Law Web: Orissa HC recognizes Right To Be Forgotten: Allowing Videos/Photos Of Rape Victims To Remain On Social Media Is Violative Of Their Fundamental Right To Privacy

The Hon’ble Supreme

Court of India in the case of K.S. Puttaswamy v. Union of

India (supra) held that purpose limitation is integral for

executive projects involving data collection – unless prior

permission is provided, third parties cannot be provided access

to personal data.See Para 166 of K.S. Puttaswamy Judgment

This principle is embodied in S.5 of the yet to-

be-implemented Personal Data Protection Bill, 2019.

Purpose Limitation enhances transparency in data processing

and helps examine the proportionality of the mechanism used

to collect data for a specific purpose. Moreover, it prevents the

emergence of permanent data ‘architectures’ based on

interlinking databases without consent. In the present case

the proposition of purpose limitation is not applicable as the

question of seeking consent does not arise at all. No person

much less a woman would want to create and display gray

shades of her character. In most of the cases, like the present

one, the women are the victims. It is their right to enforce the

right to be forgotten as a right in rem. Capturing the images

and videos with consent of the woman cannot justify the

misuse of such content once the relation between the victim

and accused gets strained as it happened in the present case.

If the right to be forgotten is not recognized in matters like the

present one, any accused will surreptitiously outrage the

modesty of the woman and misuse the same in the cyber

space unhindered. Undoubtedly, such an act will be contrary

to the larger interest of the protection of the woman against

exploitation and blackmailing, as has happened in the present

case. The sloganeering of “betibachao” and women safety

concerns will be trampled.

14. Section 27 of the draft Personal Data Protection Bill, 2018

contains the right to be forgotten. Under Section 27, a data

principal (an individual) has the right to prevent continuing

disclosure of personal data by a data fiduciary. The aforesaid

provision which falls under Chapter VI (Data Principal Rights)

of the Bill, distinctly carves out the "right to be forgotten" in no

uncertain terms. In terms of this provision, every data

principal shall have the right to restrict or prevent continuing

disclosure of personal data (relating to such data principal) by

any data fiduciary if such disclosure meets any one of the

following three conditions, namely if the disclosure of personal

data:

(i) has served the purpose for which it was made or is no

longer necessary; or (ii) was made on the basis of the data

principal's consent and such consent has since been

withdrawn; or (iii) was made contrary to the provisions of the

bill or any other law in force.

In addition to this, Section 10 of the Bill provides that a

data fiduciary shall retain personal data only as long as may

be reasonably necessary to satisfy the purpose for which it is

processed. Further, it imposes an obligation on every data

fiduciary to undertake periodic reviews in order to determine

whether it is necessary to retain the personal data in its

possession. If it is not necessary for personal data to be

retained by a data fiduciary, then such personal data must be

deleted in a manner as may be specified.

15. In the instant case, prima facie, it appears that the

petitioner has not only committed forcible sexual intercourse

with the victim girl, but has also deviously recorded the

intimate sojourn and uploaded the same on a fake Facebook

account. Statement recorded under Section 161 of Cr. P.C. of

the victim girl is also clearly in sync with FIR version.

Considering the heinousness of the crime, the petitioner does

not deserve any consideration for bail at this stage. However,

this Court is of the view that Indian Criminal Justice system is

more of a sentence oriented system with little emphasis on

the disgorgement of victim’s loss and suffering, although the

impact of crime on the victim may vary significantly for

person(s) and case(s)-- for some the impact of crime is short

and intense, for others the impact is long-lasting. Regardless,

many victims find the criminal justice system complex,

confusing and intimidating. Many do not know where to turn

for help. As in the instant case, the rights of the victim to get

those uploaded photos/videos erased from Facebook server

still remain unaddressed for want of appropriate legislation.

However, allowing such objectionable photos and videos to

remain on a social media platform, without the consent of a

woman, is a direct affront on a woman’s modesty and, more

importantly, her right to privacy. In such cases, either the

victim herself or the prosecution may, if so advised, seek

appropriate orders to protect the victim’s fundamental right to

privacy, by seeking appropriate orders to have such offensive

posts erased from the public platform, irrespective of the

ongoing criminal process.

