II. Right to erasure
Right to erasure was acknowledged by the European Union’s Court of Justice in the case of Google Spain SL, Google Inc. v Mario Costeja González. In March 2010, Spanish national Costeja González brought a complaint before the country’s Data Protection Agency against La Vanguardia newspaper, Google Spain, and Google Inc. González wanted the newspaper to remove or alter the record of his 1998 attachment and garnishment proceedings so that the information would no longer be available through Internet search engines.Mr. González demanded the data to be deleted as it was no longer vital or pertinent for anyone. The Data Protection Agency disregarded the complaint against the newspaper on the saying that the publication of the article was according to the government orders. It, however, upheld the complaint against Google, finding that Internet search engines are also subject to data protection laws and must take necessary steps to protect personal information.
The European Court of Justice ruled that the European citizens have a right to request that commercial search engines, such as Google, that gather personal information for profit should remove links to private information when asked, provided the information is no longer relevant. 
The Court found that the fundamental right to privacy is greater than the economic interest of the commercial firm and, in some circumstances, the public interest in access to Information.
III. Right to erasure in the general data protection regulation
Article 17 of the General Data Protection Regulation deals with right to erasure. It states that, the person to whom the data is concerned with, have the right to get his or her data deleted without any undue delay. One has to acquire this right from the controller and the controller is
duty bound to delete the data in question.
The right to erasure can be used only in particular circumstances, such as:
- The data is concerned is not required anymore and has lost the zeal for which it was collected;
- The person to whom the data is concerned with has retracted his/her consent for such data; and there are no legal premises for operating that data any further.
- The data in question have been illegally dispensed.
- Person to whom the data is concerned with, does not approve the course of action taken with his/ her data.
- The organization has to delete any individual’s personal data in order to act accordance with the law.
- If particular data belongs to a child and the organization has used this data to the information society services which share the information among member states of the European Union.
But the Right to erasure is not an absolute right; because it may give power to people to rewrite history, as they hold the power to delete the information about themselves. So the GDPR specifies some circumstances in which a person will not be able to exercise their right to erasure.
- If the data is used in accordance with the right to freedom of speech and expression or right to information.
- The data concerned is used in obedience of the law.
- The data is utilized for the public interest.
- If the data is required for medicinal purposes, but it should not fall within the ambit of medical secrecy.
- The data concerned is pivotal for the armed forces.
- The data constitute prime information that succor research relating to science, history, and is in public interest
IV. Right to be forgotten and right to erasure under Personal Data Protection Bill, 2019
After the declaration of right to privacy as a fundamental right in Justice K.S. Puttuswamy Case, by the Supreme Court, India seemed all prepared to recognize ancillary right as well. A draft bill was prepared on the recommendation of Justice B.N. Shrikrishna Report. One of the rights which emerged from the right to privacy was the right to erasure. But in India’s Personal Data Protection Bill, distinction between right to erasure and right to be forgotten has been mentioned. Clause 18 of the 2019 Bill provides the following rights of correction and erasure, namely the right to:
- The user can correct the erroneous data about himself,
- accomplish any fragmented personal data,
- upgrade the obsolete data, and
- get erased personal data which is redundant for the purpose for which it was processed.
Clause 20 of the Personal Data Protection Bill deals with right to be forgotten. This pertains to the right to restrict or prevent the continuing disclosure of personal data where such disclosure:
(a) has served the purpose for which it was collected or is no longer necessary for the purpose;
(b) was made with the consent of the data principal/user under the PDB Bill and such consent has since been withdrawn; or
(c) was made contrary to the provisions of the PDB Bill or any other law for the time being in force.
The underlying difference between right to erasure and right to be forgotten is that a user can only exercise his right to be forgotten if it is imposed by an Adjudicating officer.
Despite the encrypted chats WhatsApp will also be able to share the metadata of the user. Metadata is the overall data of a person’s online activity. This means WhatsApp will be able to share that the time for which the user remains online and any other data except the chats, and once this data is shared the user will not be in a position to delete it. If a person is not provided his right to erasure his/ her data remains with the organization and they can use that data or sell that data to any other company. Since data is considered as fuel in the 21st century, the right to privacy and right to erasure will play an integral role in the upcoming years, the corporate organizations dealing with any persons personal data should deal the data with due diligence as it can harm a person more than any kind of financial loss.
VI. The role of Intermediary in the protection of Right to erasure
According to Section 2(w) of the Information Technology Act, 2000, Intermediary is any person who receives, stores or transmits that record or provides services with respect to that record. The record mentioned in this section is only for the electronic records. According to this definition the social media sites or applications will also come under the purview of this definition. Section
79 of the Information Technology Act, exempts intermediary from the liability in certain cases, which is a considerable hidey hole in the IT Act for the intermediaries.
