The Personal Data Protection Bill, 2019 (‘The Bill’) was introduced by the Ministry of Electronics and Information Technology and was passed by the cabinet on the 11th of December 2019. The objective of the Bill is to set a framework for the processing of personal data. The Bill promises to give power to the digital citizens of this country by giving them ‘their rights’ which includes, among others, the right to consent and the right to access.
Analysis of free speech and expression in the Bill requires an examination of provisions relating to the right to erasure, right to be forgotten, and provisions concerning the social media verification. This article seeks to analyse these provisions through the lens of the right to anonymity, ensuring that this lens would look at free speech and expression of the Personal Data Protection Bill from a gendered perspective.
What Is Right To Erasure?
Even after the individual has provided their data to organizations (data fiduciaries who are involved with determining purpose and means of processing of personal data), they will have the right to erase the data once the purpose of the processing, by the fiduciaries, is complete. The Bill allows data principals (the person to whom the data belongs) to approach the adjudicating officer of the Data Protection Authority (an independent regulatory body) to restrict or delete personal content which is no longer necessary for the purpose for which it was processed. The eligibility to claim this particular right will be provided by subsequent regulations of the Bill.
While the 2018 version of the Bill did not have the provision pertaining to ‘right to erasure’, the 2019 version of the Bill introduced this right, along with the right to correction. The data fiduciaries may refuse such requests but only through reasonable steps. The inclusion of this provision is quite useful for the data principal. However, this right should also have been incorporated with the right to be forgotten under the Bill. The current provisions pertaining to the right to be forgotten only deals with the non disclosure of data and not the erasure of data. The separation between the two has lead to various questions pertaining to the balancing of various rights like: does the right to be forgotten, without the inclusion of the right to erasure, pose a threat to the freedom of speech and expression of individuals?
While the Personal Data Protection Bill puts the burden of this decision on the adjudicating officers of the Data Protection Authority, the jurisprudence that arises from the decisions in the High Courts seem to be favouring the right to be forgotten over the right to be anonymous, especially in cases that involve #MeToo Allegations.
My Right to Anonymity vs. His right to be forgotten
The jurisprudence of the ‘right to be forgotten’ developed from the Google v Spain case wherein the European Court of Justice delivered the judgment in favour of the petitioner who had approached the court for the removal of a newspaper article (of himself) from Google, as he found the same to be no longer relevant. The Court directed Google to remove “inadequate, irrelevant or no longer relevant” data from its search results whenever its user requests so. The ruling came to be known as the ‘right to be forgotten’ case and this principle has been adopted by various data protection laws across jurisdictions. While the article about him was concerning an announcement regarding a forced sale of his property, the question arises as to whether the court would have held the same ruling had the nature of the petitioners offences been more severe?
In India, the right to be forgotten comes under Section 20 of the Personal Data Protection Bill wherein it is clearly stated that the data principal shall have the right to restrict or prevent the continuing disclosure of their personal data by a data fiduciary. This right shall arise whenever the principal feels that such disclosure has served the purpose for which it was collected, or is no longer necessary or if the consent to process the data has been withdrawn by the principal. In such a situation, once the data principal approaches the adjudicating officer (of the independent regulatory body) for the removal of his/her content from the data fiduciary, the adjudicating officer will have to determine whether the right of the individual to restrict the use of her data overrides the right to freedom of speech or right to information of any other citizen.
The Gujarat High Court denied the existence of the right to be forgotten in a case where the petitioner, an initial accused (of criminal conspiracy) who was later acquitted by a Higher Bench, had articles published online harming his reputation. The court denied the petitioners ‘right to be forgotten’ in this case by stating that the ‘publication on a website’ does not amount to ‘reporting’. Meanwhile, the Karnataka High Court upheld the ‘right to be forgotten’ as a right giving the judgement in favour of a petitioner who wanted his daughter’s name to be removed from a court order filed and withdrawn by her. The name was apparently ‘easily searchable’ and this, according to their claims, was affecting their personal lives. The Karantaka High Court while making references to ‘trend in the Western countries’ wherein the courts follow ‘Right to be forgotten’ in sensitive cases involving women and highly sensitive cases involving rape or affecting the modesty and reputation of the person, held in favour of the petitioner and had her name removed from any publication of the order online.
While the first judgement was problematic because it did not consider an online publication to be a report, the second judgement is also flawed because it does not recognise the ‘right to privacy’ of the woman but only identifies the ‘idea of modesty and reputation of women’ which is regressive, patriarchal and has no legal backing or jurisprudence.
