 have a good afternoon. Thank you, Shreyas. Good afternoon, everyone. Before I broadly introduce the topic, which is of course data privacy, protection and public data and also our speakers and what we'll be talking about today. I'll take this opportunity to break a bit of news, which was told to me by Srinivas Kodali. The BN Sri Krishna committee of experts is going to be giving its report today at 4 p.m. We are told. So those of you who are expecting to work on it your weekend has been ruined. Congratulations. But anyway, on that note, let me just talk a little bit about what this session is all going to be all about, what our speakers are going to be talking about and why this is relevant. Those of you who are aware of the debate going on about privacy, you'd have noticed that a lot of the discussion about privacy in India is happening largely on two axes. One, what is our right of privacy against the government? When I say our, I mean citizens, individuals, persons of all sorts, what is our right of privacy against the government? To an extent, a lot of that debate has gone on. We have fairly settled principles. We have understood what we can and cannot claim against the government. A second axis, axis of that debate has been what is our right of privacy against companies who have our data, you know, entities whom we give our data to in some sort of contractual duty in some sort of commercial consideration, for some sort of commercial consideration, what are our obligations that is still developing, that is still ongoing, that is still something that is developing as we go on, you know, there are various issues there as well. But there is a third axis to that debate and something that is most fascinating and very under explored. It has an impact on the other two axes as well because there are principles that you will realize that have a bearing on how everybody gets to deal with data and how everybody deals with privacy as a whole. And that is how do we deal with each other's claims to privacy? Can I claim a right to privacy against you? Can you ask me for my data? Am I say you and me? I literally mean individuals. Can you all as a group, as a society, as an organization, as public at large, ask me for some details? Can I demand to know something about all of you as an individual, as a researcher, as a lawyer or something? This is something that is going to keep coming up again and again in many contexts. We have with us two speakers who will illustrate some of the important points that are going to come up in these debates through two different contexts. Jyoti is going to speak to us, Jyoti Pandey is going to speak to us about this particular debate in the context of the right to be forgotten. Some of you have heard of this in the context of the EU and Google. But Jyoti is going to tell you about how this is a much wider debate that is going on around the world and even in India as well. She is going to talk to you about the various implications of this right when it can be claimed when it can't. The second speaker is Sushant Sinha. He is the founder of a wonderful website called Indian Kanun. I say that as a lawyer because for most of us lawyers, Sushant is like the wizard of horse. We all use Indian Kanun as this amazing website which provides us information about cases which most people didn't have access to unless they were willing to fork over very large amounts of money to a few monopolies. But Sushant has sort of broken a lot of those. And most people are shocked to find out that Indian Kanun is run by this one guy in Banglau. And then it's like a real wizard of horse movement for a lot of us to know that all it really just took was this one guy writing code in Banglau to break a couple of diopoli really in the field of law and legal reporting. But this has come with its own problems. And I will leave it to Sushant to explain more in detail. The kind of issues that can happen when you put publicly available public data, what is data which is ostensibly public out into the public domain. And why that these are two different things is something I will leave Sushant to discuss and describe. And it's a fascinating experience that he has had over the last few years running Indian Kanun as well. So without any further ado, let me first introduce Jyoti Pandey. She's an independent tech policy researcher. She has previously worked with the Electronic Freedom Frontiers and with the Center for Internet and Society. And she will be speaking to you about the battle for privacy and the right to be forgotten. So over to you, Jyoti. Thanks, Alok. Good afternoon. I'm Jyoti Pandey. As Alok mentioned, I'm an independent researcher working in tech policy for not very long, just four years now. So I'll be talking about right to be forgotten. But before I start on this very interesting topic, I just want to know how many of you use Twitter over here? Can we have a show of hands please? Great. So everybody's aware of how Twitter throws up these lovely examples of how we deal and interact with technology, right? So let me give you a really interesting story. So two weeks back or three weeks back, a hashtag called Plain Bay and pretty plain, pretty plain girls started trending on Twitter. So the story goes like this. Rosie Blair, a woman was traveling with her boyfriend and she wanted to sit, they had different seats. So she wanted to sit with her boyfriend and she convinced this stranger to swap seats with her. This happens with us on a fairly regular basis. What happened next is the interesting part of how technology mediates our interactions with each other. So the two, the girl who swapped her seat for Rosie ended up sitting next to another good-looking man and it turns out that these two strangers had a lot of things in common. They were both into fitness, they were both cute, they got along and Rosie continued to talk about this. She went on to tweet and take pictures of this interaction and initially everybody thought that, you know, this is really adorable, you know, chance encounter, strangers meeting, how very cute. But then Rosie took it a step forward. She started reporting on their conversations. Every elbow touch, every photograph being exchanged was being tweeted and of course these tweets went viral