An Essential Erasure

AI is such an integral part of our daily lives, and so integral should be the Right to Be Forgotten (RTBF) as a part of AI. In a country like India, with a population of billions and a rapidly growing digital economy, the ethical and legal challenges surrounding RTBF are many. There has to be a balance between digital progress and fundamental privacy rights.

The Right to Be Forgotten is the right of individuals to have their personal data removed from public access when it is no longer necessary, relevant, or lawful. With the exponential growth of artificial intelligence, the collection, storage, and usage of personal data have reached unprecedented levels. In the digital age, personal data can be most vulnerable. With low digital literacy in many regions across the globe, individuals may not even be aware of their general rights to request data erasure, rendering the right ineffective in practice. And therefore, clear, robust laws are needed.

In principle, RTBF grants a person the ability to request erasure of their personal data, de-listing/de-indexing of their name from AI applications, delisting of irrelevant or outdated information, etc. In India, data privacy laws are now evolving well. The country is taking steps toward comprehensive privacy laws in the digital world. The Digital Personal Data Protection Act, 2023 (DPDP Act), yet to be implemented, marks a significant step toward recognizing data rights. The DPDP Act, 2023 recognizes a form of the Right to Be Forgotten by granting individuals the right to request erasure of their personal data when it is no longer necessary or when consent is withdrawn. However, in due course, with usage increasing, the provisions may need to be expanded to apply to varied AI needs, or alternatively, a broader interpretation may need to be given. Apart from DPDP, the Digital India Act, 2023, which has been in talks, is being said to replace the Information Technology Act of 2000 in the future.

Indian courts have time and again recognized privacy. In KS Puttaswamy v Union of India (2017), the Supreme Court held that the right to privacy is a fundamental right under Article 21 of the Constitution, paving the way for broader interpretations.

Artificial Intelligence thrives on data. It learns, predicts, and automates decisions based on data, user behaviour, identifiers, facts, and figures. Inherent technology and algorithms of AI systems resultantly pose a serious challenge to implementing privacy rights. As we all can see, once AI systems are trained on some personal data, it gets embedded in AI models, making deletion or forgetting complex.

The mandatory provisions should explicitly define the scope of RTBF in AI systems and mandate obligations on data fiduciaries/controllers to comply with such requests. In fact, rather than request-based systems, deletions could also be made mandatory provisions for certain applications, considering the lack of knowledge and skills of many. Stronger transparency with clear requirements for AI developers ought to be there. AI developers must be mandated to ensure that personal data is unlearned to the extent that, even if models retain some traces, the data cannot be re-linked to individuals. There could be awareness campaigns to inform citizens about their data rights and how to exercise them.

RTBF must be carefully balanced against national interest and the right to access information. Activities related to India’s sovereignty, security, and public order, as well as research or statistical purposes, are generally exempted from such laws. The research aspect in this needs a review.

As AI systems become more embedded in governance, finance, daily life, etc., there has to be harmony between innovation and privacy. Thankfully, the DPDP Act has initiated the topic in a candid manner. There is a need to give substance to this right, especially for laymen. To make RTBF a meaningful right in India, laws need to take care of laymen, be clear for execution purposes, ethically sound, and capable of respecting individuals’ autonomy over their data.

The RTBF is not just a legal construct but a fundamental human right, one that allows individuals to shed irrelevant, private, or harmful digital data. If we think deeply and futuristically, such privacy is also in the overall national interest in the long run. There is much for AI to unlearn.

The writer is a practising Advocate in the Supreme Court and High Court of Delhi. Views expressed are personal