THE RIGHT TO BE FORGOTTEN IN INDIA: BETWEEN PRIVACY, FREE EXPRESSION, AND THE LIMITS OF JUDICIAL SILENCE

I. Introduction

In 2017, a man approached the Karnataka High Court with an unusual plea — he wanted Google to delist search results that linked his name to a criminal case in which he had been acquitted years earlier.² His request was not about erasing the past. It was about reclaiming a future that a persistent digital record had effectively denied him. His case crystallised a question that courts and legislatures across the world are grappling with: does an individual have the right to demand that accurate but outdated information about them be removed from public view?

The right to be forgotten (RTBF) — the right of individuals to have personal information deleted or de-indexed from search engines and online platforms — has emerged as one of the most contested frontiers of digital privacy law. In Europe, it was enshrined by the Court of Justice of the European Union in Google Spain SL v. Agencia Española de Protección de Datos³ and subsequently codified in Article 17 of the General Data Protection Regulation (GDPR).⁴ In India, the right has entered the legal imagination through judicial recognition of privacy as a fundamental right,⁵ yet it remains without a dedicated statutory framework.

This article argues that India urgently needs a legislatively defined RTBF, calibrated to balance individual dignity against freedom of expression and the public interest in historical accuracy. It proceeds in three parts: first, examining the constitutional and emerging judicial basis for the right; second, analysing the tension between privacy and free expression; and third, recommending a structured legislative framework.

II. Constitutional Foundations and Judicial Recognition

The constitutional basis for the RTBF in India rests primarily upon Article 21 of the Constitution, which protects the right to life and personal liberty. In the landmark nine-judge bench decision in Justice K.S. Puttaswamy (Retd.) v. Union of India⁶ (the Privacy Judgment), the Supreme Court unanimously held that privacy is a fundamental right, intrinsic to life and liberty. Justice D.Y. Chandrachud, writing separately, expressly acknowledged that “the right to privacy includes the right to control the dissemination of personal information.”⁷

Building on Puttaswamy, High Courts have begun to recognise the RTBF incrementally. In Jorawar Singh Mundy v. Union of India⁸ the Delhi High Court directed Indian Kanoon, a legal database, to de-index a judgment that appeared as a top Google result against the petitioner — an American citizen whose visa prospects were being jeopardised by its online visibility. The court accepted, in principle, that the right to privacy could justify the removal of digitally accessible court judgments where their continued circulation caused disproportionate harm to the individual.

Similarly, the Orissa High Court in Subhranshu Rout @ Gugul v. State of Odisha⁹ observed that the right to be forgotten flows naturally from the right to live with dignity under Article 21, and directed that the identity of a rape survivor not be disclosed in any online publication of the judgment.

These decisions, while significant, are narrow and fact-specific. They demonstrate judicial sympathy for the underlying right but stop well short of establishing a comprehensive, enforceable RTBF doctrine. The absence of legislation means that outcomes depend on judicial discretion, with no consistent standards for when deletion or de-indexing is warranted.

III. The Collision Between Privacy and Freedom of Expression

The most formidable objection to a robust RTBF is its potential to conflict with the freedom of speech and expression guaranteed by Article 19(1)(a) of the Constitution, and by extension, the public’s right to access accurate information. This tension is not merely theoretical — it goes to the heart of how democratic societies resolve competing constitutional values.

Critics argue that allowing individuals to demand the removal of truthful information creates a tool for censorship by private interest.¹⁰ A corporate offender could erase news reports of a conviction. A public official could suppress records of misconduct. A debtor could de-index court orders against them. These are not imagined risks — the GDPR experience in Europe has produced thousands of such removal requests from politicians, convicted criminals, and public figures seeking to manage their reputations.¹¹

Yet the case for the RTBF is equally compelling when considered from the perspective of ordinary individuals rather than powerful actors. In the pre-internet age, a minor criminal conviction, a youthful indiscretion, or an embarrassing civil dispute would fade naturally from public memory. The digital age has abolished that merciful forgetting — search engines have become permanent, accessible archives that can define a person’s identity decades after an event has lost any legitimate public interest.¹²

The resolution lies not in abolishing the RTBF, but in structuring it with clear limiting principles. The European model under Article 17 of the GDPR is instructive: the right to erasure does not apply where the data is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defence of legal claims.¹³ A similar framework — adapted to India’s constitutional context and the realities of its information ecosystem — would permit courts and regulators to weigh privacy against expression in a structured, principled manner rather than on an ad hoc basis.

It is submitted that the right distinction is not between privacy and expression as absolute values, but between private individuals and public figures, and between historically significant information and data whose public utility has been exhausted by the passage of time. A politician’s voting record, a corporation’s regulatory violations, or a convicted person’s undischarged sentence retain public interest value. An acquitted person’s criminal history, a private individual’s decade-old financial difficulty, or a victim’s identity in a sensitive case do not.

IV. The Need for Legislation: Gaps and the Way Forward

Building on the limiting principles set out above, the legislative gap in India becomes clearer when set against existing law. India has taken steps toward data protection legislation: the Digital Personal Data Protection Act, 2023 (DPDPA)¹⁴ represents a significant step forward, introducing the right of data principals to seek erasure of personal data under Section 12(c). However, the DPDPA’s erasure right is limited in scope — it applies primarily to data processed by data fiduciaries within the defined framework of consent-based processing, and it does not expressly address the de-indexing of publicly available information from search engines, nor does it create a cause of action against online intermediaries for failure to delist search results.

