In PDPB 2019 (Now withdrawn) there were two sections namely Section 18 and Section 20 which spoke of Right to Correction and Erasure and Right to Forget
| Sec 18.Right to correction and erasure. | Sec 20.Right to be forgotten. |
|
(1) The data principal shall, where necessary, having regard to the purposes for which personal data is being processed, subject to such conditions and in such manner as may be specified by regulations, have the right to— (a) the correction of inaccurate or misleading personal data; |
(1) The data principal shall have the right to restrict or prevent the continuing disclosure or processing of his personal data by a data fiduciary where such disclosure or processing— (a) has served the purpose for which it was collected or is no longer necessary for the purpose; |
In the New DPDPB 2022,
Section 13 states as follows:
Right to correction and erasure of personal data
(1) A Data Principal shall have the right to correction and erasure of her personal data, in accordance with the applicable laws and in such manner as may be prescribed.
(2) A Data Fiduciary shall, upon receiving a request for such correction and erasure from a Data Principal:
(a) correct a Data Principal’s inaccurate or misleading personal data;
(b) complete a Data Principal’s incomplete personal data;
(c) update a Data Principal’s personal data;
(d) erase the personal data of a Data Principal that is no longer necessary for the purpose for which it was processed unless retention is necessary for a legal purpose.
It can be observed that section 13 of DPDPB 2022 is closely aligned to Section 18 of PDPB 2019.
PDPB made a distinction between “Erasure” and “Stopping disclosure” and associated Right to be forgotten with stopping of disclosure. Though it used the term “Processing” along with “Disclosure” it could be interpreted as “Processing Associated with Disclosure” where as processing associated with Section 18 was related to the purpose for which the information was collected.
In the GDPR however, Article 17 was titled Right to erasure (right to be forgotten) as if the two are same.
Now with DPDPB 2022 using only one section on “Erasure” a doubt does occur whether the definition of erasure should include the “Right to be forgotten” or not.
In the PDPB 2019, Right to be forgotten was dependent on a review by the Adjudicator and the Data Fiduciary was not permitted to implement the right to be forgotten without an intervention of a Judicial authority.
Some of the Court cases in which the “Right to be forgotten” was applied in India were cases where published judicial verdicts carried the names of accused who were later exonerated and claimed that their names should be removed from published judgement information found in websites like IndiaKanoon.com etc. and the search engines. It could not be said that the Courts wanted the names to be erased from the primary Judgement copy itself which could still carry the identity. If one picked up a Certified Copy and processed it for an appeal, it was perhaps acceptable to use the identification in the Certified Copy.
Both the law and the Court interpretation related to “Disclosure” being different from “Processing” for a given purpose.
Now whether the DPDPB 2022 has to be interpreted with reference to the jurisprudence arising from the Indian Context or from the EU Context is a matter which may pose some difficulty to establish at this point of time. The Courts may have the last word on this unless the rules provide the necessary clarification.
If possible the Government can resolve this problem by adding an explanation to Section 18 as follows.
Explanation: Right to erasure under this section is subject to the Rights of retention and disclosure under any other law for the time being.
Naavi