The case which changed the construct of Section 79 was the arrest and prosecution of Mr. Avnish Bajaj, CEO of Bazee.com (the erstwhile subsidiary of auction portal Bazee.com (the erstwhile subsidiary of auction portal eBay.com) Mr. Bajaj was arrested after a video clip containing objectionable matter was offered for sale on Bazee.com. He was made liable as his website was allegedly publishing the obnoxious content. Mr. Bajaj cried foul for initiation of the action against himself and the intermediary when the hosting platform did not host the actual clip and had no control over the third party that posted the content. The outrage caused by his arrest was voiced by eBay to the then Secretary of State of USA and NASSCOM. This case brought forth issues and concerns relating to intermediaries and in particular discussed the onus of proof lying heavily with the intermediary.To decrease the pressure on intermediary, Section 79 of the Act was amended in 2008 and shifted the burden of proof from the intermediary. The non-obstante clause with which the provision commences, lays an emphatic foundation to exonerate the intermediary from liability for third party information etc. albeit with riders provided under Section 79, sub-sections (2) and (3) of the Act.
Section 79(2) essentially covers cases where the activity undertaken by the intermediary is of a technical, automatic and passive nature. Thus, for section 79(2) to be applicable, intermediaries are to have neither knowledge nor control over the information which is transmitted or stored.
In the case of Shreya Singhal vs. Union of India, the Supreme Court examined Section 79(3) (b) of the Information Technology Act, 2000. This provision abides intermediaries to eliminate or out of action data to certain types of content if the user requests. The Supreme Court stated that it would be difficult for intermediaries to judge the legitimacy of each item render given high volumes of content. It read down the provision to say that content needs to be removed or disabled only if:
- it is done on the basis of the order of a court or government, and
- The order relates to one of the restrictions under Article 19(2) of the Constitution (such as national security and public order).
Therefore, we see that the Supreme Court undermined the right to erasure and put limitation on it, as the right can only be used by any government agency or if it comes under the purview of Article 19(2). The user has given no right to request for deletion under this Section. Complementary to this Section the guidelines for the intermediaries’ were introduced as the Information Technology (Intermediary Guidelines) Rules, 2011.
The Ministry of Electronics and IT has prepared the Information Technology [Intermediaries Guidelines (Amendment) Rules] 2018 (hereinafter referred to as “2018 Rules”) in order to prevent spreading of fake news, curb obscene information on the internet, prevent misuse of social-media platforms and to provide security to the users. The Information Technology (Intermediaries Guidelines) Rules, 2011(hereinafter referred to as ” 2011 Rules)created a lot of heat waves in the digital world with regard to the duties and liabilities of the intermediaries even after safe harbor protection provided under Section 79 of the Information Technology Act,2000(hereinafter referred to as “the Act”). Section 79 of the Act provided that the Intermediaries or any person providing services as a network service provider are exempted from the liabilities in certain instances. In 2018, the government has come out with certain changes in the 2011 Rules and has elaborately explained the liabilities and functions of the Intermediaries and to oversee that the social media platform is not misused.
In order to make the internet a more secure place, the intermediaries have to comply as par the 2018 guidelines and have to inform the user monthly if they have not complied with the restrictions applied by the government then the intermediary will hold the right to cease and stop the access to such account. The government has made it compulsory for the intermediaries to follow such Rules within the time limit prescribed whereas, no such time limit was provided for in 2011 Rules; it will Act as a constant reminder for the users about such policies and regulations and prevent them from committing breach, which can lead to bad repercussions.
The highlights of the Draft Information Technology [Intermediaries Guidelines (Amendment) Rules] 2018 are as follows:
- The Intermediary Guidelines Rules, 2011 require intermediaries to prohibit users from hosting certain content on its platform (e.g. obscene content). The Draft Rules prohibit a new category of information, i.e., content which threatens ‘public health or safety’.
- Intermediaries are obliged to, accommodate any government organization, within 72 hours. Further, they have to facilitate uncovering the originator of the information on their platform.
- Intermediaries must deploy technology-based automated tools to identify and remove public access to unlawful information. Further, intermediaries with more than fifty lakh users must incorporate a company in India.
All these features seem to give the power to the government of what content should be made available on the social media or on any other platform and if it is to be made accessible by the people or not. In this situation it seems to be violation of Article 19(1) (a) which provides the right to freedom of Speech and expression to the citizen of India and violating the right to privacy as well.
But if the content comes under the purview of Article 19(2) which provides the restriction on Article 19(2) then it is another kind of dilemma for the interpreter of the Constitution as it will have to choose between the rights of the citizen and the reasonable restriction to put a boundary on those rights, because public health and safety may not come under the purview of Article 19(2).
Moreover the rules are not about that how the counting of users will be done for any social media platform as they may have less than fifty lakh active users but the downloading of that application might be more than fifty lakh, what would happen in that situation, will the intermediary still have to register itself under the Companies Act, 2013? Such questions are still unanswerable in the guidelines.
