Introduction
The “Right to Be Forgotten” (RTBF) is a privacy right that allows individuals to request the deletion of their personal data when it is no longer necessary, has been unlawfully processed, or when the data subject withdraws consent. This right has gained prominence globally, particularly under the European Union’s General Data Protection Regulation (GDPR), and is increasingly influencing privacy laws worldwide—including India’s evolving digital data protection landscape. The RTBF has profound implications for how organizations develop data retention policies and for how consumers exercise control over their digital identities.
1. Definition and Origin of the Right to Be Forgotten
The concept originated from the 2014 judgment by the European Court of Justice in Google Spain SL v. Agencia Española de Protección de Datos, where it was ruled that individuals can request search engines to delist results that are “inadequate, irrelevant or excessive.” Under Article 17 of the GDPR, the RTBF became a legally recognized right. It mandates that organizations erase personal data in specific circumstances unless retaining it serves legal, public interest, or archival purposes.
2. RTBF under Indian Law
In India, the RTBF is not explicitly codified but has been acknowledged by various High Courts and under the proposed Digital Personal Data Protection Act (DPDPA), 2023. While the DPDPA does not use the term “right to be forgotten,” it grants individuals the right to request erasure of personal data that is no longer necessary, was processed based on withdrawn consent, or was processed unlawfully. Indian courts have also recognized this right in certain cases, balancing it against freedom of expression and public interest.
3. Impact on Data Retention Policies
The RTBF necessitates a shift from indefinite data storage to purpose-driven data retention.
a. Purpose Limitation
Organizations must now define clear purposes for data collection and cannot retain data longer than necessary. Retention policies must align with lawful grounds such as contract performance, compliance, or public interest, and be reassessed regularly.
b. Erasure Protocols
Companies must implement procedures to securely delete data upon request or when data no longer serves its original purpose. This includes deletion from backups, third-party vendors, and cloud storage.
c. Data Minimization
The RTBF reinforces the principle of data minimization—collect only what is needed and for as long as needed. This leads to better data hygiene, reduced storage costs, and lowered breach risks.
d. Recordkeeping and Audit Trails
Retention policies now need to document how and when data is deleted, provide justifications for retention beyond the consumer’s request, and ensure auditability in case of legal scrutiny.
4. Enhancing Consumer Control
The RTBF strengthens consumer rights and digital autonomy in several ways:
a. Empowerment
Consumers can proactively manage their digital footprint, especially after a change in life circumstances (e.g., outdated legal records, embarrassing photos, or old social media content).
b. Redressal for Harm
Victims of harassment, data leaks, or misinformation can seek removal of sensitive or misleading content that may damage their reputation or mental well-being.
c. Control Over Consent
The right to erase data ties into the consumer’s right to withdraw consent. Once consent is revoked, companies must stop processing and erase related data, restoring control to the user.
d. Balance with Public Interest
Consumer control is not absolute. The right must be balanced against rights of others, freedom of the press, and public interest (e.g., criminal records, news reporting). Ethical and legal frameworks help mediate such conflicts.
5. Challenges in Implementation
While powerful, the RTBF poses certain practical and ethical challenges:
a. Technical Complexity
Deleting data from distributed systems, legacy backups, or third-party processors is complex and may not guarantee full erasure.
b. Conflicts with Free Speech
Erasing publicly available information (e.g., news archives) can clash with freedom of expression and the public’s right to know.
c. Verification and Abuse
Companies must verify the identity and legitimacy of deletion requests to prevent misuse. A fraudulent erasure request could hide criminal activity or defame others.
d. Global Discrepancies
While GDPR enforces RTBF across the EU, enforcement outside Europe depends on local laws. In India, the lack of a full-fledged RTBF law creates inconsistency in its application.
6. Legal and Business Implications
Organizations that ignore RTBF obligations face legal risks and reputational damage.
a. Penalties
Under GDPR, non-compliance can lead to fines up to €20 million or 4% of global turnover. DPDPA also empowers India’s Data Protection Board to impose significant penalties.
b. Trust and Transparency
Companies that provide clear options for data deletion build consumer trust and loyalty. Transparent policies on how data is retained and erased are now a competitive advantage.
c. Vendor Contracts and Compliance
Organizations must ensure that third-party vendors, processors, and affiliates also respect deletion requests. Data Processing Agreements (DPAs) should include RTBF clauses.
7. Sector-Specific Impacts
The RTBF affects different industries in unique ways:
a. Social Media and Search Engines
Platforms like Facebook, Twitter, and Google are prime targets for RTBF requests. They must balance individual privacy with content integrity and platform responsibility.
b. Financial Services
Banks and NBFCs must retain data for regulatory compliance but may have to delete marketing data or outdated consent-based information upon request.
c. E-commerce and Retail
Customer profiles, browsing history, and personalization data may need deletion on request, affecting targeted marketing strategies.
d. Healthcare and Education
Sensitive data like health records or academic performance require special protection. Erasure must not compromise medical or academic integrity.
8. Future Outlook
India’s RTBF framework is likely to mature through judicial interpretations and rules under the DPDPA. Consumers will increasingly demand privacy-enhancing features, including self-service data erasure tools and clearer consent mechanisms. Technological solutions like automated data lifecycle management, privacy dashboards, and PETs (Privacy Enhancing Technologies) will support compliance and consumer empowerment.
Conclusion
The Right to Be Forgotten significantly reshapes how businesses approach data retention and how consumers exert control over their personal data. It compels organizations to adopt purpose-driven, ethical, and transparent data practices while giving individuals a powerful tool to manage their digital identity. As privacy laws evolve in India and globally, the RTBF will remain a cornerstone of data protection, ensuring that the right to move on, correct the record, or erase the past is respected in the digital world.