The gap is significant. The most practically disruptive digital privacy harms — the persistence of acquittal records, victim identities, and outdated personal information in search engine results — fall outside the DPDPA’s immediate reach. Addressing these harms requires supplementary rules under the DPDPA or a dedicated statutory framework that:

1. Establishes a clear standard — proportionality between the public interest in retained access and the individual’s privacy interest — for adjudicating de-indexing requests;
2. Creates a designated adjudicatory mechanism — whether through the Data Protection Board established under the DPDPA or a dedicated ombudsman — with time-bound resolution;
3. Carves out explicit exceptions for matters of public record, journalistic investigation, academic research, and ongoing legal proceedings; and
4. Imposes obligations on search engines and online platforms — which are the primary vectors of digital memory — rather than restricting the right only against the original publishers of information.

Without such a framework, the RTBF in India will remain a constitutional aspiration enforced only through expensive, slow, and inconsistent High Court litigation — a remedy available, in practice, only to those with the resources to pursue it.

V. Conclusion

The right to be forgotten is not a right to rewrite history. It is, at its core, a right to contextual integrity — the principle that information should flow in a manner consistent with the norms of the context in which it was originally shared.¹⁵ A person acquitted of a crime should not carry that accusation indefinitely in the top results of a Google search. A victim’s identity should not be permanently discoverable online. A private individual’s decade-old debt dispute should not define their professional life.

India’s courts have recognised that privacy underpins human dignity, and that digital permanence is a threat to both. But judicial recognition, however principled, cannot substitute for legislation. The Digital Personal Data Protection Act, 2023 is a foundation — but the right to be forgotten demands a more specific and robust superstructure.

This article has argued that India must enact a structured, legislatively defined RTBF that calibrates privacy against expression through clear limiting principles, creates an accessible adjudicatory mechanism, and extends its reach to search engines and online intermediaries. In the absence of such a framework, India risks allowing the permanence of the internet to become a permanent injury — one that its courts have diagnosed but its legislature has yet to treat.

Note(S):

1. BBA.LL.B (Hons.), 3rd year student, Maharishi Markandeshwar Deemed To Be University, Mullana-Ambala, Haryana, India.

2. Vasunathan v. Registrar General, High Court of Karnataka, W.P. No. 62038 of 2016 (Karnataka HC, 2017).

3. Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González, Case C-131/12, [2014] ECLI:EU:C:2014:317 (Court of Justice of the European Union, 13 May 2014).

4. General Data Protection Regulation (EU) 2016/679, Art. 17 (‘Right to Erasure (Right to be Forgotten)’), 2016 O.J. (L 119) 1.

5. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (Supreme Court of India).

6. Ibid.

7. Ibid., per Chandrachud J., at para. 169.

8. Jorawar Singh Mundy v. Union of India & Ors., W.P.(C) 3918/2021 (Delhi HC, decided April 26, 2021).

9. Subhranshu Rout @ Gugul v. State of Odisha, BLAPL No. 4592 of 2020 (Orissa HC, decided November 23, 2020).

10. Jeffrey Rosen, ‘The Right to Be Forgotten’ (2012) 64 Stanford Law Review Online 88, 89.

11. Article 29 Data Protection Working Party, Guidelines on the Implementation of the CJEU Judgment on Google Spain v. AEPD (WP225, 26 November 2014) 22.

12. Viktor Mayer-Schönberger, Delete: The Virtue of Forgetting in the Digital Age (Princeton University Press 2009) 13.

13. GDPR (n 4) Art. 17(3).

14. Digital Personal Data Protection Act 2023 (Act 22 of 2023), s. 12(c).

15. Helen Nissenbaum, Privacy in Context: Technology, Policy, and the Integrity of Social Life (Stanford University Press 2010) 127.

Bibliography

A. Primary Sources

Legislation

Constitution of India 1950, Art. 19(1)(a), Art. 21.

Digital Personal Data Protection Act 2023 (Act 22 of 2023).

General Data Protection Regulation (EU) 2016/679, 2016 O.J. (L 119) 1.

Cases

Google Spain SL, Google Inc. v. Agencia Española de Protección de Datos (AEPD), Mario Costeja González, Case C-131/12, [2014] ECLI:EU:C:2014:317 (CJEU).

Jorawar Singh Mundy v. Union of India & Ors., W.P.(C) 3918/2021 (Delhi High Court, 26 April 2021).

Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (Supreme Court of India).

Subhranshu Rout @ Gugul v. State of Odisha, BLAPL No. 4592 of 2020 (Orissa High Court, 23 November 2020).

Vasunathan v. Registrar General, High Court of Karnataka, W.P. No. 62038 of 2016 (Karnataka High Court, 2017).

B. Secondary Sources

Books

Mayer-Schönberger V, Delete: The Virtue of Forgetting in the Digital Age (Princeton University Press 2009).

Nissenbaum H, Privacy in Context: Technology, Policy, and the Integrity of Social Life (Stanford University Press 2010).

Journal Articles

Rosen J, ‘The Right to Be Forgotten’ (2012) 64 Stanford Law Review Online 88.

Reports and Guidelines

Article 29 Data Protection Working Party, ‘Guidelines on the Implementation of the CJEU Judgment on “Google Spain and Inc v. AEPD and Mario Costeja González” C-131/12’ (WP225, 26 November 2014).