because what do we do on Twitter? We follow these strange stories. But during the time that this interaction was unfolding, people on Twitter started reacting in very different ways. Some people felt that this was meat-cute and this is perfect and this is exactly what social media was created for. Other people started noticing that this could be creepy behavior because the girl had not consented to being recorded in this manner and having her interaction being projected to the world. And of course Rosie knew that there would be some privacy implications because even in the pictures that she was tweeting about these two strangers, she had blurred their faces. So what is this? Oh and it doesn't stop here. At one point these two strangers got up at the same time and Rosie went on to speculate that they may be hooking up in the bathroom which is of course uncalled for and no it was just that speculation. So what went on as the tweets went viral, of course everybody involved in this incident got really famous with TV news channels trying to get them into their studios and Rosie her boyfriend and the man all enjoyed the attention and regularly went on the TV circuit gathering the attention and loving it. The girl did not want to be a part of it but that did not stop a bunch of other internet strangers from trying to hack her identity to figure out who this anonymous pretty plain girl was. So what does this story tell us about the attention economy? It's the perfect example of how scattered moments presented without context are becoming more and more rampant as we interact on these platforms. People build detailed but very selective profiles of us based on the angle and the interest that they are coming from. Oversharing, intruding and exploiting others for content is actually rewarded in this economy. So the reason I started with this story is because when we talk about a right to be forgotten it is important to understand why there is a need for such a right in the first place and like this story demonstrates there are many examples where we might not want a certain representation of ourselves online and should we then have the power to control it or is it fair to let others decide for us how they should think about us just by the fact that we have consented to be on the same platform as them. So the right to be forgotten look at this man he's Mario Custezia Gonzalez and he is single-handedly responsible for the right to be forgotten. There's another interesting story here and this is the most interesting part of my presentation it's all numbers and words so just you know be awake now. So in 2009 Mario googled himself and he was very surprised to see search results throw up a reference to public debt he owed which led to his house being auction and the laws in Spain he is from Spain and the laws in Spain require publications that are to issue a notice for such an auction to attract bidders. This happened a few years back and when he was googling himself in 2009 the debt had been cancelled and the auction was no longer relevant so he felt that you know when you type his name in that search and with this reference coming up it was hampering his reputation so he approached the publication in question and asked them to so what had happened was this publication had recently been digitized and so he approached the publication and said hey could you remove it because it is no longer relevant. The publications said no sorry can't do law requires us to publish it this is in the public interest so then he approached Google and Google said of course we are not going to do we are we can't do this we are we don't meddle with the content we just you know link to stuff we don't publish he then approached the court and the courts in Spain granted him the right to seek that Google delist the search results so that when somebody types his name those references don't come up Google appealed and the case went up to the European Court of Justice which again held that yes he did have the right to be forgotten but so the the Spain ruling in this case was limited it said that search engine operators are controllers of personal data so in data process you have data processors and you have data controllers so this was really interesting because the ECGA interpreted search engine operators to be controllers of personal data and it granted individuals to the right to seek to approach the search engines and seek that they delist URLs about them personal data was the main stake here search results when you type somebody's name and if that name comes up in the search results that should be removed and the information which is and because in the Custodia case the argument relied on the fact that at the time of when the publication published this order for the auction it was relevant but 10 or 15 years down the line it was no longer relevant and yet it was tied to his reputation so the idea of relevance was very important in this case so the court went into some detail and said that information that is outdated inaccurate inadequate irrelevant devoid of purpose and no public interest could be could form the basis of these right to be forgotten requests now where did the court come up with this right so Europe has really strong privacy protection I mean of course I hope everybody in this room knows that we do not have a privacy law but Europe has a codified law in 1995 interestingly they were trying to update the European directive and the conversations of right to be forgotten were already taking place in these discussions to update the data protection regime and parallel to this out of the blue the European Court of Justice decides that yes there is a right indeed but for them to be able to grant this right it must be it must come from somewhere and they found that right to be forgotten to be a part of data protection regime that existed in Europe at that point which is the right of erasure the right of erasure interestingly applied only to proprietary databases so for example if you signed up for in the 90s you signed up for a magazine brochure and stop subscribing then you can write to that person be like hey I don't want to I am not accessing your services anymore please get rid of my personal details it did not apply to search databases the