Abstract
The right to be forgotten has emerged as a claim to erase or de-index personal information from digital platforms and search results. K.S. Puttaswamy v. Union of India located informational privacy within Article 21 but did not define the scope of this particular remedy. The Digital Personal Data Protection Act, 2023 adds a statutory right of erasure, yet leaves unresolved how it should interact with open justice, public records and freedom of expression.
This article traces the judicial development of the right to be forgotten in India and the tension between privacy and freedom of expression. It asks whether the Digital Personal Data Protection Act, 2023 supplies a coherent framework for the digital age, and compares the Indian position with Article 17 of the European Union's General Data Protection Regulation.
Keywords
Right to Be Forgotten, Digital Personal Data Protection Act (DPDP Act), Freedom of expression, Fundamental right, Data Erasure
Introduction
Digital memory has made personal information persistent, searchable and difficult to escape. That reality raises a central question: when may an individual require information about the past to be erased or de-indexed? The European Union recognised this interest in Google Spain SL v. AEPD (2014) and later codified erasure rights in Article 17 of the GDPR. Indian constitutional law contains no equally explicit provision, although Puttaswamy placed informational privacy within Article 21.
v. Union of India, a 9 judge bench for the first time unanimously recognised the right to privacy as a Fundamental Right under Article 21 of Constitution. Justice D. Y. Chandrachud, in his concurring opinion stated that privacy includes 'information self-determination' which means the capacity of individual to control the terms on which the information about them is disseminated. Justice Kaul further stated that the right to be forgotten may be read as a dimension of the right to live with dignity. Despite the judiciary casting light upon the foundational moment the Indian Legal landscape on Right to Be Forgotten (RTBF) remains uncertain.
Several High Courts have passed contradictory conclusions if RTBF can be enforced against search engines, online platforms and digital repositories of court records. There is a partial codification of the right of erasure through legislation's intervention through the DPDP Act, 2023, however it leaves an ambit open for critical questions of horizontal applicability, competing public interest and adjudicatory mechanism. This article critically analyses these issues and an attempt to provide recommendations for a framework that will bring a resolution.
Judicial Evolution of the Right to Be Forgotten in India
Early Recognition
The Gujarat High Court in 2015 dealt with one of the earliest judicial engagement with RTBF. The petitioner, in this case who was acquitted of criminal charges was facing damage of reputation and profit and in his professional life. Since the court's judgment was still publicly accessible through the online legal databases. The court was sympathetic to the petitioner however, stated that judicial records are part of public domain and any restriction on the publication will constitute as interfering with the principles of open justice. The decision was marked as the beginning of the concept of RTBF into Indian Judicial System and which drew a tension between digital permanence and personal rehabilitation.
A Cautious Endorsement
The Delhi High Court adopted a more receptive approach in Jorawar Singh Mundy (2021). After an acquitted petitioner showed that online access to the old narcotics case was damaging his employment prospects, the Court directed search engines to de-index the judgment on an interim basis. The order recognised that continued digital visibility can impose a punishment after acquittal.
In this decision the court had de-indexed the judgment from third party platform rather than erasure from official repositories. Thus though its limited in scope it still represents a significant step in operationalizing the right to be forgotten (RTBF).
Expanding the Frontier: SK v. Union of India, 2023
In the above mentioned case is criminal in nature wherein, the petitioner was acquitted of criminal charges. Due to several persistent online news reports the petitioner faced severe professional and reputational harm about his link to the alleged offence. The Delhi High Court recognised the right to privacy highlighting that it additionally includes, the right to move on, free from unnecessary reputational harm and directed Google and media outlets to remove the prejudicial content and anonymise the petitioner's name from court records. There has been a major shift in the recognition of the RTBF however this was done with no clear and consistent set of rules.
Indian courts have long protected open justice and free expression, but they have also begun directing private platforms to de-index old cases where continued visibility serves little public purpose and causes disproportionate private harm. The challenge is to articulate a consistent test.
The DPDP Act, 2023: a Statutory Right of Erasure
Statutory Framework
DPDP Act, 2023 is the first Indian comprehensive enactment of personal protection on legislation. Section 12 empowers the individuals with the ultimate control over how companies handle their data digitally. This Act defines terms such as Data Principal and Data Fiduciary, which means the person/s whose personal data is being used and the companies or organization that collects and manages the person/s information respectively. Section 12 provides with 4 major rights:
Correction - fixing any detail/s that are wrong or misleading;
Completion - fill in missing or blank details;
Updating - device or physical address; and Erasure - to wipe your data completely out of their system once their original requirement has been fulfilled for which it was obtained in the first instance.
Gaps and Limitations
The DPDP Act ensures an erasure framework however, there are several practicality lacunas for the enforcement of RTBF. In the Mundy case it targeted on intermediary platform rather than search engines thus, upholding the legislation decision the DPDP Act was formulated which has also not directly addressed the search engines liability for indexing content hosted on third party platforms. These issues were addressed by GDPR but not in the DPDP Act, resulting in the inconsistent patterns. For adjudicating complaints the Act has established a Data Protection Board and the powers conferred to adjudicate RTBF disputes are related to fundamental rights.
There is a potential source of confusion about the board's jurisdiction and the constitutional courts under Article 226 and 32, which may lead to overlapping or inconsistent outcomes for similar factual situations.
