UPSC PRELIMS 2020: ‘Right to be Forgotten’

rights of data subjects under the GDPR

Topic: ‘Right to be Forgotten’

Topic in Syllabus: Indian Governance

rights of data subjects under the GDPR

Context:

The European Union’s highest court ruled that an online privacy rule known as the ‘right to be forgotten’ under European law would not apply beyond the borders of EU member states.

The ruling comes as an important victory for Google, and lies down that the online privacy law cannot be used to regulate the internet in countries such as India, which are outside the European Union.

About Right to Forgotten:

  • The right to be forgotten empowers individuals to ask organisations to delete their personal data.
  • It is provided by the EU’s General Data Protection Regulation (GDPR), a law passed by the 28-member bloc in 2018.
  • The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.
  • Personal data means, any information relating to an identified or identifiable natural person (“data subject”) and “controller means the natural or legal person, public authority, agency or any other body which… determines the purposes and means of the processing of personal data.
  • After a search engine company as if Google gets requests under the privacy law to get information deleted, it first reviews and then removes links on country-specific sites within the European Union.
  • Google has so far received more than 8.45 lakh requests to take down 33 lakh internet links, and 45% of the latter have been delisted.

Recent Ruling:

  • Petitioner required that Google go beyond its practice of region-specific delinking, and ordered the search engine company to delete links from its global database.
  • Google refused to abide by the order, arguing that following the same would impede the free flow of information across the world.

Internet Rights in EU:

Right to Forgotten in India:

The draft bill framed by the Justice B. N. Srikrishna Committee has made an explicit reference to the right to be forgotten. The draft bill makes it clear that the right to be forgotten is not an absolute right and provides for certain exemptions.

Section 27 provides an individual with a right to restrict or prevent continuing disclosure of personal data.

The bill provides that an adjudicating officer think such disclosure can override the freedom of speech and the citizen’s right to information. The adjudicating officer would decide based on:

  • Sensitivity of the personal data.
  • Scale of disclosure and the degree of accessibility sought to be restricted or prevented.
  • Role of the data principal in public life.
  • Relevance of the personal data to the public.
  • Nature of the disclosure and of the activities of the data fiduciary.

 

Cases not allowing the Right to Forgotten:

  • Right to be forgotten, are exempted if the purpose of data processing is in the interest of the security of state.
  • It asks parliament to frame a law wherein the processing of data is in the interests of prevention detection and prosecution of any of other contravention of law

 

Sample Question:

Conditions for cloud penetration and development in developing and emerging countries

A.  IT infrastructure maturity and business culture

B.  Legislation and regulation base to fight cybercrimes

C.  Acceptance of and compliance to international security standards

D.  Potential number of cloud users

Answer: C