right to be forgotten extended the right to erasure and brought it on to the digital platform so the right to be forgotten of course throws some really interesting question it also points to a very important philosophical divide where we believe that any information once it's out on the internet should not be taken back it should not be tampered because it is out there in the public if it is lawful and if it is correct what right to be forgotten does it it creates the mechanism to take lawful correct truthful information and and judge it on the basis of relevance which of course is driven by context so you can see how this right could be open to misinterpretation or really broad interpretation and that is exactly what is happening so the european court of justice their rulings apply to all european countries and we and of course following the spain ruling there was a trickle effect and countries started you know folding and looking at how they could bring this right for their citizens so there are very many interesting examples here so this slide looks only i'm sorry for the font being so tiny but i wanted to kind of give a broad view of how fragmented this one right is within the same jurisdiction that already has a common and somewhat strong sense of privacy and data protection so in spain because they said relevance and truthfulness were the spain decision made a distinction that with passage of time newsworthiness diminishes which was the case because the order was no longer relevant netherlands the court of appeal a similar case came up and they said that if it's a criminal the criminal records continue to be relevant no matter how much time has elapsed so the time factor then contributes to relevance and as we know with any kind of right you know how it is interpreted by the courts and how they define the parameters around this is how it develops in spain again initially the 2014 judgment only applied to search engines in 2018 recently they have expanded it to apply to search databases of newspapers and archives so already the scope of the right has spilled over from search engines and gotten infused with newspapers and archives in italy interestingly there is a conflict where data protection is being used in a way to stifle journalism and i'll draw out more of this tension later in the talk but the italy example is specifically interesting because here the journalist usually have an exception because there's a public interest you know for news being available in the public records and most laws that you know give you control over information always have this balancing test in so in the uk for example if somebody goes and says there's a right to be forgotten and i want to exercise this right the journalist can claim this public interest exception and say no this is in the public interest and will continue publishing in italy the data protection regime does not apply this exception does not apply to journalists and therefore the one of the many consequences of the legislation and how the national framework is that the right to be forgotten has trumped so the right to privacy has trumped the right for maintaining public records in that jurisdiction again germany dealt with the question of so a lot of criminal and the courts have been really clear that you know if if you have been convicted or if there is some sort of a criminal record then there makes it makes sense for the public to have knowledge of that record because it somehow relates to your reputation and how they should be judging you um italy again what it did establish was that if there is negative publicity now so the negative publicity was also something that kusteja argued for he said that you know the links appearing were hampering his reputation so italy again so basically the way the right to be forgotten has been interpreted in italy it essentially translates into that any kind of inconvenient review or if you write like something about me that i do not like and even if it is published in newspaper i can exercise a right to be forgotten and have it removed from the public records so you can imagine in the hands of the powerful and the mighty were a great censorship tool this will be in france so another interesting thing that the spain judgment did and a couple of other jurisdictions have also replicated is specify exclusion protocols that the search engines can use in order to specify to so the publishers should use these exclusion protocols to specify to search engines certain content that they that should be excluded from their automatic indexes um and this is something so in the italy decision this was argued in the in the court and the judges completely ignored that you know this technical possibility to exclude this search result existed they went with the broader application of the right um so if you notice i haven't included uk over here uh even though it's part of the eu because i have have two very interesting examples that i wanted to bring up the first is a man convicted of benefits fraud in 2012 he forged documents as proof of his innocence went to google and said that there are some 300 URLs please delete and you and google complied with that request and deleted 293 URLs this guy was so confident he went again and saw delisting of other links which were for a conviction for forgery which is when somebody in google realized that oh hey wait a minute if he's been convicted for forgery maybe the identity documents he showed for the first request could also be forged and that is exactly what it was and then they revoked it so um but the why this is extremely interesting is because even though we trust google which is a huge private platform to create a thanks to create a verification mechanism which would be strong and they would have resources to you know um dedicate to this process had this guy not been greedy and had he not sought delisting of those other um links they would have never found the first um uh you know the error so the scope for fraud and the scope for um dishonest of application of the right to be forgotten is very very high even in a country like uk so we can imagine if this right is exported to india what is going to happen um the other thing that i wanted to point out is that we have two kinds of three kinds