When it isn’t right to forget

Right to be forgotten in proposed Data Protection Bill poses a threat to press freedom and RTI.

Written by M Sridhar Acharyulu | Updated: September 14, 2018 5:36:14 am

In this photo, Justice BN Srikrishna hands over the report to IT Minister RS Prasad. (PTI)

Justice BN Srikrishna Committee’s draft Personal Data Protection Bill 2018 is introducing a new right — the right to be forgotten, to remove very old, irrelevant and unnecessary information links from social media networks. This concept is prevalent in the European Union (EU) and France, though it was not preferred in the US to the more valuable press freedom. Mario Costeja Gonzalez wanted Googleand a Spanish newspaper, La Vanguardia, to remove a 1998 news item about selling off property to pay off debts. The EU court in 2009 upheld his right not to be reminded of that unpleasant part of his life. The US court did not agree with William James Sidis, a former child prodigy, who did not want The New Yorker to publish about his past.

In India, after a person got a certificate of marriage with a woman’s name who never married him, her father’s plea to annul that marriage certificate was accepted by the Karnataka High Court. A rape victim has a right that her past be forgotten. At the same time, a criminal cannot claim that he has the right to insist that his conviction should not be referred to by the media, the Gujarat High Court said.

As per the Srikrishna Committee’s Bill, an adjudicating officer, who is not a judge but a bureaucrat, will decide. According to Section 27 of the Bill a data principal (for instance, a former minister convicted earlier) has a right to prevent the data processor or data fiduciary (could be a TV, web portal or newspaper) from using such data or information if data disclosure is no longer necessary, the consent to use data has been withdrawn or if data is being used contrary to the provisions of the law.

Section 27(2) says the adjudicating officer can decide on the question of disclosure, and the circumstances in which he thinks such disclosure can override the freedom of speech and the citizen’s right to information. In determining this, the adjudicating officer has to consider five factors listed in subsection (3). They are: (a) the sensitivity of the personal data; (b) the scale of disclosure and the degree of accessibility sought to be restricted or prevented; (c) the role of the data principal in public life; (d) the relevance of the personal data to the public; and (e) the nature of the disclosure and of the activities of the data fiduciary, particularly whether the data fiduciary systematically facilitates access to personal data and whether the activities would be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.

Aggrieved by the order of the adjudicating officer, one can file for a review. If he reaffirms the decision, an appeal can be made to the appellate tribunal. This is fine as far as data protection is concerned. But when the data principal is a public servant (for instance, a former minister), and the data fiduciary is a newspaper or web journal, the freedom to criticise the public personalities for their public policies based on their past statements and activities will be in jeopardy, and a journalist has to wait for the decision of the adjudicating officer to clear her writing about it. A citizen seeking access to such information will be confused whether to approach the CIC or DPA — these adjudicating officers are subordinate to members of the Data Protection Authority.

The right to be forgotten in the Bill might spell a danger to press freedom. The PDP Bill says the rights of the data principal, including the right to be forgotten, are exempted if the purpose of data processing is in the interest of the security of state (Section 42). But, the Bill says, Parliament should pass a law explaining the procedures to determine the interests and to create another authority to decide the disclosure. These rights will not apply to the processing of data in the interests of prevention, detection, investigation and prosecution of any offence or any other contravention of law (Section 43). For that, too, however, Parliament has to make a law to consider and achieve such interests. The Srikrishna Committee did not suggest any draft for these two additional provisions contemplated under Sections 42 and 43. Even for this, Section 4 (right to privacy needs to be respected) and, Section 31 (fair and reasonable processing duties) will apply.

An exemption “for journalistic purpose” is provided in Section 47 saying that where the processing of personal data is necessary for or relevant to a journalistic purpose, the provisions of Chapters II to VIII of the Act shall not apply, except SS 4 and 31. Section 27(2) disappoints. It says Section 27(1) applies only where the journalist demonstrates that the processing is in compliance with any code of ethics issued by — (a) the Press Council of India, or (b) any media self-regulatory organisation. This means the journalist has to prove that privacy was taken care (Section 4) and all safeguards prescribed were complied with (Section 31). Journalistic publication will be dependent upon the opinion of a dealing clerk or adjudicating officer. These are additional pre-publication restrictions on citizens and media which were never contemplated by the Constitution and rejected by the judiciary.

The penalty provisions are severe and costly. Section 74 gives the power to impose a penalty to the adjudicating officer after an inquiry, besides facilitating compensation (Section 75). Failure to adhere to security standards (Section 31) might lead to a penalty of up to Rs 5 crore (Section 69). A penalty of up to Rs 1 crore can be imposed where any person fails to comply with any provision of this Act, for which no separate penalty has been provided in the Act (Section 73). This can easily be used against journalists.

Is this constitutional? Article 19(2) of the Indian Constitution did not provide “privacy” as a ground for imposing restrictions. This Bill fails on constitutional verification by the judiciary, unless “privacy” is added in Article 19(2) by a major amendment to the Constitution. The Data Protection Bill is going to be a serious threat to press freedom and RTI.

The writer, formerly professor of Media Law in NALSAR University of Law, is Central Information Commissioner.