Privacy vs. Public Interest: Balancing of Right in Digital Era & the Debate over Right to be forgotten

By Anuradha Gandhi and Rachita Thakur

Introduction

On November 6, 2024 Delhi High Court instructed the registry to redact the names of petitioner and respondent number 2 from the case record and search results. A criminal complaint was filed against the petitioner which led to registration of FIR but the accused was later acquitted. The case details were published online, and even after the case against the respondent was dismissed, the petitioner’s name and case information remained accessible and visible through a simple google search. Thus the petitioner filed the present case and therefore asked to remove the same under the right to be forgotten as it was having a negative impact on social life, career prospects and reputation.[1]

What is right to be forgotten?

The right to be forgotten typically refers to the ability to have one’s digital presence including news articles, videos, or photographs removed or erased so they no longer appears in search engine results or databases.[2]

Google Spain case

[3]

The case was first of its kind to recognize “right to be forgotten” at global level. Two articles concerning the attachment and garnishment regarding the property of petitioner was published in the newspaper but in the following years the economic situation of the petitioner changed yet a link to the earlier news was available on search engine long after. While dealing with the matter the court found that the activity of a search engine was to be classified as the “processing of personal data” within the meaning of that Directive and held that fair balance had to be sought between the legitimate interest of Internet users in having access to such information and the data subject’s fundamental rights. Search engine operators need to remove links of all third party internet pages relating to that person, even when such publications was lawful containing information which is inadequate, irrelevant or no longer relevant, or excessive, given the purposes for which they had been processed and in the light of the time that had elapsed since the date of the processing in question.[4]

GDPR under the Article 17 of General Data Protection Regulation personal data must be erased when the purpose has been served or data subject has withdrawn the consent and there exist no further legal ground for processing such data.[5]

Justice K.S Puttaswamy vs Union of India

[6]

The case recognized right to privacy as individual’s right to protect his reputation from being unfairly harmed and such protection of reputation needs to exist not only against falsehood but also certain truths and further recognizes right to be forgotten as a part of right to privacy as technology results in a sort of permanent storage in some way or other making it difficult to begin life again. Privacy is the key which allow the person to remove shackles of unadvisable things done in past[7] and right to erasure of the data is considered the cornerstone of the right to privacy.

India-

Section 12 of digital personal data protection act, 2023 (herein referred to as DPDPA) provides that data principal shall have right to erase personal data for processing of which she has previously consented and data fiduciary shall further erase it unless retention is necessary for specified purpose or for compliance with law.[8]

USA-

Unlike EU and India, USA do not recognize right to be forgotten explicitly as it would be the closest they have gotten to it is right to opt-out which would allow user to opt out of allowing companies to sell their data to other company as provided in the new privacy rights act.[9] California consumer privacy act provides for deletion of data to safeguard personal information that may possibly have negative effect on the consumer.[10]

How search engine works?

Search engines works in three stages-

Demo
Crawling	Search engines use bots to crawl through different websites and pages. It uses algorithmic process to determine which sites to crawl, how often and what information to collect.[11]
Indexing	Webpages, links discovered by search engines are added into the database structure called index. It further tries to understand the content and categories based on keywords.[12]
Serving Search Result	On entering the query in search engine it provide with most relevant results relating to the search. It also serves information by personalizing as per the individual based on their web history, location and also by use of cookie. In addition, search engines’ also use machine learning algorithms to personalize search.

As of 2022, Google’s Transparency Report revealed that it had delisted nearly 50% of the URLs requested for removal under these terms, having received over 1.3 million requests from users to be “forgotten” since 2014. The relevance of this new right cannot be disputed; however, its scope, applicability and effects are still being debated.[13]

De-referencing of sensitive data

In the very famous case of Google vs CNIL, de-referencing of sensitive personal data was discussed to great extent. It was mentioned that lawfulness of sensitive data shall be considered on appeal of de-referencing. Under article 9 of GDPR the processing of sensitive personal information or data is safeguarded. In the case that data processing is lawful, right to data protection usually overrides the freedom of information of internet users.[14]

The search engine operator is required to settle to the request for de-referencing of links containing sensitive personal data. The search engine operator needs to perform balancing test of competing rights present.[15]