of broad action happening on the right to be forgotten so you have the european courts so you have the courts that are interpreting and reading this right into existing data protection uh uh frameworks that are there at the national level you have um some countries that are actually introducing or revising their existing laws and actually incorporating a clause that says hey there is a right to be forgotten so if india comes up with a um right to privacy the chances are pretty high that it would include a mention of the right to be forgotten if not a specific right um and um but the third more interesting way this right has been negotiated is through data protection authorities who themselves are interpreting this right and giving it to citizens so um so basically because e u has already interpreted this right exists the data protection authorities are then now finding google for saying um so in the uk a former bank clerk imprisoned for stealing money from elderly people's bank accounts was convicted and um the data protection authority actually ordered google because remember we're saying that you know convicted criminals their record should be there for the public record but here the data protection authority went above that standard and actually ordered google to remove um actual conviction records so what is happening in north america this has spread of course it has not been limited to european union the us does not have a law um there is a bill which is currently being reviewed it's in the second stage it's the second time it is being reviewed um california has something called the eraser law for minors which seals juvenile internet records so these are both legislative things the courts haven't really dealt with the right to be forgotten in the u.s yet um in canada which is a very interesting example the courts have um the data protection authority like i mentioned has come up with a report based on a consultation independently so proactively the data protection authority there is seeking to bring in a right to be forgotten for canada and they have recommended that instead of de-indexing a link lower the rank of a search result so essentially make it really hard to find um they also have the canadian courts have also specified that search engines to use geo identifying technologies to actively block canadians from accessing the right to be forgotten link anywhere so in canada um the supreme court and more recently uh supreme court had a ruling in equistec where it upheld that uh google should remove search results for specific websites not just in canada but everywhere in the world so the equistec case has got nothing to do with the right to be forgotten but it's got to do with how google implements its um removal of search results and it's the extra territorial application of one kind of content removal practice from that google um practices and um this would have implications for how right to be forgotten is also interpreted so if canada may now building on this decision be like hey not only geo identifying technologies should block canadians accessing that uh link within canada but make sure that you know this link is not available to any canadian anywhere in the world which essentially means that you know you're tweaking laws of other countries in mexico again the scope of right to be forgotten has been broadened um there's there's actually a legislative effort in mexico on to introduce this right um so again we see the trend that a lot of powerful people are using this right you know to negotiate their reputations online and of course when you create a tool like that uh who would have the time the scope the resources and the energy to you know utilize it to the maximum and we need to think about these things when we consider certain rights so this transportation mogul um the deep i mean he's um he had um so it's got nothing to do with the right to be forgotten but the data protection authority again went uh well above and beyond the scope that has been defined for this right and suggested and has initiated sanctions against the search engine uh for uh cancellation and opposition to the processing of data so you know again there's this conflict is the search engine a controller and therefore has to comply with right to be forgotten request and then what mexico is doing not only a controller even if you're processing you have to still comply with right to be forgotten request and that is really tricky because um we'll come to that later anyway so um the courts annul the dpa order to remove links in another case the courts in mexico have annul the dpa order so the dpa is really over reaching in mexico um and in another case the court has ruled that when persistence causes injury right to be forgotten request must be honored but injury can be open to interpretation so in asia what's happening indonesia is the first country in asia to actually adopt a right to be forgotten law by revising the electronic information and transactions law um japan the courts have rejected the existence of such a right they said that it can only be allowed when the value of privacy protection clearly outweighs that of information disclosure china too has concluded that there is no right to be forgotten under chinese laws it also specifically noted in the case that autocomplete search words did not infringe the complainants right to his name and reputation so if i type is jyotipa day of adip it says a fool then you know i can't be like hey google you're calling me a fool so i mean um it's really interesting how and in which context these cases are also coming up in each of these jurisdictions so you know we have criminal cases we have the powerful who want to protect their reputation we have people who are you know involved in crimes but were not convicted we have people who want to transform public records um in south america um i've taken only three countries but there are a lot of countries actually in south america that are contemplating or actually trying to work with this right the highest constitutional court refused to recognize right to be forgotten um and held that newspaper was not required to remove the report about a woman involved in crime but not convicted as i just gave that example um they did however say