The Right To Be Forgotten
The Right To Be Forgotten Requires Deliberate Rulemaking
*Apar Gupta
On July 5, 1993 an illustration made by Peter Steiner was published in The New Yorker picturing a pair of dogs talking to each other. One of them with a paw on a keyboard, in front of a computer. It carried the now iconic caption, “On the internet, nobody knows you’re a dog”. The graphic and the accompanying text conveyed an utter lack of trust in the early use of the Internet. But it also captured another minor sentiment- -the presence of user choice. In the early days of the Internet a person could be anyone. They could build their online personality, or simply refuse to participate in the growing information economy.
With the network maturing, information being aggregated and the erasure of boundaries between the physical and the virtual, the ability of users to shape their online identities has become tougher. Irrespective of merit, digital mediums of communication have become a preferred mode for publication by users, institutions and governments. Much of this ends up being publicly accessible information. While such data improves hope of transparency and rich empirical models, it has also led to a loss of control for individuals. Search engines today provide a deep insight into a person’s identity by collecting information published over years, if not decades. A simple online search, not taking more than a few minutes, may reveal intimate, embarrassing details. Such information may be timeworn, selective or irrelevant but may lead to social judgment and emotional distress for the subjects of such a search result. Clearly there exists a problem. One of the solutions being proposed to it is the right to be forgotten.
The right to be forgotten has been an area of debate for some years, but was relatively dormant until a recent judgment by the European Court of Justice (ECJ). The ECJ in Google Spain judgment1 rendered an opinion in favor of a right to be forgotten stating that, “…if it is found..., following a request by the data subject…that the inclusion in the list of results displayed following a search made on the basis of his name… [are] inadequate, irrelevant or no longer relevant, or excessive... the information and links concerned in the list of results must be erased.”
This judgment has come under substantial criticism on several grounds. Much of this concern arises from its impact on free expression. There is good reason for such worry. The role of the Internet in decreasing barriers for access to knowledge and communication is well documented. The United Nations Human Rights Council has recently recognized access to the Internet to be a basic human right. Given the growing adoption of the Internet, risks to individual reputation do arise, but there also exists large-scale social benefits. It may be also important to emphasize that a binary analysis between the right to privacy and the right to free speech, while useful, may also be restrictive. It may provide a false sense of certainty in analysis when the area of regulation in India is more complex within such categories.
[ 19 ]
This essay has the modest hope of setting out the complexity of the debate on the right to be forgotten as may be specially suited to India. It makes the argument that the right to be forgotten is a determination that requires a deliberative process. Many elements have been flagged which are best suited to be examined by the office of a Privacy Authority or a Privacy Commissioner. Such a proposal may look tedious or even politically unviable at present — but terming whim into regulation is a perilous path. Without wide consultation by an expert institution, we may not be able to assess how much the right to be forgotten guards individual reputations, and how much it bites into public interest.
The Origins of the Right To Be Forgotten in India
It is first necessary to understand the premise of the right to be forgotten. What are its proper contours and from where does it arise in law? The first part of the inquiry is linked to explaining the articulation of right to be forgotten by the ECJ and then examining its links to the existing body of law in India.
The right to be forgotten has been identified by several commentators as arising from European statutes on criminal and civil law. Many link it to the right of rehabilitation for convicts, reasoning that erasure of their criminal histories is necessary for social integration. Such statutes exist in the United Kingdom and France that incorporate a “right to oblivion” or, le droit à l’oubli. But an immediate origin of the Google Spain judgment is the European Union’s Data Protection Directive made in 1995. The ECJ premised its holding on the right of “rectification, erasure or blocking of data” under Articles 12(b) and 14(a) of the Data Protection Directive. As per the official court summary, it reasons, “the effect of the interference with the person’s rights is heightened on account of the important role played by the internet and search engines in modern society, which render the information contained in such lists of results ubiquitous.” The practical effect of the judgment is that persons within the European Union may make a request directly with a search engine to de-list. After, such an application is then judged by the search engine, which may delist the webpage.
