The Joint Parliamentary Committee (“JPC”) on the Personal Data Protection Bill, 2019 (“PDP Bill”) submitted its report on December 16, 2021 (“JPC Report”) which made several recommendations on aspects of the PDP Bill and data protection rights in general as well. The existing framework does not explicitly contain provisions on the ‘right to be forgotten’, however, it has been upheld by the judiciary at various stages in the recent past. The ‘right to be forgotten’ has not been recognized as a separate legal right, but rather as a facet of the fundamental right to privacy. Recently, the Delhi High Court, through its judgement in the case of Jorawer Singh Mundy v. Union of India, [W.P.(C) 3918/2021], held that, right to be forgotten is in tangent to the right to privacy.

Chapter V: Section 18 of the PDP Bill contains provisions on the right to correction and erasure, whereby the data principal shall have the right to correct or erase personal data subject to conditions and in such manner as may be specified by regulations. Specifically, the JPC examined Section 18(1)(d) in detail, which reads as follows:

“18. Right to correction and erasure - (1) The data principal shall where necessary, having regard to the purposes for which personal data is being processed, subject to such conditions and in such manner as may be specified by regulations, have the right to—

(a) the correction of inaccurate or misleading personal data;

(b) the completion of incomplete personal data;

(c) the updating of personal data that is out-of-date; and

(d) the erasure of personal data which is no longer necessary for the purpose for which it was processed.”

The following observations were made by the JPC on the aforementioned section:

1. Section 18(1)(d), in the opinion of the JPC, seemed to be restricted in scope by stating that the data principal had the right to erasure of personal data but only to the extent to those personal data that no longer serves the purpose for which it was collected. The question raised by JPC was why does the data principal not have the right to erasure of all personal data.
2. The JPC also questioned the possible misuse of qualification provided under Section 18(1)(d) which would allow data fiduciaries to deny requests of erasure of data citing that it is still relevant for processing.

These concerns were addressed by the Ministry of Electronics and Information Technology (“MeitY”) by explaining that deletion of all personal data might not be complied with as it might expose the data fiduciary to receive frivolous requests wherein, the data collected would have to be erased prior to it being processed for the purpose it was collected. The JPC also considered situations where personal data may not be deleted due to legal obligations/ purposes and therefore, opined that in such situations, the data principal can reserve the right to not comply with the request of the data principal for the complete erasure of data.

With respect to qualifications, MeitY responded by iterating that Section 18(1)(d) spells out that the right of the data principal under said section is subject to such conditions and in such manner as may be specified by regulations, which in MeitY’s opinion would also prevent litigations. On the matter of denial of request, MeitY clarified that Section 18(2) and 18(3) provides necessary rights against such denial. The sections read as follows:

“(2) Where the data fiduciary receives a request under sub-section (1), and the data fiduciary does not agree with such correction, completion, updation or erasure having regard to the purposes of processing, such data fiduciary shall provide the data principal with adequate justification in writing for rejecting the application.

(3) Where the data principal is not satisfied with the justification provided by the data fiduciary under sub-section (2), the data principal may require that the data fiduciary take reasonable steps to indicate, alongside the relevant personal data, that the same is disputed by the data principal.”

Therefore, if the data fiduciary rejects the request of the data principal to erase the data, under Section 18(2), the data fiduciary must provide reasons or grounds for rejection in writing to the data principal, who if unsatisfied with the reasons, has the right to appeal against the same as provided under Section 18(3). Furthermore, Section 9(1) of the PDP Bill imposes a restriction on the retention of personal data by the data fiduciary. The section reads as follows:

“9. Restriction on retention of personal data – (1) The data fiduciary shall not retain any personal data beyond the period necessary to satisfy the purpose for which it is processed and shall delete the personal data at the end of the processing”

Hence, there is an obligation on the part of the data fiduciary to delete all personal data collected, after the purpose for which it was collected has been fulfilled, or if the data has been duly processed.

However, in JPC’s view, if the right under Section 18(1)(d) remains unqualified, then there might be situations where the financial costs relating to erasure requests made by data principals might make it unfeasible for the data fiduciary to adhere to. Acknowledging the two contrary positions which came into light during the discussions, JPC believes that the intent behind Section 18(1)(d) seems ambiguous. The seventh recommendation of the JPC is on right to erasure and it emphasizes that the extent to which one can reserve or rather achieve their individual liberty and right to privacy depends on factors such as available technology, cost, practicability etc. Therefore, the JPC has not recommended any amendment of the PDP Bill, but only expressed the hope that Data Protection Authority (“DPA”) which would be established under the PDP Bill, should be able to evolve keeping in mind the international practices and frame regulations which ensure that the rights of the data principal can be exercised in a simple manner while permitting the data fiduciaries to exercise their obligations and duties in a practically feasible manner, while keeping in mind the interests of government with regard to said obligations, as well.

Please find a copy of the JPC Report, here and a copy of the PDP Bill, here.

This update has been contributed by Aishwarya Manjooran (Associate).

Argus Knowledge Centre is now on WhatsApp! Send us a message on +91 8433523504 to receive updates from our Knowledge Centre.