VII. Conclusion and Suggestions
- In the circumstances where intermediaries misuse data of a person a colossal amount of fine should be imposed on that company and shall be banned to function in India;
- There should be awareness camps about the data privacy and how a person’s data can be misused, so how it abuses their right to privacy;
- The users of an application should be well aware about how they can exercise their right to erasure or forgotten, and the terms and conditions of the data deletion should be crystalline
- The Personal Data Protection Bill, should be passed promptly, with necessary changes;
- The Bill has expanded the scope of exemptions for the government, and additionally provided that the government may direct data fiduciaries to provide it with any non-personal or anonymised data for better targeting of services.
- In an interdependent and data-abundant world, government access to data is a necessary but insufficient condition to ensure optimal national security outcomes. The digital economy is influenced by a multi-layered ecosystem of domestic laws, commercial choices, bilateral arrangements, and international norms and institutions. In this ecosystem, access to data is one tool to secure our increasingly digital societies. This tool must be complemented by others, such as transparency and accountability frameworks for technology platforms, new bilateral data-sharing agreements, and cooperation with international security organizations. Where access to data is necessary, it would be in the government’s interest to tailor access norms as narrowly as possible, including by providing clear stipulations on the conditions under which data can be accessed, the precise nature of data that can be sought, and the purpose for which it can be accessed.
The Government of India has introduced The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (the “Intermediary Rules”) which has been under criticism because it takes the digital freedom of a person and gives government power of censorship in ‘incognito mode’. Here the responsibility of Government is of paramount nature as they need to give citizens the rights while using social media platforms as well as put limitations on the right and should not use their power to control the digital rights of a person.
CURIA – Documents, http://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageInd ex=0&part=1&mode=DOC&docid=152065&occ=first&dir=&cid=667631 (last visited Mar 8, 2021).
 Global Freedom of Expression | Google Spain SL v. Agencia Española de Protección de Datos – Global Freedom of Expression, https://globalfreedomofexpression.columbia.edu/cases/google-spain-sl-v-agencia-espanola-de-proteccion-de-datos-aepd/ (last visited Feb 5, 2021).
 The Right to Be Forgotten – Under The Personal Data Protection Bill 2018 – Privacy – India, Mondaq https://www.mondaq.com/india/privacy-protection/860598/the-right-to-be-forgotten–under-the-personal-data-protection-bill-2018 (last visited Mar 8, 2021).
 Justice K.S.Puttaswamy(Retd) vs Union Of India on 26 September, 2018, https://indiankanoon.org/doc/1275 17806/ (last visited Mar 8, 2021).
 Right of Erasure – Under The Personal Data Protection Bill 2019 – Privacy – India, https://www.mondaq.co m/india/data-protection/877732/right-of-erasure–under-the-personal-data-protection-bill-2019 (last visited Mar 8, 2021).
 Chaitanya Rohilla vs Union of India Through Secretary, … on 25 January, 2021, https://indiankanoon.org /doc/171200111/ (last visited Mar 8, 2021).
 Avnish Bajaj vs State on 29 May, 2008, https://indiankanoon.org/doc/309722/ (last visited Mar 8, 2021).
 The Conundrum Of Intermediary Liability In The Last Decade – Intellectual Property – India, https://www.mondaq.com/india/trademark/921920/the-conundrum-of-intermediary-liability-in-the-last-decade (last visited Mar 8, 2021).
 Intermediary Liability under the IT Act: Time for an Amendment?, https://www.barandbench.com/columns/i ntermediary-liability-under-the-information-technology-act-time-for-an-amendment (last visited Mar 8, 2021).
 Shreya Singhal vs U.O.I on 24 March, 2015, https://indiankanoon.org/doc/110813550/ (last visited Mar 8, 2021).
 Draft Information Technology [Intermediaries Guidelines (Amendment) Rules] 2018, supra note 1.
 Analysis of the Information Technology [Intermediaries Guidelines (Amendment) Rules] 2018 – Media, Telecoms, IT, Entertainment – India, https://www.mondaq.com/india/social-media/794624/analysis-of-the-information-technology-intermediaries-guidelines-amendment-rules-2018 (last visited Feb 19, 2021).
 Draft Information Technology [Intermediaries Guidelines (Amendment) Rules] 2018, supra note 1.
 Chapter At A Glance, PRSIndia , https://www.prsindia.org/node/840397/chapters-at-a-glance (last visited Mar 8, 2021).
 The Personal Data Protection Bill, 2019: All you need to know, PRSIndia (2019), https://www.prsindia.org/the prsblog/personal-data-protection-bill-2019-all-you-need-know (last visited Mar 8, 2021).
 Akhil Deo and Arjun Jayakumar and Samir Saran and Trisha Ray and Akhil Deo, The personal data protection bill 2019: Recommendations to the Joint Parliamentary Committee, ORF, https://www.orfonline.org /research/the-personal-data-protection-bill-2019-61915/ (last visited Mar 8, 2021).