The DPDP Act has blanket exclusions rather than a proportionality calibrated exception in the GDPR. As article 17(3) of GDPR explicitly mentions exceptions to write, archiving in public interest, to include freedom of expression and legal claims, however these are not mentioned in the DPDP Act in such minute detail where it fails to address the search engines indexing problem entirely or suggesting an scrutiny of data processing. The DPDP Act does not encourage or specify suo motu jurisdiction and is solely a complaint driven Data Protection Body as suggested in section 21 of the DPDP Act.
This structure places the entire burden upon the already vulnerable individual/persons unlike the European adjudicating structure. Under article 51 of the GDPR's supervisory authority model, national independent authorities have the power for a suo motu jurisdiction.
The Competing Pull of Freedom of Speech and Expression
The Supreme Court in Press Council of India v. Union of India affirmed the media's right to report on court proceedings as a facet of this freedom, however it must be highlighted that this resulted in a significant increase of tension between Art 19(1)(a) and the Right To Be Forgotten. Therefore, to delete true and legal information which is accessible digitally requires careful constitutional calibration by keeping a careful balance between an individual's right to privacy and the right to access legal information.
The right to privacy also has constraints wherein a person is not entitled to it if they act in the public figure capacity or in a public space, they cannot use 'privacy' as an escape for the truth to be published as held in the case of Rajagopal v. Tamil Nadu, 1994. Right to erase information shall be granted only when the data available is out-dated, inaccurate or disproportionately prejudicial but considerably more difficult to sustain against accurate reporting of matters of genuine public concern.
A structured proportionality analysis is therefore indispensable. Court must ask the following Whether the privacy interference is sufficiently serious to warrant intervention?
Whether the public interest served by continued digital access is legitimate?
Whether the harm to the individual is proportionate to that interest.
Courts have begun to gesture towards this standard, but have yet to articulate it with the doctrinal rigour that the competing constitutional interests demand.
Comparative Perspective: Lessons from the European Experience
EU offers instructive lessons for India to develop its jurisprudence on RTBF, as EU's jurisprudence on RTBF is over a decade old now. EU believes RTBF is a legal power, through which individuals can demand the search engines and websites to remove their personal information from the internet. This is backed by a structured and very clear framework unlike the Indian laws which remains highly vague and unstructured. The Google Spain case laid the foundation to this right. The CJEU ruled that the search engines like google are responsible for the data they index.
It was held that any information about a private citizen is irrelevant, outdated or excessive the search engines must remove any such link from its search results. Further it stated that even if the original website had a perfectly legal right to publish the story, the individual's privacy must be a priority. This ruling was then turned into an official law under the Article 17 of the GDPR which is a default setting of RTBF wherein the person's privacy has an automated priority unless a company can prove a specific exception applies, laying down strict exceptions and limitations.
However, direct transplantation of the EU framework into India faces constitutional complications that are absent in the European context. The GDPR operates within a rights regime where privacy is codified as an absolute fundamental right under Article 8 of the EU Charter of Fundamental Rights, with no competing fundamental right of open justice built into the same constitutional text. The GDPR's default in favour of erasure unless a company proves an exception would, if transplanted uncritically, risk running afoul of the constitutional guarantee of press freedom recognised in Indian Express Newspapers v. Union of India..
The DPDP Act recognises erasure in general terms but does not provide a structured test for de-indexing or the right to be forgotten. Courts must therefore balance privacy, open justice and public access without sufficient statutory guidance. India should borrow from the European Union not a fixed hierarchy of rights, but a clearer procedural architecture.
This includes specifically, the obligation under Article 17(2) of the GDPR requiring data controllers who have made data public to take reasonable steps to inform other controllers of the erasure request, and the recognition in Google Spain that search engines are independent data controllers liable for the harm their indexing causes. These two elements notice obligations and search engine liability are conspicuously absent from the DPDP Act and could be introduced through subordinate legislation under Section 40 without requiring a full statutory amendment.
Conclusion
The right to be forgotten in India stands at an important jurisprudential crossroads. The constitutional foundation laid in Puttaswamy, and the growing but inconsistent judicial recognition through successive High Court decisions and the partial legislative codification of the DPDP Act, collectively marks the substantial progress. Yet the absence of a coherent, unified framework leads to individuals seeking to vindicate their RTBF claims must navigate a fragmented legal landscape whose outcomes remain unpredictable. This leads to confusions and chaos among not just the tech companies but also the citizens and legal fraternity.
The three recommendations emerge from this analysis are:
The DPDP Act should be amended to the extent that ensure the right of erasure to search engines as independent data controllers following the model established in the Google Spain and the GDPR.
To form a structured proportionality framework which shall require adjudicators to assess the severity of the privacy harm against the nature and strength of the competing public interest which should be formally codified, either through legislative amendment or an authoritative Supreme Court ruling.
The jurisdiction of Data Protection Board should be expressly extended to RTBF disputes involving media publications and search engines, with provisions governing its interface with the constitutional courts to avoid jurisdictional uncertainty.
Digital memory is not neutral: it can define, confine and distort identity long after an event has lost public relevance. India therefore needs a coherent and proportionate framework for erasure and de-indexing. The right to be forgotten is not merely a matter of data administration; it is an increasingly important dimension of fundamental rights in the information age.
Primary materials
Key primary materials: Digital Personal Data Protection Act, 2023 and subordinate legislation; Ministry of Electronics and Information Technology.