CA Shailendra Uprety and Adv. Srijana Adhikari v. Ministry of Communication and Information Technology (Writ no.: 075-WO-0676)

Background of the case

The petitioners, Chartered Accountant Shailendra Uprety and Advocate Srijana Adhikari, filed a public interest writ petition before the Supreme Court of Nepal seeking recognition and legal protection of the “Right to be Forgotten.” The Petitioners argued that once personal information is uploaded on the internet, it remains stored indefinitely and may continue to harm individuals even after it becomes irrelevant or outdated. Such information could violate a person’s right to privacy, dignity, reputation, and employment opportunities. Therefore, the Petitioners requested the Court to issue a mandamus directing the Government to enact a specific law on the Right to be Forgotten, establish a Data Controller Authority, and create legal mechanisms to remove inadequate, irrelevant, or outdated personal data from digital platforms (search engines).

The Supreme Court acknowledged that the Right to be Forgotten is closely connected to the constitutional rights to privacy and dignity and noted its recognition in international legal frameworks. The Court reiterated that enactment of a new law falls within the exclusive domain of the legislature and not the judiciary. Accordingly, the Court issued the directive order to the Government to study the issue and consider making appropriate legal arrangements, including possible amendments to existing laws and the establishment of a regulatory mechanism for personal data protection.

What is right to be forgotten?

The Right to Be Forgotten (RTBF) refers to an individual’s right to request the removal, deletion, or de-indexing of personal data that is outdated, irrelevant, excessive, or no longer necessary for the purpose for which it was collected. In the digital era, personal information once published online often remains permanently accessible, causing long-term harm to an individual’s dignity, privacy, reputation, and livelihood.

RTBF is not an absolute right; rather, it requires a balancing between privacy, freedom of expression, and public interest. Its core objective is to prevent perpetual punishment and reputational harm arising from obsolete or irrelevant digital records.

Data once stored on the internet remain stored indefinitely. Information that is inadequate, irrelevant, or no longer relevant, once entered into the internet network, can continue to trouble a person repeatedly or for life. Such data can violate a person’s right to live with dignity, deprive them of employment opportunities, and affect how family and society perceive them.

A person has the right to know what information about them is published online and to request removal of inadequate or irrelevant information.

While the Constitution of Nepal guarantees the right to live with dignity and the right to privacy, there is no law allowing removal of information published in violation of these rights.

The right to privacy protects confidential information, whereas the “Right to be Forgotten” allows removal of information published online.

Therefore, internet-related issues are matters of public concern. The “Right to be Forgotten” exists to protect dignity and privacy by allowing removal of irrelevant or outdated data.

This right is based on human autonomy and self-determination.

It has been recognized in several jurisdictions including the UK, EU countries, Spain, Germany, Argentina, and India.

Historical Development of the Right to Be Forgotten (Global Perspective)

The concept of RTBF has evolved through international jurisprudence and legislation:

• European Union

Google Spain SL v. AEPD & Mario Costeja González (C-131/12, 2014)

This case arose from a dispute about online privacy and old personal information appearing in internet search results. In 1998, a Spanish newspaper published a legal notice stating that Mario Costeja González’s property was being auctioned to recover unpaid social security debts. Many years later, although the matter had already been resolved, when people searched his name on the internet, links to that old notice still appeared in Google search results. Costeja felt that this outdated information was harming his reputation and was no longer relevant.

He first requested the newspaper to remove or alter the page, but the newspaper refused because the publication had been lawful at the time. He then approached Google Spain and Google Inc., asking them to remove the links from search results so that the information would no longer appear when his name was searched. Google rejected his request, arguing that it merely displayed links and was not responsible for the content. Costeja then filed a complaint before the Spanish Data Protection Authority (AEPD), which ordered Google to remove the links. Google challenged this order before the Court of Justice of the European Union.

The main issue before the Court was whether a search engine operator could be considered responsible for personal data appearing in search results and whether individuals had a right to request removal of links to outdated or irrelevant information. The Court decided in favor of Costeja. It held that search engines like Google are “data controllers” because they collect, organize, and display personal information. Therefore, they have legal responsibilities regarding personal data protection.

The Court further ruled that individuals have a “right to be forgotten,” meaning they can request removal of links to personal information that is inaccurate, irrelevant, outdated, or excessive in relation to the purpose for which it was originally published. Importantly, the Court clarified that this right applies to search engine results and does not necessarily require removal of the original information from the website where it was first published. The Court also stated that, in most cases, a person’s privacy rights outweigh the public’s interest in accessing old personal information, unless the person is a public figure or the information remains relevant to public interest.

This decision became a landmark ruling because it formally recognized the “Right to be Forgotten” in digital privacy law and later influenced the inclusion of the right to erasure under Article 17 of the EU’s General Data Protection Regulation (GDPR).

• General Data Protection Regulation (2018): Article 17 of the regulation formally codified the Right to Erasure, providing enforceable legal standards.
• Argentina: Courts in cases such as Da Cunha v. Yahoo and Google addressed search engine liability and reputational harm.
• Japan: Act on the Protection of Personal Information Act, 2003 allows individuals to request deletion where continued data use infringes rights.
• India: The Supreme Court has recognized RTBF as part of the constitutional right to privacy in the cases of Justice K.S. Puttaswamy and Anr. vs. Union of India (UOI) and Ors, Jorawar Singh Mundy v. Union of India and other cases). The Digital Personal Data Protection Act, 2023 has ensured the Right to correction and erasure of personal data.

Significance of the Case in Nepal

This case represents the first recognition of the Right to be Forgotten by the Nepalese judiciary, marking a landmark step in protecting digital privacy and personal dignity.

• It highlights the growing importance of data protection and internet-related rights in Nepal.
• It sets a precedent for legislative action to balance privacy rights, public interest, and freedom of expression.
• It strengthens awareness about the responsibilities of both the government and digital platforms in safeguarding personal information.