HIGH COURT OF ORISSA: CUTTACK

BLAPL No.4592 OF 2020

(In the matter of an application under Section 439,

Criminal Procedure Code, 1973)

Subhranshu Rout @ Gugul Vs State of Odisha

PRESENT

SHRI JUSTICE S.K. PANIGRAHI

Date of judgment: 23.11.2020

1. The present application is preferred under Section 439 of

the Criminal Procedure Code, 1973 in connection with G.R.

Case No.171 of 2020 arising out of Rasol P.S. Case No.62 of

2020, pending in the Court of learned SDJM, Hindol registered

for the commission of offences punishable under Sections 376,

292, 465, 469, 509 of IPC read with Sections 66, 66(C), 67,

67(A) of the I.T. Act, 2000.

AFR

2.The factual conspectus as set forth in the F.I.R. is that on

03.05.2020 one Rupali Amanta, D/o. Raghunath Amanta of

Village-Giridharprasad, P.S. Rasol, District-Dhenkanal alleged

that for a period of about one year, she had been in love with

the petitioner. Both the petitioner as well as the accused were

village mates and classmates. On the day of last Kartika Puja,

the petitioner went to the house of the informant and taking

advantage of the fact that she was alone he committed rape on

the informant and recorded the gruesome episode in his

mobile phone. When the informant warned petitioner that she

would apprise her parents of the brutal incident and its

serious undertones, the petitioner threatened to kill her as

well as to make viral the said photos/videos. Further, she has

alleged that since 10.11.2019, the petitioner had maintained

physical intimacy with the informant. Upon the informant

narrating the incident to her parents, the petitioner opened a

fake Facebook ID in the name of the informant and uploaded

all the objectionable photos using the said ID in order to

further traumatize her. Though the informant disclosed the

said fact to the IIC, Rasol P.S.by way of a written complaint on

27.04.2020, the Police has failed to take any step on the said

complaint and thereby portrayed unsoundness of the police

system. After much difficulty, finally, the informant could get

the present FIR lodged.

3.Learned counsel for the petitioner submits that both the

victim and accused are adults and hence they know the best

what is right or wrong. He submits that the petitioner is an ITI

Diploma holder who is in search of a job and hence his

detention will spoil his career. He further stated that the

petitioner is interested to marry the victim girl unconditionally.

4.Per contra, learned counsel for the State submits that the

petitioner had not only forcibly committed sexual intercourse

with the victim girl, but he had also deviously recorded the

intimate sojourn and uploaded the same on a fake Facebook

account created by the Petitioner in the name of the victim

girl. The allegation is very serious since there is specific

allegation of forced sexual intercourse by the accused/

petitioner against the will of the victim. Statement recorded

under Section 161 of Cr. P.C. of the victim girl also clearly

divulges the fact that the petitioner has been threatening and

blackmailing her stating that if she discloses these facts to

anybody, he would eliminate her and also make her intimate

scenes viral on the social media. He further submits that the

investigation of the case has not yet been completed. The

entire allegation in the FIR as well as the statement recorded

under Section 161 of Cr.P.C read with other materials

available on records are a pointer to the fact that the crime

committed by the petitioner are serious in nature. The victim

has been at the receiving end of an unabated mental torture

due to the blackmailing tactics used by the petitioner.

5. While examining the pages of the case records, prima facie,

it appears that the petitioner has uploaded the said

photos/videos on a social media platform i.e. Facebook and

with the intervention of the police, after some days, he deleted

the said objectionable contents from the Facebook. In fact, the

information in the public domain is like toothpaste, once it is

out of the tube one can’t get it back in and once the

information is in the public domain it will never go away.