that you know the the publication would have to use exclusion protocols uh in pedu the court has ordered newspapers to remove links to investigations on drug trafficking carried out by law enforcement and so there is another tension that is developing where public officials and people who hold important offices certain information about them should be in the public because you know they hold these important offices the right to be forgotten is also negotiating those standards or actually watering them down in brissel uh so brissel there is a case pending where in 1958 a woman was murdered and in 2004 this major tv network made a show on it and then the one of the relatives of that woman has gone and student said that there is a right to be forgotten you need to remove that um the supreme court just tell that search engines need to scrub new stories about fraud involving appointment of woman as state judge the woman basically became a judge through fraudulent means and this was reported and now the courts have in brissel ruled that you know this judge has the right to be forgotten though as a public official she probably shouldn't so right to be forgotten india what's happening here um and shushan sinna in his next talk is going to be um covering a lot of this but uh as alok mentioned we have the shri krishna committee report and it'll be exciting to see what what they actually say because in the white paper they mention a sector they have mentioned right to be forgotten and they mentioned taking a sectoral approach to it which balances free speech and privacy it's a very broad uh mention of the right they haven't gotten into any specific but they probably mention it because in the privacy judgment that came out put us mommy versus union of india injustice in one of the judges justice calls opinion he specifically he mentions he references this right in in a couple of really interesting context so he talks about um uh young children and how they may um have put up certain information that they regret and they should have the right to take that back um but we do already have existing laws you know uh for protection of identity we have juvenile so india i mean what i'm trying to basically explain is that the justification of this right in that opinion um could be handled through other existing legislation which could be tweaked or improved there is no um the rational use in the opinion to me don't suggest that we need to introduce a new right but we'll see how the shri krishna committee has interpreted that um in there are three cases that have happened the karnataka high court of personal details of a woman from a published judgment so divorce cases um and then you want to get remarried and you google somebody's name and a reference to their divorce proceedings comments and it's a it's a sort of an embarrassment so families approaching uh women's identity that's really important issue in india and usually courts are very favorable towards uh handing out judgments that seem um you know um privacy conscious about women um in gujrat so the gujrat the case was interesting uh the person who approached the court said this judgment was classified as unreportable and yet one of these online legal forums has gone and published it so the judge with the distinction that you know uh publishing on an online legal database is not reporting i mean but we see you know how these fine lines and the nuances and the rationales being used to uh negotiate this right in each jurisdiction is very dependent on the context the existing laws and how the courts actually favor uh privacy versus public interest so um google has of course been um at the eye of the storm and it recently published a report of the implementation of right to be forgotten requests within europe um so 2.4 million URLs have been requested by europeans and it has complied with 43 percent of these combined france germany uk generated 50.6 percent uh and the usage of right to be forgotten varies estonia filing most requests per capita and grease the least so again within europe it's very uneven score um we have uh so who is making these requests the total volume of previously unseen requesters has declined year or year on year um the vast majority of requests are coming from individuals especially individuals with a sizable online presence uh make heavy use of right to be forgotten minors which is what was driving justice calls opinion are only five percent of these total number of requests and um this is despite uh google haven't taken extra efforts to create um a knowledge about the existence of this right uh within um that age group in europe because they're mandated to do so so what categories of information are people wanting to get removed there are two broad categories personal information in web directories or social media histories and legal history included in news archive and government directory pages uh the request categories are also pretty and this is not an exhaustive list google if i would urge you to go through that report it is pretty interesting and actually uses some brings highlights some really good examples from the countries um personal information in web directories is um something that has so we can see why people are requesting um legal history and news so one broad trend that has developed over the past four years of implementing this right that the personal information that are in directories and social media those requests have gone down but the legal history in government uh pages and news articles have gone up one of this and google suggests that one of the many reasons for this could be that uh you have more control and platforms have stepped up the privacy practices or are giving user more control about the data that they have published on these platforms so as these practices evolve in the overall digital economy uh the requests are falling so we it's a it's an interesting insight that you know how the overall economy and how we shape it uh would then reduce the need for such a right to exist in the first place um in terms of news article and government pages you don't really have any control over them once it's published it's their uh policy so those have those kind of requests have remained pretty stable um this is the categories