Ostensibly the right to be forgotten is on a similar trajectory for recognition in India. At present, a case titled as, Laksh Vir Singh Yadav v. Union of India & Others2 is pending adjudication in the High Court of Delhi. However, there exist concerns as to the creation of such a right given its tenous link with the right to privacy. There exists little statutory support of any privacy legislation in India that may provide an underlying legislative basis (such as Data Protection Directive) for holding that a right to be forgotten exists in India. Further, though unfortunate it is also relevant to highlight a cloud that has been brought on the fundamental right to privacy. This is due to the reference by the Supreme Court on the question as to its origin in the aadhaar batch of cases titled as Justice K.S. Puttaswamy & Anr. v. Union of India & Others3 .
Due to this reference inconsistency has crept into the application of the fundamental right to privacy. While some High Courts (specifically the High Court of Bombay and the High Court of Patna) have applied the right to privacy in their determinations, the High Court of Delhi has restrained itself in the case of Karmanya Singh Sareen & Anr. v. Union of India & Ors4 .
[ 20 ]
There also exist substantive objections to extending the right to privacy to include the right to be forgotten. The right to be forgotten though concerns the interest of an individual to control information/data as similarly found in the right to privacy, there is an important distinction between both.
Whereas the right to be forgotten concerns information which is publicly available, the right to privacy concerns information which is private and intimate. Such distinction is made clear from the obiter of the Supreme Court in R. Rajagopal v. State of Tamil Nadu5 , where it held that, “A citizen has a right to safeguard the privacy of his own, his family, marriage, procreation, motherhood, child-bearing and education among other matters…None can publish anything concerning the above matters without his consent whether truthful or otherwise and whether laudatory or critical…[however] any publication concerning the aforesaid aspects becomes unobjectionable if such publication is based upon public records including court records. This is for the reason that once a matter becomes a matter of public record, the right to privacy no longer subsists and it becomes a legitimate subject for comment by press and media among others.”
Further, if such a right were to be created purely as per the right to privacy under Article 21 of the Constitution of India, it is questionable if it can be extended to wholly private companies who operate search engines. This is given that fundamental rights generally apply to state instrumentalities.
At this instance, it is important to recognize that the right to be forgotten is also distinct from an assertion that the publication itself is defamatory. If that would be the case, the removal of the link from the search engine would operate as a regular injunction (in the nature of a consequential relief to a finding of defamation), rather than an independent distinct right. Hence, the right to be forgotten as is at present being proposed is not only independent of the right to privacy but also the wrong of defamation.
When wading through such legal doctrine it would be inequitable to deny that there exist instances where public information that is indexed by a search engine may be damaging to an individual. Much of the information indexed by search engines on a person does not originate from such persons data but through independent, third party websites that are not under their control. Hence, there is little recourse a person has when the first result for a search query on their name reveals damaging information. Such lament may be one of the reasons that about two years ago the New Yorker revisited it’s illustration of the two talking dogs. This time the caption read, “remember when, on the Internet, nobody knew who you were?”. However, there exist good reasons to restrain sympathy for the right to be forgotten.
Threats to Free Expression
While the right to be forgotten may offer uncertain benefits, the risks to free expression and speech are immediate. The right to freedom of speech and expression is expressly guaranteed under Article 19(1)(a) of the Constitution of India. It includes, (i) the freedom of the press; and (ii) the right to receive information. Both the right of the press and the right to receive information have been recognized by the judgments of the Supreme Court of India as forming the core of the right to freedom of speech and expression. While freedom is not absolute and is restricted by the express grounds for legislation under Article 19(2), it has to be built on the basis of well-recognized limitations such as privacy or defamation. As the analysis above demonstrates, the right to be forgotten does not fall within the silos of either. At the very least there is some balancing that is required when, and if, the right to be forgotten is recognized in India.
[ 21 ]
Limited Liability of Intermediaries in India
Another aspect that merits consideration is the operation of such a right. In its present formulation the right to be forgotten would be determined by a system of a private complaint to an online intermediary (such as Google). Even if a criterion were developed for the application of the right to be forgotten, the determination in individual instances would still be as per the discretion of the online intermediary.
