white_paper_on_data_protection_in_india_171127_final_v2

The EU GDPR has chosen to recognise the right to be forgotten; 646 however, it has done so
while acknowledging the social ramifications of obliterating all aspects of the past existence
of certain data. According to the regulation, an individual who is no longer desirous of his
personal data to be processed or stored would be able to erase it so long as the personal data is
no longer necessary, relevant, or is incorrect and serves no legitimate interest. 647 Thus, it
would follow that the right cannot be exercised where the information/data is necessary; for
exercising the right of freedom of expression and information, for compliance with legal
obligations, for the performance of a task carried out in public interest, on the grounds of
public interest in the area of public health, for archiving purposes in the public interest,
scientific or historical research purposes or statistical purposes, or for the exercise or defence
of legal claims. 648 Under the EU GDPR, the decision on whether the right to erasure can be
exercised, is to be taken by the data controller. 649
The quantum of fine that is applicable to the data controller if such an entity takes an
incorrect view or otherwise infringes Article 17 of the EU GDPR (right to erasure) may
amount to 20 million euros or up to four percent of the total worldwide annual turnover of the
preceding financial year, whichever is higher. 650
Canada
Schedule 1, Principle 5 of PIPEDA provides the deletion of personal information that is no
longer required. 651 Further, organisations are mandated to develop guidelines and implement
procedures. Though PIPEDA allows the erasure of personal information to a certain extent, it
is often criticised for including loopholes that allow freedom of speech to outweigh the right
to be forgotten. It is thought that the right to be forgotten cannot be shoehorned into existing
privacy law because search engines do not come within the scope of PIPEDA and the activity
of indexing newsworthy content online is subject to the journalism exception in PIPEDA.
Furthermore, any attempt to compel a search engine to not include particular resultsparticularly
pointing to lawful content- falls foul of the freedom of expression right under the
Canadian Charter of Rights and Freedoms. 652
646 Michael L. Rustad, Sanna Kulevska, ‗Reconceptualising the right to be forgotten to enable transatlantic data
flow‘, 28(2) Harvard Journal of Law & Technology 349 (2015).
647 Article 17, EU GDPR.
648 Article 17, EU GDPR.
649 Article 17, EU GDPR.
650 Article 83, EU GDPR.
651
Schedule 1, Principle 5 of PIPEDA; Office of the Privacy Commissioner of Canada, ‗Schedule 1, Principle 5
of PIPEDA; Personal Information Retention and Disposal: Principles and Best Practices‘ (June 2014), available
at: https://www.priv.gc.ca/en/privacy-topics/safeguarding-personal-information/gd_rd_201406/ ,(last accessed
28 October 2017).
652 David T.S. Fraser, ‗You‘d better forget the right to be forgotten in Canada‘ (April 2016), available at:
http://blog.privacylawyer.ca/2016/04/youd-better-forget-right-to-be.html, (last accessed 28 October 2017) cited
in Office of the Privacy Commissioner of Canada, ‗Submissions received for the consultation on Online
Reputation‘, available at: https://www.priv.gc.ca/en/about-the-opc/what-we-do/consultations/consultation-ononline-reputation/submissions-received-for-the-consultation-on-online-reputation/or/sub_or_07/
(last accessed
21 November 2017).
140