Personal Liberty):
      • Expanded interpretation by the Supreme Court.
      • Inclusion of the Right to Live with Dignity.
    • K.S. Puttaswamy v. Union of India (2017):
      • Right to Privacy declared a Fundamental Right.
      • Justice S.K. Kaul’s opinion specifically mentioning RTBF.
    • High Court Judgments (Post-Puttaswamy):
      • Application of RTBF on a case-by-case basis (e.g., Karnataka HC, Delhi HC).
  • Statutory Codification: Digital Personal Data Protection Act (DPDPA), 2023:
    • Key Terminology:
      • Data Principal: The individual.
      • Data Fiduciary: The data-collecting entity.
      • Data Protection Board of India (DPBI): The regulatory body.
    • Section 12: The Right to Erasure:
      • Grounds for Erasure:
        • Withdrawal of consent.
        • Purpose of collection is fulfilled.
    • Exemptions and Limitations (Section 17):
      • Enforcement of legal rights.
      • Judicial functions.
      • Journalistic purposes.
      • National security and public order.
  • Core Conflicts & Balancing Act:
    • vs. Right to Information (RTI Act, 2005):
      • Transparency vs. Privacy.
      • Public records and accountability.
    • vs. Freedom of Speech (Article 19):
      • Freedom of the press.
      • Risk of censorship and historical revisionism.
    • Balancing Factors (Mnemonic: P-R-I-M-E):
      • Public Figure Status, Relevance, Information Nature, Motive, Elapsed Time.
  • Policy Analysis & Global Context:
    • Comparison with EU’s GDPR:
      • Scope, public interest test, and enforcement mechanisms.
    • Critical Policy Appraisal Table:
      • Challenges: Ambiguity, implementation hurdles, conflict with RTI.
      • Opportunities: Individual autonomy, alignment with global standards, digital trust. [NEW_TOPIC_NAME:right-to-be-forgotten-india-article-21]