Territorial Scope of de-referencing

EU –

Under article 3 of GDPR territorial scope of processing personal data has been defined. The scope extends to conditioning of an establishment of controller or processor in the Union, irrespective of whether processing takes place in union or not.[16] The right to be forgotten can be classified into-

Demo
Global	Search engines result can effect EU resident even when search is conducted by non EU resident
EU-Wide	Blocking of data links in the member states from gaining access
Language	Geo-blocking of search results based on language.[17]

India-

In the case of Vasunathan vs State of Karnataka[18], court ordered the registry to mask the name of the petitioner’s daughter and ensure that any internet search made in public domain shall not reflect her name. While in different case, the court order involved removal of links from domains primarily in India[19] restricting the scope to Indian jurisdiction only. Between these conflicting judgements the DPDPA provides with the territorial scope of processing personal data, it applies on processing of data within India and outside India if such data relates to good or services being offered in India.[20]

Right to forgotten Vis a Vis right to information

While protecting the individual’s right to be forgotten there is a need to balance private interest with public interest. The criteria to judge this could be divided as[21]:

Nature of archived information.
Time elapsed since happening of event
Contemporary interest of information
Person claiming entitlement to information was well known
Conduct of individual since the event
Negative repercussion of continued availability of information
Degree of accessibility of information in digital archive
Impact on freedom of press

Also, after considering the facts and circumstances of the case right to de-index and to remove personal information of individual can be considered, in certain cases right to erasure and deletion of personal information from search engine can be allowed. There need to be a fine balance between concept of open justice and that of privacy of litigant/individual.[22] Supreme Court is further dealing with the matter of Right to be forgotten and CJI noted that ordering a removal of judgement is a far-fetched idea, masking of the name of the victims or witnesses can be done by court but removal of judgement relating to one case can lead to request of removal of the judgement in other financial matters too and since judgement amounts to public record such request can’t be entertained.[23]

To know more about right to be forgotten in judicial and publicly available document refer to our article https://ssrana.in/articles/right-to-be-forgotten-judicial-publicly-available-documents/

Freedom of press and right to be forgotten

Newspaper data can be asked to be blocked to appear on search engine as newspaper archives can be a rich source of information about individuals. In case the article is something negative, the continued appearance on newspaper can have deteriorating effect on the reputation of individual.[24]

Right to freedom of press must give way to the right to privacy of the especially when the accused has been exonerated of all the allegations leading to his honorable acquittal.[25]

In case the request for blocking or masking the name is made after long period of time it cannot override the freedom of press.[26]

The names of the individuals in a case need to be masked/erased so that they do not appear/visible in any search engine, least the same is likely to jeopardize and cause irreparable hardship, prejudice etc., not only to the respondent and the prosecutrix, but to their people connected with them in their day-today life, career prospects etc.[27]

Conclusion

De-indexing requests and jurisprudential discussions have now extended beyond removal of URLs. The apex court in the case of ABC vs State[28] quoted-

“the need to allow the masking of names of individuals acquitted of any offence or when criminal proceedings against such persons are quashed, emanates from the most basic notions of proportionality and fairness. While access to information is a fundamental aspect of democracy, the same cannot be divorced from the need to balance the right to information of the public with the individual’s right to privacy. This is especially when after the quashing of the proceedings, no public interest can be served by keeping the information alive on the internet”

If it is allowed to stay on record, the internet will never permit the humans to forget.[29]

Abhishekta Sharma, Assessment Intern at S.S. Rana & Co. has assisted in the research of this article.

[1] ABC v. State, CRL.M.C. 495/2019

[2] https://www.thehindu.com/news/national/right-to-be-forgotten-from-judicial-records-explained/article68459719.ece

[3] ECLI:EU:C:2014:317

[4] https://fra.europa.eu/sites/default/files/fra_uploads/fra-2024-factsheet-right-to-be-forgotten_en.pdf

[5] https://gdpr-info.eu/issues/right-to-be-forgotten/

[6] (2017) 10 SCC 1

[7] https://indiankanoon.org/doc/127517806/

[8] https://indiankanoon.org/doc/72504975/

[9] https://www.freedomforum.org/right-to-be-forgotten/

[10] § 7002, California Consumer Privacy Act, https://cppa.ca.gov/regulations/pdf/cppa_regs.pdf