Do citizens of India have a legal right ask a website to delete their personal information? Is there any rule under the IT Act or any other regulation in India which provides the right to withdraw consent from providing your personal information? I want to delete my personal information from a certain website where I have created an account. UPDATE As @ohwilleke pointed out I was specifically looking for "a legally enforceable right" and not something inherited in TnC since it can get pretty crazy [Ref: 7,500 Online Shoppers Unknowingly Sold Their Souls] Thanks for your responses, I have done my own research with negative result, at least for India. While EU seems to be serious about "Right to be forgotten". As per this regulation, you do have option to opt-out. So it does mean somewebsite.com would destroy my personal information when i choose to withdraw my consent. Now, what happens to other data retention laws that require data to be kept for specific amount of time?
At least as of 2011, when regulations under the Information Technology Act related to privacy and data security were issued (some of the relevant statute sections and regulations are linked in this answer at Law.SE), there was no non-contractual right to have your data destroyed, although a terms of service for a site could give you that right contractually. Instead, usually, a term of service agreement will do exactly the opposite and give a site owner an irrevocable right to keep your data forever. I am not aware of any subsequent statutory, regulatory or case law developments in India which have changed this situation, but that kind of tweak of IT Act regulations in India wouldn't necessary make headlines outside of the local IT industry press coverage in obscure trade journals. The EU is the only place of which I am aware that has any individual right to have data destroyed or suppressed even if it doesn't violated copyright, wasn't obtained illegally and isn't fraudulent or defamatory. Even then, as I understand it, in the EU this is not a unilateral right that applies in all circumstances and is instead a specific remedy for certain situations that have a particularly intense privacy aspect to them.
The European laws have specific sections regarding digital goods. The following two passages are relevant to you: From Returning unwanted goods: Warning! Please note that you may not use goods that you have received before deciding to withdraw from the purchase. The right to withdraw exists to allow you to examine the product in the same way as you would in a shop, not to give you 14 days free use. Be aware also that more specific rules apply to digital content (e.g. downloading or streaming music or video). From Shopping online: Digital content Specific information requirements apply when you buy digital content online, e.g. when downloading or streaming music or video. Before you make the purchase, you must also be informed how the content operates with relevant hardware/software (interoperability) and about its functionality, including whether any geographical restrictions apply to the use of the content and if private copies are allowed. You also enjoy the right of withdrawal within 14 days from concluding the contract for online digital content. However, once you start downloading or streaming the content you may no longer withdraw from the purchase, provided that the trader has complied with his obligations. Specifically, the trader must first obtain your explicit agreement to the immediate download or streaming, and you must explicitly acknowledge that you lose your right to withdraw once the performance has started. So yes, the law specifically allows you to waive that right when purchasing digital goods. So long as Steam has correctly advertised the product's system requirements and other key details, you lose your right to withdraw from the purchase the moment you start downloading it to your system.
Legal framework Per Articles 4(1) and 4(2) of the UK GDPR, your email address is most likely personal data (and certainly is once you notify the data controller that it belongs to you), and the storage and use of that data constitutes processing. In order to process your personal data, the data controller must establish at least one of the six lawful bases set out in Articles 6(1)(a) to 6(1)(f). It's quite clear that none of those lawful bases apply in this situation. Hence, the processing is unlawful. Next steps Start by making a request to the data controller under Articles 14(1) and 15(1) for the following: A copy of all personal data (including the email address) which they hold in relation to you. The purpose of them holding the data. The legal basis on which they hold the data. That they erase all personal data which they hold in relation to you, pursuant to Article 17(1)(d) (unlawful processing of data). Per Article 12(3), the data controller is required to respond &quot;without undue delay&quot;, with an upper time limit of 1 month (or 2 months if they notify you of the time extension within 1 month). Sadly, most data controllers in my experience seem to interpret this to mean that 1 month is the standard time limit, even though technically this is incorrect and the standard limit is &quot;without undue delay&quot;. Pursuant to Article 12(6) the data controller can pause the clock by asking you for additional information if they have &quot;reasonable doubts concerning [your] identity&quot;. If you send your request from the email address in question then they can't really have &quot;reasonable&quot; doubts, but be aware of this possibility in any case and respond promptly to any requests to confirm your identity so that the clock resumes. Most likely they will be unable to (correctly) provide an answer to points 2 and 3 above, since they do not have a genuine purpose or legal basis. If, after the maximum deadline has expired, they have still not responded and/or erased the data, you have two options: Complain to the ICO under Article 77(1). The ICO has the power under Article 83(5) to fine the data controller up to the higher of 4% of their turnover or £17,500,000. Complaining to the ICO is free and easy and is usually recommended over option 2. Issue a claim in the County Court for a compliance order pursuant to Article 79(1) and Section 167 of the Data Protection Act 2018. You also have the right to claim compensation for &quot;material and non-material damage&quot; (including distress) pursuant to Article 82(1) and Section 168, but this may be unrealistic in the case of a few unwanted emails. Option 2 is not free: you will need to pay a court fee and, unless you represent yourself, legal fees. There may also be additional cost risks if you lose the case. Mentioning the above two points in your request could be an effective way to persuade them to comply in the first place.
