Right to be Forgotten an integral part of an Individual’s Right to Privacy: Odisha HC
The Odisha HC headed by Justice SK Panigrahi found that “the information in the public domain is like toothpaste, once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away.”, thereby confirming the verdicts of several other High Courts by holding that an individual has a right to expect intermediaries (such as Facebook, Twitter) to remove sensitive information relating to them online in case of Subhranshu Rout @ Gugul vs State of Odisha,BLAPL No.4592 OF 2020.  This comes three years after the landmark K.S. Puttuswamy v Union of India judgment, which upheld that the Right to Privacy is a fundamental right under Article 21 of the Indian Constitution. The present case deals with intimate pictures of a woman being published online. The victim claimed she had been in love with the accused for around a year before the incident occurred. Both parties were from the same village and had also been classmates. Having learned one day that the victim was alone at home, the accused visited and raped her. While doing so, he also captured pictures and a video of the incident without her consent. After the act, he threatened to kill her and then upload her pictures onto the internet if she told anyone. The woman informed her parents of the incident and in response, the accused created a fake Facebook profile in her name and uploaded their intimate pictures. The police were apathetic to the victim’s plight, and it was only after some time that they convinced the accused to delete the fake profile and its content. The counsel for the petitioner submits that there was no crime as the accused and the victim were rational adults in a consensual relationship. He also claimed that he was going to marry her unconditionally. In addition, the counsel also argued that as he was a Diploma holder seeking employment, the detention was going to hinder his prospects. The counsel for the State contended that in addition to the intercourse being non-consensual, the accused also photographed the incident and threatened the woman with it. It was clear from her statement under S.161 CrPC that she had been subjected to blackmail and threats after the rape. While there is a serious penal deterrent for such heinous crimes, there exist no mechanisms to ensure that the victim’s right to be forgotten is fulfilled. In the present case, it was only after the police visited the accused did he take down the content. There was no mechanism whereby the victim could directly approach the intermediary (Facebook) and ask them to take it down. It further noted that “Though the statute prescribes penal action for the accused for such crimes, the rights of the victim, especially, her right to privacy which is intricately linked to her right to get deleted in so far as those objectionable photos have been left unresolved. There is a widespread and seemingly consensual convergence towards an adoption and enshrinement of the right to get deleted or forgotten but hardly any effort has been undertaken in India till recently, towards adoption of such a right, despite such an issue has inexorably posed in the technology dominated world. Presently, there is no statute in India which provides for the right to be forgotten/getting the photos erased from the server of the social media platforms permanently.” The Court recognized the intrinsic significance of one’s right to be forgotten in the larger context of our fundamental Right to Privacy. “It is their right to enforce the right to be forgotten as a right in rem. Capturing the images and videos with consent of the woman cannot justify the misuse of such content once the relation between the victim and accused gets strained as it happened in the present case. If the right to be forgotten is not recognized in matters like the present one, any accused will surreptitiously outrage the modesty of the woman and misuse the same in the cyber space unhindered. Undoubtedly, such an act will be contrary to the larger interest of the protection of the woman against exploitation and blackmailing, as has happened in the present case. The sloganeering of “betibachao” and women safety concerns will be trampled.”  
HIGH COURT OF ORISSA: CUTTACK BLAPL No.4592 OF 2020 In the matter of an application under Section 439 Criminal Procedure Code 1973) Subhranshu Rout @ Gugul Petitioner … Opposite Party State of Odisha For petitioner : For the Opp. Party: Shri Manoj Kumar Mohanty Additional Standing Counsel Shri Bibhuti Bhusan Behera and S. Bahadur Advocates THE HONOURABLE SHRI JUSTICE S.K. PANIGRAHI Date of Hearing: 20.10.2020 Date of judgment: 23.11.2020 1. The present application is preferred under Section 439 of the Criminal Procedure Code 1973 in connection with G.R. Case No.171 of 2020 arising out of Rasol P.S. Case No.62 of 2020 pending in the Court of learned SDJM Hindol registered for the commission of offences punishable under Sections 376 292 465 469 509 of IPC read with Sections 66 66(C) 67 67(A) of the I.T. Act 2000. 2.The factual conspectus as set forth in the F.I.R. is that on 03.05.2020 one Rupali Amanta D o. Raghunath Amanta of Village Giridharprasad P.S. Rasol District Dhenkanal alleged that for a period of about one year she had been in love with the petitioner. Both the petitioner as well as the accused were village mates and classmates. On the day of last Kartika Puja the petitioner went to the house of the informant and taking advantage of the fact that she was alone he committed rape on the informant and recorded the gruesome episode in his mobile phone. When the informant warned petitioner that she would apprise her parents of the brutal incident and its serious undertones the petitioner threatened to kill her as well as to make viral the said photos videos. Further she has alleged that since 10.11.2019 the petitioner had maintained physical intimacy with the informant. Upon the informant narrating the incident to her parents the petitioner opened a fake Facebook ID in the name of the informant and uploaded all the objectionable photos using the said ID in order to further traumatize her. Though the informant disclosed the said fact to the IIC Rasol P.S.by way of a written complaint on 27.04.2020 the Police has failed to take any step on the said complaint and thereby portrayed unsoundness of the police system. After much difficulty finally the informant could get the present FIR lodged. 