Under the Indian Criminal Justice system a strong penal

action is prescribed against the accused for such heinous

crime but there is no mechanism available with respect to the

right of the victim to get the objectionable photographs deleted

from the server of the Facebook. The different types of

harassment, threats and assaults that frighten citizens in

regard to their online presence pose serious concerns for

citizens. There is an unprecedented escalation of such

insensitive behavior on the social media platforms and the

victim like the present one could not get those photos deleted

permanently from server of such social media platforms like

facebook. Though the statute prescribes penal action for the

accused for such crimes, the rights of the victim, especially,

her right to privacy which is intricately linked to her right to

get deleted in so far as those objectionable photos have been

left unresolved. There is a widespread and seemingly

consensual convergence towards an adoption and

enshrinement of the right to get deleted or forgotten but hardly

any effort has been undertaken in India till recently, towards

adoption of such a right, despite such an issue has inexorably

posed in the technology dominated world. Presently, there is

no statute in India which provides for the right to be

forgotten/getting the photos erased from the server of the

social media platforms permanently. The legal possibilities of

being forgotten on line or off line cries for a widespread debate.

It is also an undeniable fact that the implementation of right

to be forgotten is a thorny issue in terms of practicality and

technological nuances. In fact, it cries for a clear cut

demarcation of institutional boundaries and redressal of many

delicate issues which hitherto remain unaddressed in Indian

jurisdiction. The dynamics of hyper connectivity- the

abundance, pervasiveness and accessibility of communication

network have redefined the memory and the prescriptive

mandate to include in the technological contours is of pressing

importance.

6. However, this instant issue has attracted sufficient

attention overseas in the European Union leading to framing of

General Data Protection Regulation (GDPR) which governs the

manner in which personal data can be collected, processed

and erased. The aspect of right to be forgotten appears in

Recitals 65 and 66 and in Article-17 of the GDPR1,which vests

in the victim a right to erasure of such material after due

diligence by the controller expeditiously. In addition to this,

Article 5 of the GDPR requires data controllers to take every

reasonable step to ensure that data which is inaccurate is

1The data subject shall have the right to obtain from the controller regarding the

erasure of personal data concerning him or her without undue delay and the

controller shall have the obligation to erase personal data without undue delay.

“erased or rectified without delay”. Every single time, it cannot

be expected that the victim shall approach the court to get the

inaccurate data or information erased which is within the

control of data controllers such as Facebook or Twitter or any

other social media platforms.

7. A similar issue was raised in England in the Wales High

Courts in NT1 and NT2 Vs. Google LLC2which ordered Google

to delist search results referring to the spent conviction of a

businessman known as NT2 but rejected a similar request

made by a second businessman, NT1. The claimants therein

had been convicted of certain criminal offences many years

ago who complained that search results returned by Google

featured links to third-party reports about the convictions in

the past which were either inaccurate and/or old, irrelevant

and of no public interest or otherwise an illegitimate

interference with their rights. The reliefs sought in those

cases were based on the prevailing data protection laws and

English Law principles affording protection in case of tortuous

misuse of private information. The Court rejected NT1’s

request based on the fact that he was a public figure with a

2[2018] EWHC 799 (QB).

role in public life and thus the crime and its punishment could

not be considered of a private nature. In contrast, the Court

upheld NT2’s delisting claim with the reasoning that his crime

did not involve dishonesty. His punishment had been based on

a plea of guilt, and information about the crime and its

punishment had become out of date, irrelevant and of no

sufficient legitimate interest to users of Google to justify its

continued availability.3

8.In the case of Google Spain SL & another v. Agencia

Espanola de Protection de Datos (AEPD) and another4 the

European Court of Justice ruled that the European citizens

have a right to request that commercial search engines, such

as Google, that gather personal information for profit should

remove links to private information when asked, provided the

information is no longer relevant. The Court in that case ruled

that the fundamental right to privacy is greater than the

economic interest of the commercial firm and, in some

circumstances; the same would even override the public

interest in access to information. The European Court in the

aforesaid case had affirmed the judgment of the Spanish Data

3Para 223 of Judgment

4C-131/12[2014] QB 1022

Protection Agency (SPDA)in a case which concerned a

proceeding relating to bankruptcy which had ordered removal

of material from the offending website by recognizing a

qualified right to be forgotten and held that an individual was

entitled to have Google de-list information of which he

complained.