Recently, the Delhi High Court too gave its opinion on the ‘Right to be forgotten’ specific to #MeToo allegations. In a pending suit, the High Court while stating how ‘Right to be Forgotten’ and the ‘Right to be Left Alone’ are the inherent facets of ‘Right to Privacy’, gave an order in favour of the removal and republication of articles against the plaintiff who had sexual harassment allegations against him. The court protected the ‘massive injury’ that is caused to the plaintiff in this case.
Also read: Nighat Dad: On Digital Rights, Cyber Laws And #HamaraInternet In Pakistan
The very same Delhi High Court heard recent matter involving anonymous sexual harassment allegations against Subodh Gupta wherein he challenged an Instagram handle for defamation. The case for the anonymous Instagram account included the jurisprudence of the concept named the ‘right to anonymity’, a right which can come under the freedom of speech and expression guaranteed under the Constitution. The right to anonymity encourages a culture of dissent, encourages individuals to anonymously communicate issues that are so sensitive, personal and important in nature that its existence can be potentially hampered if their identity is revealed. #MeToo allegations specifically need the ‘right to anonymity’ especially considering the systematically enforced lack of agency amongst women to complain against their abusers. An empirical study has also found that victims of sexual abuse are much more likely to engage in such communications through accounts that particularly offer anonymity.
The inclusion of this provision will encourage and incentivise social media intermediaries to collect sensitive personal data from the users through government IDs that are submitted for this verification. Not only will this provision increases the risk of data breach of the individuals and but it will give a lot of power to the social media companies that have the resources to build such a verification system.
The Delhi High Court in this case has allowed the Instagram account handle to file in a sealed cover its vakalatnama to maintain its interim anonymity. The Court, while questioning the argument of anonymity said, “How can you hide behind an electronic identity. How can they (plaintiff) be allowed to fight against a ghost… I don’t understand the concept of shadow boxing here.”
‘My right to anonymity versus his right to be forgotten’ is a tricky situation considering the authority will now have to consider what matters more: the freedom of speech and expression of one individual or the reputation of the other. While the Personal Data Protection Bill puts the burden of this decision on the adjudicating officers of the Data Protection Authority, the jurisprudence that arises from the decisions in the High Courts seem to be favouring the right to be forgotten over the right to be anonymous, especially in cases that involve #MeToo allegations. While the Subodh Gupta Case is listed to be heard on the 22nd of January, the existence of anonymous allegations are still threatened by the charges of defamation.
Manufactured ‘Voluntary’ Verification
In yet another way of destroying the right to anonymity or the right to privacy, the Personal Data Protection Bill contains a provision requiring companies to provide the option for users to voluntarily verify their identities. The companies here include social media intermediaries which are primarily used for online interactions and enable users to create, modify, upload, share, disseminate or access information. These intermediaries that have more than a specified number of users, and whose actions are likely to impact electoral democracy, security of the state, public order, sovereignty or integrity of India, are included in this provision and their criteria will be notified by the central government as Significant Data Fiduciaries. Thus, all such notified Social Media Intermediaries are now required to enable users who have registered in their platform or have used their services to voluntarily verify their accounts post which the intermediaries will also mark verified accounts with a specified mark which will be visible to all users.
Now, this would involve the users of these intermediaries to verify their identities with their social media accounts. The inclusion of this provision will encourage and incentivise social media intermediaries to collect sensitive personal data from the users through government IDs that are submitted for this verification. Not only will this provision increase the risk of data breach of the individuals and but it will give a lot of power to the social media companies that have the resources to build such a verification system. The objective of this provision was to help fight misinformation, however, the provision completely ignores the right to anonymity of the users of the internet.
Such verification will no longer be ‘voluntary’ but will be ‘manufactured’ because of social pressure and the mere introduction of the public record which ‘marks’ verified accounts. This is absolutely unfair as though there is a choice given to the users, the choice is controlled by a number of social and legal factors which ultimately harm the users as they will be doomed whether or not they choose to verify their accounts. For example, survivors of sexual abuse will not have a platform for anonymous sexual harassment allegations if the social media accounts have to be verified. There is a chilling effect on the freedom of speech and expression of women if the complainants have to reveal their identities.
Also read: Personal Data Protection Bill 2019: The Rise Of A Surveillance State
At one hand while anonymous accounts are responsible for trolling, they can also benefit by providing agency to victims of sexual harassment cases to communicate their stories. It is definitely a difficult task to draw a line in between or to prioritise one right over the other. However, it is absolutely essential that we understand and realise that the freedom of speech and expression of individuals can never be compromised for unrealistic restrictions put forth by the state, be it through a provision of a Personal Data Protection Bill or a restriction to their right to protest on the streets.
Featured Image Source: Telegraph India
