Right to Erasure and Right to Forget.. Are they same?

In PDPB 2019 (Now withdrawn) there were two sections namely Section 18 and Section 20 which spoke of Right to Correction and Erasure and Right to Forget

Sec 18.Right to correction and erasure. Sec 20.Right to be forgotten.

(1) The data principal shall, where necessary, having regard to the purposes for which personal data is being processed, subject to such conditions and in such manner as may be specified by regulations, have the right to—

(a) the correction of inaccurate or misleading personal data;
(b) the completion of incomplete personal data;
(c) the(***)updationof personal data that is out-of-date; and
(d) the erasure of personal data which is no longer necessary for the purpose for which it was processed.

(1) The data principal shall have the right to restrict or prevent the continuing disclosure or processing of his personal data by a data fiduciary where such disclosure or processing—

(a) has served the purpose for which it was collected or is no longer necessary for the purpose;
(b) was made with the consent of the data principal under section 11 and such consent has since been withdrawn; or
(c) was made contrary to the provisions of this Act or any other law for the time being in force.

In the New DPDPB 2022,

Section 13 states as follows:

Right to correction and erasure of personal data

(1) A Data Principal shall have the right to correction and erasure of her personal data, in accordance with the applicable laws and in such manner as may be prescribed.

(2) A Data Fiduciary shall, upon receiving a request for such correction and erasure from a Data Principal:

(a) correct a Data Principal’s inaccurate or misleading personal data;

(b) complete a Data Principal’s incomplete personal data;

(c) update a Data Principal’s personal data;

(d) erase the personal data of a Data Principal that is no longer necessary for the purpose for which it was processed unless retention is necessary for a legal purpose.

It can be observed that section 13 of  DPDPB 2022  is closely aligned to Section 18 of PDPB 2019.

PDPB made a distinction between “Erasure” and “Stopping disclosure” and associated Right to be forgotten with stopping of disclosure. Though it used the term “Processing” along with “Disclosure” it could be interpreted as “Processing Associated with Disclosure” where as processing associated with Section 18 was related to the purpose for which the information was collected.

In the GDPR however, Article 17 was titled Right to erasure (right to be forgotten) as if the two are same.

Now with DPDPB 2022 using only one section on “Erasure” a doubt does occur whether the definition of erasure should include the “Right to be forgotten” or not.

In the PDPB 2019, Right to be forgotten was dependent on a review by the Adjudicator and the Data Fiduciary was not permitted to implement the right to be forgotten without an intervention of a Judicial authority.

Some of the Court cases in which the “Right to be forgotten” was applied  in India were cases where published judicial verdicts carried the names of accused who were later exonerated and claimed that their names should be removed from published judgement information found in websites like IndiaKanoon.com etc. and the search engines. It could not be said that the Courts wanted the names to be erased from the primary Judgement copy itself which could still carry the identity. If one picked up a Certified Copy and processed it for an appeal, it was perhaps acceptable to use the identification in the Certified Copy.

Both the law and the Court interpretation related to “Disclosure” being different from “Processing” for a given purpose.

Now whether the DPDPB 2022 has to be interpreted with reference to the jurisprudence arising from the Indian Context or from the EU Context is a matter which may pose some difficulty to establish at this point of time. The Courts may have the last word on this unless the rules provide the necessary clarification.

If possible the Government can resolve this problem by adding an explanation to Section 18 as follows.

Explanation: Right to erasure under this section is subject to the Rights of retention and disclosure under any other law for the time being.

Naavi

About Vijayashankar Na

Naavi is a veteran Cyber Law specialist in India and is presently working from Bangalore as an Information Assurance Consultant. Pioneered concepts such as ITA 2008 compliance, Naavi is also the founder of Cyber Law College, a virtual Cyber Law Education institution. He now has been focusing on the projects such as Secure Digital India and Cyber Insurance
This entry was posted in Cyber Law. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.