9.Recently, the European Court of Justice, in Google LLC vs.

CNIL5 ruled that “currently there is no obligation under EU law,

for a search engine operator to carry out such a de-referencing

on all the versions of its search engine.” The Court also said

that the search operator must “take sufficiently effective

measures” to prevent searches for differenced information

from within the EU. The court specifically held as under:

“69. That regulatory framework thus provides the

national supervisory authorities with the instruments

and mechanisms necessary to reconcile a data

subject’s rights to privacy and the protection of

personal data with the interest of the whole public

throughout the Member States in accessing the

information in question and, accordingly, to be able to

adopt, where appropriate, a de-referencing decision

which covers all searches conducted from the territory

of the Union on the basis of that data subject’s name.

5Case C-507/17

70. In addition, it is for the search engine operator to

take, if necessary, sufficiently effective measures to

ensure the effective protection of the data subject’s

fundamental rights. Those measures must themselves

meet all the legal requirements and have the effect of

preventing or, at the very least, seriously discouraging

internet users in the Member States from gaining

access to the links in question using a search

conducted on the basis of that data subject’s name

(see, by analogy, judgments of 27 March 2014, UPC

Telekabel Wien, C-314/12, EU:C:2014:192,

paragraph 62, and of 15 September 2016, McFadden,

C-484/14, EU:C:2016:689, paragraph 96).

71. It is for the referring court to ascertain whether,

also having regard to the recent changes made to its

search engine as set out in paragraph 42 above, the

measures adopted or proposed by Google meet those

requirements.

72. Lastly, it should be emphasized that, while, as

noted in paragraph 64 above, EU law does not

currently require that the de-referencing granted

concern all versions of the search engine in question,

it also does not prohibit such a practice. Accordingly,

a supervisory or judicial authority of a Member State

remains competent to weigh up, in the light of

national standards of protection of fundamental rights

(see, to that effect, judgments of 26 February

2013, Åkerberg Fransson, C-617/10, EU:C:2013:105,

paragraph 29, and of 26 February 2013, Melloni,

C-399/11, EU:C:2013:107, paragraph 60), a data

subject’s right to privacy and the protection of

personal data concerning him or her, on the one

hand, and the right to freedom of information, on the

other, and, after weighing those rights against each

other, to order, where appropriate, the operator of that

search engine to carry out a de-referencing concerning

all versions of that search engine.

73. In the light of all of the foregoing, the answer to

the questions referred is that, on a proper

construction of Article 12(b) and subparagraph (a) of

the first paragraph of Article 14 of Directive 95/46

and Article 17(1) of Regulation 2016/679, where a

search engine operator grants a request for dereferencing

pursuant to those provisions, that

operator is not required to carry out that dereferencing

on all versions of its search engine, but on

the versions of that search engine corresponding to all

the Member States, using, where necessary, measures

which, while meeting the legal requirements,

effectively prevent or, at the very least, seriously

discourage an internet user conducting a search from

one of the Member States on the basis of a data

subject’s name from gaining access, via the list of

results displayed following that search, to the links

which are the subject of that request.”

10.Presently, there is no statue which recognizes right to be

forgotten but it is in sync with the right to privacy, which was

hailed by the Apex Court as an integral part of Article 21 (right

to life) in K.S. Puttaswamy (Privacy-9J.).6 However, the

Ministry of Law and Justice, on recommendations of Justice

B.N. Srikrishna Committee, has included the Right to be

forgotten which refers to the ability of an individual to limit,

delink, delete, or correct the disclosure of the personal

information on the internet that is misleading, embarrassing, or

irrelevant etc. as a statutory right in Personal Data Protection

Bill, 2019. The Supreme Court in K.S. Puttaswamy (Privacy-

9J.)has held right to be let alone as part of essential nature of

6(2017) 10 SCC 1

privacy of an individual. The relevant paras of the judgment

are as under:

“XXXXX

R. Essential nature of privacy

297. What, then, does privacy postulate? Privacy

postulates the reservation of a private space for the

individual, described as the right to be let alone. The

concept is founded on the autonomy of the individual.