of sites again the social media content is 13.9 directory and information are 18.8 news sources government pages and break up so what are some of the trends news related content increase social media generally declined broad variations and categories of sites requested in different countries in Spain um 10.6 percent of requested URLs targeting government records missed them from law that mandates government to publish public notifications um the Spanish law to inform missing individuals about a government decision that directly affects them and publish government decisions to absolve an individual from a criminal sentence so if you've been convicted and your sentence has been changed then um that needs to be published so when there are these laws that require your personal details to be part of the public pages these kind of in those jurisdictions these requests are pretty high the requesters in France and Germany were most concerned with information exposed on social media um these variations actually illustrate the challenge of a one-size-fits-all privacy policy and this is what we're saying you know when we say the Europe's right to be forgotten um it's very important that we distinguish that there is and it should be the case that the right to be forgotten in India is looks and takes into context the different legislation the way of working our bureaucracy the chances of uh fraud um so yeah if we have if we import the european right into India we are going to create trouble for ourselves what does the right to be forgotten actually do it creates great power for private corporations um it is basically giving them the right to adjudicate on your fundamental right it makes them the arbitrator of relevance and legitimacy also interestingly um it the Spanish decision created the obligations for a specific class of intermediaries but now um again like i said the scope of this right has been broadened so much that um hosts and hosts are different from search engines so twitter and facebook would be host and google is a search engine countries are pushing to have hosts also comply with right to be forgotten request um when private corporations are deciding and um thinking about your fundamental rights that they're doing this behind closed doors you have no control over it the opaque decision making and compliance will become de facto rules because if google with its scale and resources sets the sets the standards of the procedure how they will go about it uh it's very likely that other smaller companies will adopt it um also interesting challenges that come up what happens to information that needs to be retained for auditing and technical reasons um and the territorial scope of right to be forgotten so canada for example use of technologies to block link um also really interesting um which i haven't mentioned here is that even the scope beyond personal information so they're targeting newspapers and archives and not just search engines it's gone beyond that but if the definition of databases expands and if it is really broad then technically any hosting function or any platform that has a search database i mean if you don't define the parameters of the right and it is only specific to databases i mean imagine the implications for any kind of service that has a search function built into it how does right to be forgotten impact press freedom and historical integrity in many many ways uh basically what it is doing is um it is putting the right to know in direct conflict with the right to privacy it also impacts severely what should be considered public record do we have the right to go back and revise public records um it's creating a right to alter lawful information that is already in the public domain um it also impacts historical integrity of published work archives and history the duty to preserve information for public interest data about a private individual could become relevant in the future so you know today uh kusteja might not be important but after this right to be forgotten ruling my god his name is so important i mean you know um so relevance and context changes and when we take information off it's no longer part of the public um the public no longer has access to it and that is a form of severe censorship uh maintaining public domain requires transparency and accountability and when we are outsourcing all of this work with private corporations um it would be very difficult to maintain those levels of transparency and accountability it is also important to distinguish between certain parts of the process so are we asking the publication to delete the original newspaper article or report or are we or are we just asking the search engine to delist or are we asking the search engine to just rank the search results lower depending on which course we adopt the right will develop its own framework and evolve in a different manner so two interesting um examples i'll drop up in five minutes so identities have fraud and exclusion after annan's talk and all of the adhaar conversations we've been having um identities have fraud and exclusion have been bearing really heavy on my mind and given the uk examples it would be interesting and in fact very very scary to think about such a right being brought in india without having really strong measures for the verification of identity so google has to prevent fraudulent removal request the key criteria that google um sets up is the verification of identity now imagine as right to be forgotten expands and if in india it's a really broad right that applies to all sorts of search databases then how would we ensure that every database that has to comply with the right to be forgotten request is actually following a very um strong and robust verification procedure uh fail-proof mechanism for verification can lead to dishonest application as we saw in the uk example um it also creates scope and incentive for individuals to game the system so tomorrow you know i could commit fraud and then use a right to be forgotten first steal somebody's identity commit a fraud and then use a right to be forgotten to remove like all traces of that identity um so it would be very very important to limit this right to a very very specific narrow context even if you're thinking about