Can individuals be forced to carry the burden of their digital past indefinitely?
Amidst challenges arising from the rapid advancement of technology and the internet, the right to be forgotten emerged as an important subset of informational privacy. Does the right ensure meaningful control over the information on digital and internet platforms? In the absence of a specific law, how has this right evolved through judicial interpretation? See infographics.
The right to be forgotten is the legal and moral claim of individuals to remove their personal information and personal identifiers from internet searches, platforms, and databases. (Image generated using AI) — Dileep P Chandran
As digital technologies shape, mediate, and challenge the identity, dignity and reputation of individuals, the “right to be forgotten” as a component of informational privacy under Article 21 of the Constitution has come into focus. The right to be forgotten allows a person to ask to remove, mask or limit access to personal information available online when it no longer serves a public purpose and continues to harm their privacy or reputation.
In its May 29 judgement, the Delhi High Court directed search engine operators and legal database platforms to de-index, de-list or mask name-based search functionality and personal identifiers. It held that no law allows Google or other search engines to show court records for cases that have ended in an acquittal, discharge, quashing or settlement or private in nature, subject to appropriate conditions. Similar relief has also been granted by the Bombay, Delhi and Kerala High Courts in individual cases.
The Right to be Forgotten, Explained
Such judgements seek to protect individuals from the enduring consequences of digital permanence and affirm that the dignity and reputation of individuals deserve protection even after legal vindication. But is this right to erasure merely a facet of the right to privacy under Article 21? Does it undermine the public’s right to information, freedom of press, and open justice? Or does this signify the evolution of a new generation of digital or fourth-generation human rights?
The fourth-generation human rights
To address the ethical and legal challenges arising from the rapid advancement of technology and the internet, new claims of human rights evolved. While the traditional framework of civil-political, socio-economic, and community rights remains relevant, the digital age demands a new set of rights that are essential to guard the dignity of individuals in cyberspace.
Scholars describe this new set of rights as fourth generation human rights. These include the right to internet access, protection from cyberattacks, deepfakes, algorithm bias, manipulation, and abuses, protection of minors, recognition of intellectual property, the right to privacy and protection of personal data, and rights to anonymity and encryption.
Among these, informational privacy is being considered as an alarming concern in which control over personal data and safeguards from the theft of credentials and misappropriation are guaranteed. Consequently, the right to delete/erasure or the right to be forgotten emerged as an important subset of informational privacy.
What is the right to be forgotten?
The right to be forgotten, also referred to as the right to erasure/delete, is the legal and moral claim of individuals to remove their personal information and personal identifiers from internet searches, platforms, and databases when it no longer serves legitimate public interests or infringes privacy. It also encompasses masking and de-indexing of personal identifiers from databases.
|
Difference between masking and de-indexing |
| Masking means the court removes or replaces a person’s name and other identifying details in a judgment while leaving the judgment itself online.
De-indexing means directing search engines or online platforms not to display a judgment in a simple name-based search. The key difference is that masking requires a direction to the court or its registry, while de-indexing involves directions to private platforms or search engines. |
The removal of digital footprint means a person can ask for their personal data to be deleted when they withdraw their consent. The right ensures an individual’s meaningful control over the information on digital and internet platforms. It enables people to seek relief from enduring harm to one’s reputation associated with outdated allegations or resolved cases.
How Europe shaped the right to be forgotten
The right to be forgotten is recognised abroad, especially in the European Union. In 2010, Spanish national Costeja González brought a complaint before the country’s Data Protection Agency against La Vanguardia newspaper, Google Spain, and Google Inc., demanding the removal of the record of his 1998 attachment and garnishment proceedings from internet search engines.
Garnishment is a judicial proceeding by which a monetary judgement is satisfied against a defendant by ordering a third party to pay a plaintiff the money that the third party owes to the defendant.
González argued that the proceedings concluded years ago should not appear in online searches. The Spanish agency dismissed the complaint against the newspaper, but upheld it against Google. Subsequently, Google Inc. and Google Spain challenged the decision before the National High Court of Spain, which referred the case to the Court of Justice of the European Union (CJEU).
The European Union’s statutory framework
In its landmark judgement, the CJEU ruled that search engine operators have to remove personal information at the request of individuals who do not wish their information to be publicly accessible while acknowledging public interests and exceptions.
The judicial recognition of the right to erasure paved the way for a statutory framework for the same by the European Union – the General Data Protection Regulation (GDPR) in 2016. The framework seeks to safeguard the right to protect personal data and for free movement of personal data within the Union.
The right to erasure (‘right to be forgotten’) guaranteed under Article 17 of GDPR obligates controllers to erase personal data when the data subject demands the removal of personal data that are no longer necessary, where consent has been withdrawn, and processing has no legitimate ground or is unlawful.
However, there are exemptions such as exercising freedom of expression and information, legal obligation to process, public interest in the area of public health, archiving for historical and scientific research purposes, and for the establishment, exercise or defence of legal claims.
Judicial recognition of the right in India
While recognised abroad, India does not yet have a specific law governing the right to be forgotten. It evolved primarily through judicial interpretation. The constitutional roots of the right in India stem from the right to privacy, which is an integral part of Article 21 of the Constitution, which concerns the right to life.
