Right to be forgotten clause in Srikrishna panel's draft bill tricky to implement, say experts

BENGALURU: The Personal Data Protection Bill 2018 gives the individual the right to be forgotten, which entails that the person has the power to restrict or prevent continuing disclosure of personal data by a data fiduciary.
This clause, which also features in Europe’s General Data Protection Regulation, however, could be tricky to implement, according to experts. It may also not be popularly used by individuals since it could entail a fee.

The right to be forgotten comes with certain clauses, which includes the go ahead from an adjudicating officer on the applicability as well as consideration of whether rights and interests of the person in preventing or restricting the continued disclosure of personal data override the right to freedom of speech and expression and the right to information of any citizen.

The Bill effectively calls for the data fiduciary to retain personal data only as long as may be reasonably necessary to satisfy the purpose for which it is processed, and also calls periodic reviews to determine whether it is necessary to retain the personal data.

There could be inherent challenges in executing this provisions, experts feel. “Europe itself has forgotten the right to be forgotten,” said Subho Ray, president of the Internet and Mobile Association of India (IAMAI). “It will be difficult for the fiduciary to track all the places where data is shared, and overall it may not be feasible,” he added.

There could also be operational costs involved for companies to comply with the clause, experts feel.

“From an operational perspective, the company will have to create systems that take this into account and then in reality would have to create channels for customers to say that they want to be forgotten,” said Ujjwal Chaudhry, engagement manager, RedSeer Consulting.