3.Learned counsel for the petitioner submits that both the victim and accused are adults and hence they know the best what is right or wrong. He submits that the petitioner is an ITI Diploma holder who is in search of a job and hence his detention will spoil his career. He further stated that the petitioner is interested to marry the victim girl unconditionally. 4.Per contra learned counsel for the State submits that the petitioner had not only forcibly committed sexual intercourse with the victim girl but he had also deviously recorded the intimate sojourn and uploaded the same on a fake Facebook account created by the Petitioner in the name of the victim girl. The allegation is very serious since there is specific allegation of forced sexual intercourse by the accused petitioner against the will of the victim. Statement recorded under Section 161 of Cr. P.C. of the victim girl also clearly divulges the fact that the petitioner has been threatening and blackmailing her stating that if she discloses these facts to anybody he would eliminate her and also make her intimate scenes viral on the social media. He further submits that the investigation of the case has not yet been completed. The entire allegation in the FIR as well as the statement recorded under Section 161 of Cr.P.C read with other materials available on records are a pointer to the fact that the crime committed by the petitioner are serious in nature. The victim has been at the receiving end of an unabated mental torture due to the blackmailing tactics used by the petitioner. 5. While examining the pages of the case records prima facie it appears that the petitioner has uploaded the said photos videos on a social media platform i.e. Facebook and with the intervention of the police after some days he deleted the said objectionable contents from the Facebook. In fact the information in the public domain is like toothpaste once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away. Under the Indian Criminal Justice system a strong penal action is prescribed against the accused for such heinous crime but there is no mechanism available with respect to the right of the victim to get the objectionable photographs deleted from the server of the Facebook. The different types of harassment threats and assaults that frighten citizens in regard to their online presence pose serious concerns for citizens. There is an unprecedented escalation of such insensitive behavior on the social media platforms and the victim like the present one could not get those photos deleted permanently from server of such social media platforms like facebook. Though the statute prescribes penal action for the accused for such crimes the rights of the victim especially her right to privacy which is intricately linked to her right to get deleted in so far as those objectionable photos have been left unresolved. There is a widespread and seemingly enshrinement of the right to get deleted or forgotten but hardly any effort has been undertaken in India till recently towards adoption of such a right despite such an issue has inexorably posed in the technology dominated world. Presently there is no statute in India which provides for the right to be forgotten getting the photos erased from the server of the social media platforms permanently. The legal possibilities of being forgotten on line or off line cries for a widespread debate. It is also an undeniable fact that the implementation of right to be forgotten is a thorny issue in terms of practicality and technological nuances. In fact it cries for a clear cut demarcation of institutional boundaries and redressal of many delicate issues which hitherto remain unaddressed in Indian jurisdiction. The dynamics of hyper connectivity abundance pervasiveness and accessibility of communication network have redefined the memory and the prescriptive mandate to include in the technological contours is of pressing 6. However this issue has attracted sufficient attention overseas in the European Union leading to framing of General Data Protection Regulationwhich governs the manner in which personal data can be collected processed and erased. The aspect of right to be forgotten appears in Recitals 65 and 66 and in Article 17 of the GDPR1 which vests in the victim a right to erasure of such material after due diligence by the controller expeditiously. In addition to this Article 5 of the GDPR requires data controllers to take every reasonable step to ensure that data which is inaccurate is 1The data subject shall have the right to obtain from the controller regarding the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay. “erased or rectified without delay”. Every single time it cannot be expected that the victim shall approach the court to get the inaccurate data or information erased which is within the control of data controllers such as Facebook or Twitter or any other social media platforms. 