The ability of an individual to make choices lies at the

core of the human personality. The notion of privacy

enables the individual to assert and control the

human element which is inseparable from the

personality of the individual. The inviolable nature of

the human personality is manifested in the ability to

make decisions on matters intimate to human life.

The autonomy of the individual is associated over

matters which can be kept private. These are concerns

over which there is a legitimate expectation of privacy.

The body and the mind are inseparable elements of

the human personality. The integrity of the body and

the sanctity of the mind can exist on the foundation

that each individual possesses an inalienable ability

and right to preserve a private space in which the

human personality can develop. Without the ability to

make choices, the inviolability of the personality

would be in doubt. Recognizing a zone of privacy is

but an acknowledgment that each individual must be

entitled to chart and pursue the course of

development of personality. Hence privacy is a

postulate of human dignity itself. Thoughts and

behavioural patterns which are intimate to an

individual are entitled to a zone of privacy where one

is free of social expectations. In that zone of privacy,

an individual is not judged by others. Privacy enables

each individual to take crucial decisions which find

expression in the human personality. It enables

individuals to preserve their beliefs, thoughts,

expressions, ideas, ideologies, preferences and choices

against societal demands of homogeneity. Privacy is

an intrinsic recognition of heterogeneity, of the right of

the individual to be different and to stand against the

tide of conformity in creating a zone of solitude.

Privacy protects the individual from the searching

glare of publicity in matters which are personal to his

or her life. Privacy attaches to the person and not to

the place where it is associated. Privacy constitutes

the foundation of all liberty because it is in privacy

that the individual can decide how liberty is best

exercised. Individual dignity and privacy are

inextricably linked in a pattern woven out of a thread

of diversity into the fabric of a plural culture.

XXXXXXX

402. “Privacy” is “[t]he condition or state of being free

from public attention to intrusion into or interference

with one's acts or decisions” [Black's Law

Dictionary (Bryan Garner Edition) 3783 (2004)] . The

right to be in this condition has been described as

“the right to be let alone” [ Samuel D. Warren and

Louis D. Brandeis, “The Right To Privacy”, 4 Harv L

Rev 193 (1890)] . What seems to be essential to

privacy is the power to seclude oneself and keep

others from intruding it in any way. These intrusions

may be physical or visual, and may take any of several

forms including peeping over one's shoulder to

eavesdropping directly or through instruments,

devices or technological aids.

XXXXXXX

479. Both the learned Attorney General and Shri

Sundaram next argued that the right to privacy is so

vague and amorphous a concept that it cannot be held

to be a fundamental right. This again need not detain

us. Mere absence of a definition which would

encompass the many contours of the right to privacy

need not deter us from recognising privacy interests

when we see them. As this judgment will presently

show, these interests are broadly classified into

interests pertaining to the physical realm and

interests pertaining to the mind. As case law, both in

the US and India show, this concept has travelled far

from the mere right to be let alone to recognition of a

large number of privacy interests, which apart from

privacy of one's home and protection from

unreasonable searches and seizures have been

extended to protecting an individual's interests in

making vital personal choices such as the right to

abort a foetus; rights of same sex couples—including

the right to marry; rights as to procreation,

contraception, general family relationships, childbearing,

education, data protection, etc. This

argument again need not detain us any further and is

rejected.

XXXXXXX

560. The most popular meaning of “right to privacy”

is—“the right to be let alone”. In Gobind v. State of

M.P. [Gobind v. State of M.P., (1975) 2 SCC 148 :

1975 SCC (Cri) 468] , K.K. Mathew, J. noticed

multiple facets of this right (paras 21-25) and then

gave a rule of caution while examining the contours of

such right on case-to-case basis.

XXXXXX

636. Thus, the European Union Regulation of 2016

[Regulation No. (EU) 2016/679 of the European

Parliament and of the Council of 27-4-2016 on the

protection of natural persons with regard to the

processing of personal data and on the free movement

of such data, and repealing Directive No. 95/46/EC

(General Data Protection Regulation).] has recognised

what has been termed as “the right to be forgotten”.