The Supreme Court in the case of Shreya Singhal v. Union of India6 signaled a discomfort with a quasijudicial power being vested in a private party by stating that, “Section 79(3)(b) has to be read down to mean that the intermediary upon receiving actual knowledge that a court order has been passed asking it to expeditiously remove or disable access to certain material must then fail to expeditiously remove or disable access to that material. This is for the reason that otherwise it would be very difficult for intermediaries like Google, Facebook etc. to act when millions of requests are made and the intermediary is then to judge as to which of such requests are legitimate and which are not.”
Quite simply, the court reasons that the takedown mechanism for illegal content can only be enforced as per the order of a court or a state authority. There are several benefits to such an approach, including the observance of natural justice. As per the approach indicated under the Shreya Singhal case illegality is first determined as per existing laws and reasons are provided within the order. In reaching such a determination a public authority would be legally obligated to provide the opportunity of a hearing.
This would be extended both to the complainant and the party whose web page will be removed or deindexed from the search engine. In case either of them remains dissatisfied further processes for appeal would exist. All these safeguards will be circumvented in a private system of enforcement, when the complaint can directly be made to the search engine that would act like a judge. These are only some of obvious considerations that need to be weighed and balanced to determine the legal regulation for the right to be forgotten in India.
Some Solutions and Wider Prescriptions
The Internet policy space is witnessing frenzied activity as we come to realize that slogans for Digital India are not matched by the regulations of a digital India. However we must not mistake movement for progress. Risk exists that the pressures to act in haste may negatively impact public interest. A positive way to proceed in future may be provided by the lessons of the past.
Here India’s principal statute to regulate online conduct, the Information Technology Act, 2000 (IT Act) provides some guidance. Commentators frequently point to inadequacies within the IT Act. While criticisms on its several provisions and deficiencies have merit, to its credit the Information Technology Act, 2000 was the product of deliberative rule making. The origin of the law was premised on the desire for uniformity in national legislations that would govern the Internet. Hence, large parts of the legislation are based on the Model Law on Electronic Commerce proposed by the United Nationals Commission on International Trade. Even when amendments were made to the legislation after eight years of its existence, there were multiple rounds of consultations to examine the recommendations made by an expert committee. However, at present such an approach seems to be episodically employed. There is a general absence of any sustained policy dialogue fostered by a government institution that advances rule making.
[ 22 ]
For instance the Information Technology Act, 2000 in Section 88 provides for the constitution of an advisory committee that should be composed of persons having special knowledge in the area. Even though stray government notifications exist indicating the constitution of the committee, its effectiveness remains in doubt. Till date the composition of this advisory committee has included only civil servants who are government officers or representatives of industry associations.
There have not been any members who are academics, engineers, civil society representatives or technologists. Even the meetings of this advisory committee are not public and it is not clear if the committee has been conducting regular business. Given the pace at which the Internet is being adopted in India and the tremendous impact it has on society, what is needed today are government institutions that promote research and dialogue.
The government when looking to develop its institutional capacity must balance various stakeholder interests. This understandably will require diverse voices to be continuously engaged rather than be granted an audience every few years. The absence of such a forum will only throw up more legislative and regulatory gridlocks, or even subject them to reactive measures adverse to public interest. Even after several years there is no clear roadmap indicated by the government for privacy legislation in India. Drafts of a Draft Privacy Law have been kept private without any public consultation.
In such a situation it is reasonable to deduce that litigations are only symptoms of a legislative vacuum. Another example of this is the case concerning the right to be forgotten, which subjects a complex Internet policy determination to adversarial litigation. While we may pride ourselves with mental faculties that are superior to animals, there are lessons to learn from them. About six years ago, Jessica Pierce and Bekoff Marc wrote a book by the name of ‘Wild Justice’.
As the title hints, it concerns an examination of the behaviors of animals contrasted against humans. One of the startling findings they posit is that dogs have a unique sense of right and wrong. They further suggest that when in packs, they enforce moral boundaries for their members. There is some modesty in such an approach that is built on dialogue and negotiation. It promises the advancement of social interest with individual rights. It helps us to collectively assess risk, factor complexity and reach for an ideal.
*Apar Gupta is a lawyer practicing in Delhi.
Disclosure: Apar is a trustee in the Internet Freedom Foundation (IFF) that has filed an intervention application in the case of Laksh Vir Singh Yadav v. Union of India [W.P. (C) No. 1021 of 2016].All comments made in this post are personal views of the author.