7. A similar issue was raised in England in the Wales High Courts in NT1 and NT2 Vs. Google LLC2which ordered Google to delist search results referring to the spent conviction of a businessman known as NT2 but rejected a similar request made by a second businessman NT1. The claimants therein had been convicted of certain criminal offences many years ago who complained that search results returned by Google featured links to third party reports about the convictions in the past which were either inaccurate and or old irrelevant and of no public interest or otherwise an interference with their rights. The reliefs sought in those cases were based on the prevailing data protection laws and English Law principles affording protection in case of tortuous misuse of private information. The Court rejected NT1’s request based on the fact that he was a public figure with a 2[2018] EWHC 799and another4 the European Court of Justice ruled that the European citizens have a right to request that commercial search engines such as Google that gather personal information for profit should remove links to private information when asked provided the information is no longer relevant. The Court in that case ruled that the fundamental right to privacy is greater than the economic interest of the commercial firm and in some circumstances the same would even override the public interest in access to information. The European Court in the aforesaid case had affirmed the judgment of the Spanish Data 3Para 223 of Judgment 4C 131 12[2014] QB 1022 Protection Agency SPDA)in a case which concerned a proceeding relating to bankruptcy which had ordered removal of material from the offending website by recognizing a qualified right to be forgotten and held that an individual was entitled to have Google de list information of which he complained. 9.Recently the European Court of Justice in Google LLC vs. CNIL5 ruled that “currently there is no obligation under EU law for a search engine operator to carry out such a de referencing on all the versions of its search engine.” The Court also said that the search operator must “take sufficiently effective measures” to prevent searches for differenced information from within the EU. The court specifically held as under: “69. That regulatory framework thus provides the national supervisory authorities with the instruments and mechanisms necessary to reconcile a data subject’s rights to privacy and the protection of personal data with the interest of the whole public throughout the Member States in accessing the information in question and accordingly to be able to adopt where appropriate a de referencing decision which covers all searches conducted from the territory of the Union on the basis of that data subject’s name. 5Case C 507 17 C 314 12 70. In addition it is for the search engine operator to take if necessary sufficiently effective measures to ensure the effective protection of the data subject’s fundamental rights. Those measures must themselves meet all the legal requirements and have the effect of preventing or at the very least seriously discouraging internet users in the Member States from gaining access to the links in question using a search conducted on the basis of that data subject’s name see by analogy judgments of 27 March 2014 UPC Telekabel Wien EU:C:2014:192 paragraph 62 and of 15 September 2016 McFadden C 484 14 EU:C:2016:689 paragraph 96). 71. It is for the referring court to ascertain whether also having regard to the recent changes made to its search engine as set out in paragraph 42 above the measures adopted or proposed by Google meet those 72. Lastly it should be emphasized that while as noted in paragraph 64 above EU law does not currently require that the de referencing granted concern all versions of the search engine in question it also does not prohibit such a practice. Accordingly a supervisory or judicial authority of a Member State remains competent to weigh up in the light of national standards of protection of fundamental rights see judgments of 26 February 2013 Åkerberg Fransson C 617 10 EU:C:2013:105 paragraph 29 and of 26 February 2013 Melloni C 399 11 EU:C:2013:107 paragraph 60) a data subject’s right to privacy and the protection of personal data concerning him or her on the one hand and the right to freedom of information on the other and after weighing those rights against each other to order where appropriate the operator of that search engine to carry out a de referencing concerning all versions of that search engine. 73. In the light of all of the foregoing the answer to that on a proper the questions that effect 11 those provisions construction of Article 12(b) and subparagraph of the first paragraph of Article 14 of Directive 95 46 and Article 17(1) of Regulation 2016 679 where a search engine operator grants a request for de referencing pursuant operator is not required to carry out that de referencing on all versions of its search engine but on the versions of that search engine corresponding to all the Member States using where necessary measures requirements which while meeting effectively prevent or at the very least seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access via the list of results displayed following that search to the links which are the subject of that request.” 10.Presently there is no statue which recognizes right to be forgotten but it is in sync with the right to privacy which was hailed by the Apex Court as an integral part of Article 21in K.S. Puttaswamy 10 SCC 1 privacy of an individual. The relevant paras of the judgment are as under: R. Essential nature of privacy 297. What then does privacy postulate Privacy postulates the reservation of a private space for the individual described as the right to be let alone. The concept is founded on the autonomy of the individual. The ability of an individual to make choices lies at the core of the human personality. The notion of privacy enables the individual to assert and control the human element which from the personality of the individual. The inviolable nature of the human personality is manifested in the ability to make decisions on matters intimate to human life. The autonomy of the individual is associated over matters which can be kept private. These are concerns over which there is a legitimate expectation of privacy. The body and the mind are inseparable elements of the human personality. The integrity of the body and the sanctity of the mind can exist on the foundation that each individual possesses an inalienable ability and right to preserve a private space in which the human personality can develop. Without