The Personal Data Protection Bill, 2019 (‘The Bill’) was introduced by the Ministry of Electronics and Information Technology and was passed by the cabinet on the 11th of December 2019. The objective of the Bill is to set a framework for the processing of personal data. The Bill promises to give power to the digital citizens of this country by giving them ‘their rights’ which includes, among others, the right to consent and the right to access.
Analysis of free speech and expression in the Bill requires an examination of provisions relating to the right to erasure, right to be forgotten, and provisions concerning the social media verification. This article seeks to analyse these provisions through the lens of the right to anonymity, ensuring that this lens would look at free speech and expression of the Personal Data Protection Bill from a gendered perspective.
What Is Right To Erasure?
Even after the individual has provided their data to organizations (data fiduciaries who are involved with determining purpose and means of processing of personal data), they will have the right to erase the data once the purpose of the processing, by the fiduciaries, is complete. The Bill allows data principals (the person to whom the data belongs) to approach the adjudicating officer of the Data Protection Authority (an independent regulatory body) to restrict or delete personal content which is no longer necessary for the purpose for which it was processed. The eligibility to claim this particular right will be provided by subsequent regulations of the Bill.
While the 2018 version of the Bill did not have the provision pertaining to ‘right to erasure’, the 2019 version of the Bill introduced this right, along with the right to correction. The data fiduciaries may refuse such requests but only through reasonable steps. The inclusion of this provision is quite useful for the data principal. However, this right should also have been incorporated with the right to be forgotten under the Bill. The current provisions pertaining to the right to be forgotten only deals with the non disclosure of data and not the erasure of data. The separation between the two has lead to various questions pertaining to the balancing of various rights like: does the right to be forgotten, without the inclusion of the right to erasure, pose a threat to the freedom of speech and expression of individuals?
While the Personal Data Protection Bill puts the burden of this decision on the adjudicating officers of the Data Protection Authority, the jurisprudence that arises from the decisions in the High Courts seem to be favouring the right to be forgotten over the right to be anonymous, especially in cases that involve #MeToo Allegations.
My Right to Anonymity vs. His right to be forgotten
The jurisprudence of the ‘right to be forgotten’ developed from the Google v Spain case wherein the European Court of Justice delivered the judgment in favour of the petitioner who had approached the court for the removal of a newspaper article (of himself) from Google, as he found the same to be no longer relevant. The Court directed Google to remove “inadequate, irrelevant or no longer relevant” data from its search results whenever its user requests so. The ruling came to be known as the ‘right to be forgotten’ case and this principle has been adopted by various data protection laws across jurisdictions. While the article about him was concerning an announcement regarding a forced sale of his property, the question arises as to whether the court would have held the same ruling had the nature of the petitioners offences been more severe?
In India, the right to be forgotten comes under Section 20 of the Personal Data Protection Bill wherein it is clearly stated that the data principal