This does not mean that all aspects of earlier

existence are to be obliterated, as some may have a

social ramification. If we were to recognise a similar

right, it would only mean that an individual who is no

longer desirous of his personal data to be processed or

stored, should be able to remove it from the system

where the personal data/information is no longer

necessary, relevant, or is incorrect and serves no

legitimate interest. Such a right cannot be exercised

where the information/data is necessary, for

exercising the right of freedom of expression and

information, for compliance with legal obligations, for

the performance of a task carried out in public

interest, on the grounds of public interest in the area

of public health, for archiving purposes in the public

interest, scientific or historical research purposes or

statistical purposes, or for the establishment, exercise

or defence of legal claims. Such justifications would be

valid in all cases of breach of privacy, including

breaches of data privacy.”

The Hon’ble Apex court while considering the issue of

a conflict between the right to privacy of one person

and the right to a healthy life of another person has

held that, in such situations, the right that would

advance public interest would take precedence.”

(emphasis supplied)

11.The Hon’ble Supreme Court of India in the case of Mr ‘X’ v.

Hospital ‘Z’7 has recognized an individual’s right to privacy as

a facet Article 21 of the Constitution of India. It was also

pertinently held that the right which would advance the public

morality or public interest would alone be enforced through

the process of court, for the reason that moral considerations

cannot be kept at bay and the Judges are not expected to sit

as mute structures of clay in the halls known as the

courtroom, but have to be sensitive, “in the sense that they

7(1998) 8 SCC 296

must keep their fingers firmly upon the pulse of the accepted

morality of the day.”

12. The Ld. Single Judge of High Court of Karnataka in the

case of Vasunathan v. The Registrar General, High Court of

Karnataka8 has acknowledged the right to be forgotten,

keeping in line with the trend in the Western countries where

it is followed as a matter of rule. The High Court of Delhi in its

recent judgment in Zulfiqar Ahman Khan vs. Quintillion

Business Media Pvt. Ltd. and Ors9 has also recognized the

“right to be forgotten” and 'Right to be left alone' as an integral

to part of individual’s existence. The Karnataka High Court in

{Name Redacted} vs. The Registrar General10 recognized

“Right to be forgotten” explicitly, though in a limited sense.

The petitioner’s request to remove his daughter’s name from a

judgment involving claims of marriage and forgery was upheld

by the Court. It held that recognizing right to be forgotten

would parallel initiatives by ‘western countries’ which uphold

this right when ‘sensitive’ cases concerning the ‘modesty’ or

‘reputation’ of people, especially women, were involved.

However, the High Court of Gujarat in Dharamraj

82017 SCC OnLine Kar 424

92019(175) DRJ 660

10Writ Petition (Civil) Nos.36554-36555/2017decided on 4th January, 2018

Bhanushankar Dave v/s State of Gujarat & Ors.,[MANU/GJ/0029/2017] in a case

involving the interpretation of the rules of the High Court has

taken a contrary and narrow approach.

13. The Information Technology (Reasonable Security Practices

and Procedures and Sensitive Personal Data or Information)

Rules, 2011, India’s first legal framework recognized the need

to protect the privacy of personal data, but it failed to capture

the issue of the “Right to be forgotten”. The Hon’ble Supreme

Court of India in the case of K.S. Puttaswamy v. Union of

India (supra) held that purpose limitation is integral for

executive projects involving data collection – unless prior

permission is provided, third parties cannot be provided access

to personal data.See Para 166 of K.S. Puttaswamy Judgment

This principle is embodied in S.5 of the yetto-

be-implemented Personal Data Protection Bill, 2019.

Purpose Limitation enhances transparency in data processing

and helps examine the proportionality of the mechanism used

to collect data for a specific purpose. Moreover, it prevents the

emergence of permanent data ‘architectures’ based on

interlinking databases without consent. In the present case

the proposition of purpose limitation is not applicable as the

question of seeking consent does not arise at all. No person

much less a woman would want to create and display gray

shades of her character. In most of the cases, like the present

one, the women are the victims. It is their right to enforce the