the ability to make choices the inviolability of the personality would be in doubt. Recognizing a zone of privacy is but an acknowledgment that each individual must be the course of development of personality. Hence privacy is a postulate of human dignity itself. Thoughts and behavioural patterns which are intimate to an individual are entitled to a zone of privacy where one is free of social expectations. In that zone of privacy an individual is not judged by others. Privacy enables each individual to take crucial decisions which find expression in the human personality. It enables thoughts expressions ideas ideologies preferences and choices to chart and pursue their beliefs to preserve against societal demands of homogeneity. Privacy is an intrinsic recognition of heterogeneity of the right of the individual to be different and to stand against the tide of conformity in creating a zone of solitude. Privacy protects the individual from the searching glare of publicity in matters which are personal to his or her life. Privacy attaches to the person and not to the place where it is associated. Privacy constitutes the foundation of all liberty because it is in privacy that the individual can decide how liberty is best Individual dignity and privacy are inextricably linked in a pattern woven out of a thread of diversity into the fabric of a plural culture. 402. “Privacy” is “[t]he condition or state of being free from public attention to intrusion into or interference with one s acts or decisions” Black s Law Dictionary3783 . The right to be in this condition has been described as “the right to be let alone” . What seems to be essential to privacy is the power to seclude oneself and keep others from intruding it in any way. These intrusions may be physical or visual and may take any of several including peeping over one s shoulder to eavesdropping directly or instruments devices or technological aids. 479. Both the learned Attorney General and Shri Sundaram next argued that the right to privacy is so vague and amorphous a concept that it cannot be held to be a fundamental right. This again need not detain us. Mere absence of a definition which would encompass the many contours of the right to privacy need not deter us from recognising privacy interests when we see them. As this judgment will presently show these interests are broadly classified into to marry rights as interests pertaining to the physical realm and interests pertaining to the mind. As case law both in the US and India show this concept has travelled far from the mere right to be let alone to recognition of a large number of privacy interests which apart from privacy of one s home and protection unreasonable searches and seizures have been extended to protecting an individual s interests in making vital personal choices such as the right to abort a foetus rights of same sex couples—including the right to procreation contraception general family relationships child bearing education data protection etc. This argument again need not detain us any further and is 560. The most popular meaning of “right to privacy” is—“the right to be let alone”. In Gobind v. State of M.P.2 SCC 148 : 1975 SCC 468] K.K. Mathew J. noticed multiple facets of this right and then gave a rule of caution while examining the contours of such right on case to case basis. 636. Thus the European Union Regulation of 2016 Regulation No. 2016 679 of the European Parliament and of the Council of 27 4 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive No. 95 46 EC General Data Protection Regulation).] has recognised what has been termed as “the right to be forgotten”. This does not mean that all aspects of earlier existence are to be obliterated as some may have a social ramification. If we were to recognise a similar right it would only mean that an individual who is no longer desirous of his personal data to be processed or stored should be able to remove it from the system where the personal data information is no longer 15 is necessary necessary relevant or is incorrect and serves no legitimate interest. Such a right cannot be exercised exercising the right of freedom of expression and information for compliance with legal obligations for the performance of a task carried out in public interest on the grounds of public interest in the area of public health for archiving purposes in the public interest scientific or historical research purposes or statistical purposes or for the establishment exercise or defence of legal claims. Such justifications would be valid in all cases of breach of privacy including breaches of data privacy.” The Hon’ble Apex court while considering the issue of a conflict between the right to privacy of one person and the right to a healthy life of another person has held that in such situations the right that would advance public interest would take precedence.” emphasis supplied) 11.The Hon’ble Supreme Court of India in the case of Mr ‘X’ v. Hospital ‘Z’7 has recognized an individual’s right to privacy as a facet Article 21 of the Constitution of India. It was also pertinently held that the right which would advance the public morality or public interest would alone be enforced through the process of court for the reason that moral considerations cannot be kept at bay and the Judges are not expected to sit as mute structures of clay in the halls known as the courtroom but have to be sensitive “in the sense that they 7(1998) 8 SCC 296 must keep their fingers firmly upon the pulse of the accepted morality of the day.” 12. The Ld. Single Judge of High Court of Karnataka in the case of Vasunathan v. The Registrar General High Court of Karnataka8 has acknowledged the right to be forgotten keeping in line with the trend in the Western countries where it is followed as a matter of rule. The High Court of Delhi in its recent judgment in Zulfiqar Ahman Khan vs. Quintillion Business Media Pvt. Ltd. and Ors9 has also recognized the “right to be forgotten” and Right to be left alone as an integral to part of individual’s existence. The Karnataka High Court in Name Redacted} vs. The Registrar General10 recognized “Right to be forgotten” explicitly though in a limited sense. The petitioner’s request to remove his daughter’s name from a judgment involving claims of marriage and forgery was upheld by the Court. It held that recognizing right to be forgotten would parallel initiatives by ‘western countries’ which uphold this right when ‘sensitive’ cases concerning the ‘modesty’ or ‘reputation’ of people especially women were the High Court of Gujarat However 82017 SCC OnLine Kar 424 92019(175) DRJ 660 10Writ PetitionNos.36554 36555 2017decided on 4th January 2018 in Dharamraj 17 Bhanushankar Dave v s State of Gujarat & Ors. 11 in a case involving the interpretation of the rules of the High Court has taken a contrary and narrow approach. 