bringing this into india um the threat of malicious actors sparring deletions so what is happening so in italy and in europe you see a lot of cases of bad reviews of restaurants of people who are in the service industry i imagine when you give a tool for someone to um you know um i could genuinely have a bad customer experience but the corporation could you know then just seek or that individual could just seek a right to be forgotten request and remove those bad reviews so in this economy when part of it relies on our attention and part of it relies on the reputation we build um how would the right to be forgotten impact both of those things um beyond search engines the right to be forgotten applies to all types of databases that index personal details would definitely hinder innovation lack of records of transactions in some cases may prevent coordination for example if you have blood banks and they want to coordinate and you don't want your name then it becomes really difficult for you to without those personal details coordination in public emergencies becomes harder uh financial data fraud um again removing traces of forgery or convicted um uh people for people who've been convicted for financial fraud uh would also create challenges deletion of data may leave individuals vulnerable as exclusion from database could lead to access to services in the next tomorrow if um and i'm hypothetically thinking this uh say if india has a right to be forgotten and uh but the caveat is that if you exercise your right to be forgotten you cannot use this service because our service relies on uh building on your personal details to personalize that service for you i mean in which case the right to be forgotten would effectively be a moot uh right so tailoring the right for a very specific context for a very specific class of intermediary i mean ideally this right should not exist but you don't know how that will go another interesting example and there are and i'm actually thinking through this and we lovely to hear people in this audience who have more knowledge about blockchain i have i have no idea about blockchain and how it works and i tried reading it it seemed very very complicated but thinking about the idea that you can take back your identity or you can revise um records uh what happens to technologies like blockchain that rely on decentralized and distributed um sorry which rely on permanent tamper proof records so um who would be the authority that would grant the right to be forgotten request in this context who would be the um the authority or the stakeholder in that chain who would actually implement it who would authenticate and verify how would that uh impact technologies like blockchain transactions cannot be deleted and tampered with the way technology has been designed in blockchain uh the right to be forgotten doesn't sit with sit well with this and it would stymie the development of such solutions uh would it also reduce transparency of transactions um uh and what is happening is a couple of people in europe have been exploring options so storing personal data off chain and storing transactional data on chain and i don't understand how that works but again from my research on this what it seems to suggest is that it actually increases the complexity of the system and therefore makes the entire technology uh open to uh attack vectors and makes it a more vulnerable so what's the way forward uh resist adoption of right to be forgotten explore other measures to control personal data bring through procedural fairness so frameworks like notice and takedown and if we could create uh more um individual specific rights around the framework that are so copyright law in india has a notice and takedown um the it act has a notice and takedown scheme if how could you could you think about strengthening these existing frameworks um clear procedures in event of non-compliance including going to courts so um dps should not be able to step in and order google the court should be adjudicating and again there is a tension there because if ultimately the data protection authority is the regulator for your personal data then um what kind of rights are we granting the regulator with respect to right to be forgotten which also relates to content uh clarify the role of the data protection authority creating exceptions for companies that host so interestingly the european has a new privacy framework the european um global data protection regulation gdpr um and there it includes the right to be forgotten but again none of the privacy experts can actually clarify if the right to be forgotten is limited to search engines or if it also applies to host the twitter and facebook and when europe where the right actually evolved is not clear on this issue uh when we are importing it into india without our privacy strong frameworks um it's going to be problem so i'm leaving you with some questions and these are questions for me and for you to think over does the right to be forgotten solve the issue of countering untruthful or outdated information online does the right negatively impact press freedom archives public right to know how can we ensure right to be forgotten does not become a tool for censorship what are the unintended consequences on fraud and identity theft there's right to be forgotten encourage your reputation economy so in uk france in germany um there is interestingly a bunch of corporations that are filing these requests because we have online celebrities that don't have the time to do it so they are outsourcing it to these companies and then economy has developed around right to be forgotten so will we create a similar economy if we expose this right here and how does the right to be forgotten impact development of new technology like blockchain or immutable or other immutable led thank you uh thanks a lot jyoti uh since we are running a little bit short on time so what i suggest is that we take all questions after susans so that the audience has a full perspective of the issue so all questions for jyoti and susan we will take at the end of susan session as well since that'll be just before lunch and we can go a little bit over time also as required uh so please see me have another round of applause for jyoti as well