The K S Puttaswamy vs Union of India case (2017), which established the right to privacy as a fundamental right, laid the constitutional foundation of the right to be forgotten in Indian jurisprudence. Although the court did not explicitly establish the right to be forgotten, it recognised the right to exercise control over one’s personal data and existence on the internet. The various courts in India gradually recognised different facets of this right on a case-to-case basis, including:
1. In R. Rajagopal vs State of Tamil Nadu (1994), widely known as the Auto Shankar case, the Supreme Court recognised the right to privacy against unauthorised publication of personal information and affirmed the ‘right to be let alone’ as part of Article 21.
2. In the X vs Registrar General, Karnataka High Court case (2017), the court directed to mask the personal identifier of petitioners such as women and acquitted from digital records.
3. In the Jorawar Singh Mundy vs Union of India case (2021), the Delhi High Court granted interim relief by directing search engines and legal databases to de-index past judgement on a criminal case in which the person had been acquitted.
4. In the Supreme Court Order to Registry (2022), the Supreme Court directed to develop a mechanism to mask personal details of parties of sensitive matrimonial disputes to prevent their perpetual digital exposure.
5. In Laksh Vir Singh Yadav vs Union of India case (2026), the Delhi High Court recognised the right to be forgotten as a facet of informational privacy under Article 21 while emphasising the need to balance privacy with the freedom of expression and transparency.
Limited statutory frameworks
Unlike the European experience, the judicial recognition of the right to be forgotten is yet to be translated into the statutory framework in India. The Information Technology Act, 2000 is silent on the right to erasure. Although the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 establishes a grievance redressal mechanism allowing individuals to request intermediaries, such as search engines and social media platforms, to remove personal information, it did not create a statutory right to be forgotten.
The Digital Personal Data Protection Act, 2023 is India’s first legislative attempt to recognise a limited form of right to be forgotten. Section 12(3) of the Act allows a data principal to request the data fiduciary (an entity entrusted with the responsibility of handling data) for erasure of personal data. It mandates the data fiduciary to remove the same unless its retention is necessary for the specified purpose or for compliance with any law.
Nevertheless, the DPDP Act is silent on judicial records and search engine de-indexing where the right to be forgotten claims most frequently arise. The practical enforceability of the provision is also limited, leaving individuals to depend largely on judicial discretion rather than a clear statutory framework.
Reconciling privacy with public interest
The exercise of the right to be forgotten is often in conflict with other rights and principles such as freedom of speech and expression, freedom of press, people’s right to know, principle of open justice, and broader consideration of public interest. Courts consistently balance the right to privacy under Article 21 with these competing rights and constitutional values.
Most importantly, courts find no antinomy between the right to privacy and the legitimate intentions of the State. Instead, it ensures that the State’s invasion of privacy has to be proportional to the legitimate purposes. Directing internet platforms to mask or de-index personal identifiers rather than the complete removal of judicial records from search engines and media platforms is an important gesture of reconciling privacy with broader public interest.
Challenges and self-regulation
The enforceability of the right to be forgotten may not be ensured without setting reasonable restrictions on press freedom, freedom of speech and expression, and open justice. It also demands utmost care in managing public records and regulation of internet platforms. Courts also undertake the difficult task of determining legitimate public interest on a case-to-case basis. Ensuring technical and platform compliance remains problematic since removed data may still appear on social media and unregulated platforms.
Although courts provide relief in selected cases, the legal framework on the right to be forgotten remains incomplete. Social media platforms and controllers of search engines may adopt stronger self-regulation and periodic review of personal data, particularly regarding the management of personal data in sensitive cases.
The managers of judicial records need to innovate mechanisms to mask and de-index personal identifiers in appropriate cases. Beyond legal jurisprudence and statutory framework, the right to be forgotten demands societal reckoning with the ‘right to be let alone’ in the internet world, and invites ethical reflection on whether individuals should be forced to carry the burden of their digital past indefinitely.
Post read questions
1. The right to be forgotten has emerged as an important facet of informational privacy under Article 21 of the Constitution. Examine its constitutional basis and discuss the challenges involved in balancing it with freedom of speech, the right to information, and the principle of open justice.
2. The emergence of digital technologies has given rise to claims of fourth-generation human rights. Evaluate the concept of fourth-generation human rights in the context of informational privacy and data protection.
3. The European Union has moved from judicial recognition of the right to be forgotten to legislative codification under the General Data Protection Regulation. Compare the European and Indian approaches to the right to be forgotten.
4. Discuss the constitutional and technological challenges in implementing the right to be forgotten in India. Should the right to be forgotten extend to judicial records?
5. Balancing privacy with transparency is one of the greatest ethical challenges of the digital age. Examine in the context of the right to be forgotten.
(Dileep P Chandran is an Assistant Professor at the Department of Political Science in P M Government College, Chalakudy, Kerala.)
Share your thoughts and ideas on UPSC Special articles with ashiya.parveen@indianexpress.com.
Click Here to read the UPSC Essentials magazine for June 2026. Subscribe to our UPSC newsletter and stay updated with the news cues from the past week.
Stay updated with the latest UPSC articles by joining our Telegram channel – IndianExpress UPSC Hub, and follow us on Instagram and X.
Share