13. The Information TechnologyRules 2011 India’s first legal framework recognized the need to protect the privacy of personal data but it failed to capture the issue of the “Right to be forgotten”. The Hon’ble Supreme Court of India in the case of K.S. Puttaswamy v. Union of India held that purpose limitation is integral for executive projects involving data collection unless prior permission is provided third parties cannot be provided access to personal data.12This principle is embodied in S.5 of the yet to be implemented Personal Data Protection Bill 2019. Purpose Limitation enhances transparency in data processing and helps examine the proportionality of the mechanism used to collect data for a specific purpose. Moreover it prevents the emergence of permanent data ‘architectures’ based on interlinking databases without consent. In the present case the proposition of purpose limitation is not applicable as the 12See Para 166 of K.S. Puttaswamy Judgment question of seeking consent does not arise at all. No person much less a woman would want to create and display gray shades of her character. In most of the cases like the present one the women are the victims. It is their right to enforce the right to be forgotten as a right in rem. Capturing the images and videos with consent of the woman cannot justify the misuse of such content once the relation between the victim and accused gets strained as it happened in the present case. If the right to be forgotten is not recognized in matters like the present one any accused will surreptitiously outrage the modesty of the woman and misuse the same in the cyber space unhindered. Undoubtedly such an act will be contrary to the larger interest of the protection of the woman against exploitation and blackmailing as has happened in the present case. The sloganeering of “betibachao” and women safety concerns will be trampled. 14. Section 27 of the draft Personal Data Protection Bill 2018 contains the right to be forgotten. Under Section 27 a data principal has the right to prevent continuing disclosure of personal data by a data fiduciary. The aforesaid provision which falls under Chapter VIof the Bill distinctly carves out the "right to be forgotten" in no uncertain terms. In terms of this provision every data principal shall have the right to restrict or prevent continuing disclosure of personal databy any data fiduciary if such disclosure meets any one of the following three conditions namely if the disclosure of personal i) has served the purpose for which it was made or is no longer necessary or was made on the basis of the data principal s consent and such consent has since been withdrawn or was made contrary to the provisions of the bill or any other law in force. In addition to this Section 10 of the Bill provides that a data fiduciary shall retain personal data only as long as may be reasonably necessary to satisfy the purpose for which it is processed. Further it imposes an obligation on every data fiduciary to undertake periodic reviews in order to determine whether it is necessary to retain the personal data in its possession. If it is not necessary for personal data to be retained by a data fiduciary then such personal data must be deleted in a manner as may be specified. 20 15. In the instant case prima facie it appears that the petitioner has not only committed forcible sexual intercourse with the victim girl but has also deviously recorded the intimate sojourn and uploaded the same on a fake Facebook account. Statement recorded under Section 161 of Cr. P.C. of the victim girl is also clearly in sync with FIR version. Considering the heinousness of the crime the petitioner does not deserve any consideration for bail at this stage. However this Court is of the view that Indian Criminal Justice system is more of a sentence oriented system with little emphasis on the disgorgement of victim’s loss and suffering although the impact of crime on the victim may vary significantly for person(s) and case(s) for some the impact of crime is short and intense for others the impact is long lasting. Regardless many victims find the criminal justice system complex confusing and intimidating. Many do not know where to turn for help. As in the instant case the rights of the victim to get those uploaded photos videos erased from Facebook server still remain unaddressed for want of appropriate legislation. However allowing such objectionable photos and videos to remain on a social media platform without the consent of a woman is a direct affront on a woman’s modesty and more importantly her right to privacy. In such cases either the victim herself or the prosecution may if so advised seek appropriate orders to protect the victim’s fundamental right to privacy by seeking appropriate orders to have such offensive posts erased from the public platform irrespective of the ongoing criminal process. 16. In view of the foregoing discussion of the case this Court is not inclined to enlarge the petitioner on bail. Hence the present bail application stands dismissed. S.K.PANIGRAHI J.] Orissa High Court Cuttack The 23rd day of November 2020 AKK AKP 