The GDPR will probably not allow a successful demand for erasure in these circumstances. The company does not need to argue &quot;that they can't delete user information for fear of be liable for.something&quot; because GDPR art 17 1(c), 3(b), and 3(e) already make that case for the company. Lets look at the relevant law. GDPR Article 17 reads in relevant part: (1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (1) (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (1) (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (1) (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); ... (3) Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (3) (a) for exercising the right of freedom of expression and information; (3) (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ... (3) (e) for the establishment, exercise or defence of legal claims. Art 17 Par 1 (a) only allows erasure when data are &quot;no longer necessary&quot;. But depending on how the purposes were worded by the Controller, they may well still be necessary Art 17 Par 1 (b) only allows erasure when consent is withdrawn and consent was the legal basis for processing. But a contract with the user is a much more likely basis for processing for a financial service. Art 17 Par 1 (c) requires erasure if the user objects and there is no &quot;overriding legitimate grounds for the processing&quot; but the needs to maintain financial records of a transaction is probably an &quot;overriding legitimate ground&quot;. In any case par 3 alloys erasure to be refused &quot;for compliance with a legal obligation&quot; or &quot;for the establishment, exercise or defence of legal claims&quot;. Financial records may well fall into one or both of these categories, at least as regards transaction data. In short it is far from clear that the GDPR will require erasure in these circumstances.
Any processing of personal data needs a legal basis, for example necessity for some contract or legitimate interest. If no other legal basis allows the processing, you need to acquire consent. Consent must be freely given. If something is gated behind consent without that consent being really necessary, this might coerce users and they would not be able to consent freely. The GDPR does not have a hard ban on this, but it explicitly calls out that this case must be considered when determining whether consent is valid. So what your company is trying to do is in a dark grey area. Not necessarily wrong, but likely so. Consent could be made free if users have an actual choice. For example, some online newspaper sites had success with a “pay or consent” wall. (Success in the sense that some data protection authorities allowed this). In your case, this could mean that users either consent to extra data collection, or that they buy some reasonably priced premium mode. But none of this is for you to decide. You can voice your doubts that the software would be compliant. You could also ask if the Data Protection Impact Assessment document for this proposed processing is available (creating such an assessment is likely mandatory in this case). But in the end, it is the company's obligation to be compliant, and this responsibility is largely shouldered by the company's data protection officer (to whom you can turn with further questions).
The GDPR has an exemption for purely personal or household activity. Creating a family tree seems purely personal as long as you don't publish it. You're also allowed to freely share the tree as long as it stays within that purely personal scope. Your proposed restriction of only showing data of blood relatives seems excessively strict. But assuming that this exemption wouldn't apply, there'd probably still be no problem. The GDPR does not require you to always obtain consent. It requires that the purposes for which you process personal data are covered by some legal basis. Consent is one such legal basis, but legitimate interest is another. You can likely argue that you have a legitimate interest to create a tree of your (extended) family. The legitimate interest must be weighed against the rights and freedoms of the affected persons. For example, contact information could be used for stalking. The balance of the legitimate interest check can be changed if you adopt suitable safeguards. Your idea of only sharing data with close relatives would be such a safeguard, but it might not be necessary. When you rely on legitimate interest, the affected person can object to further processing, furthermore they can request to be erased from your records. A request for erasure can be denied if there are overriding grounds to keep the data. E.g maybe only contact information has to be deleted but names, dates, and relations might be kept. You should notify persons when they are included into your records. It is your obligation as the data controller to make these decisions. If someone disagrees they can sue you or lodge a complaint with a supervision authority. Note that dead persons are not natural persons in the sense of the GDPR, and have no privacy. However, national laws may provide such protections.
You are responsible for what data is being processed by your website. When you embed third party components on your website (e.g. iframes, scripts), you are at least jointly responsible with the third party providing these components. You are only responsible for what happens on the website (i.e. what processing is under your control), not for what the third party provider does with collected data on their services. However, note that information will be transferred to Google's servers regardless of whether the visitor has a Google account! The Fashion ID case is relevant case law establishing and explaining these points. Since you are (jointly) responsible, you need a legal basis for collecting personal data through the tracking snippet and sharing it with the third party (here Google). For example, the legal basis could be a legitimate interest, or could be consent. A legitimate interest requires that you balance this interests against the interests, rights, and freedoms of the data subject (the site visitor). If the data subject wouldn't reasonably expect this tracking, you cannot rely on a legitimate interest. Consent can always work, except that it is a freely given, informed opt-in – likely unsuitable for conversion tracking. Which legal basis to use is primarily your responsibility. You argue that the tracking snippet does not collect personal data. However, this argument is not well supported. Under the GDPR, personal data does not only include directly identifying information such as an email address, but also any information “relating” to an identifiable person. Identification includes the ability to single out someone, e.g. by a browser fingerprint. For purposes of conversion tracking, Google will clearly try to collect data that allows the visitor to be singled out, thus collecting personal data. Furthermore, specific kinds of information are regulated by the ePrivacy directive. This includes “traffic data” and “information stored on a terminal device”, regardless of whether this information is personal data under the GDPR. Under ePrivacy, such information can only be used as strictly necessary to provide the service requested by the user (and conversion tracking is not strictly necessary), or when the user gives their consent. Depending on what information is collected by the tracking snippet and on whether you are subject to ePrivacy, you would have to collect consent anyway. There is also the issue that Google Ads is an US-based service, and transferring data to the US is largely illegal since the 2020 Schrems II ruling. The US do not provide an adequate level of data protection, so that transfers would require additional safeguards. Standard Contractual Clauses (SCCs) for Controller to Controller transfers are not sufficient by itself. Of course those extra safeguards are effectively impossible to implement and no one is doing this correctly, but it's worth considering that there is additional legal risk. Explicit consent can provide a legal basis for transfers even to a country with inadequate protections, but that mechanism is intended for occasional transfers. In conclusion: you have wrongly concluded that no personal data would be involved you are jointly responsible with Google for whatever data is processed by the conversion tracking snippet you need a legal basis for sharing this data with Google legitimate interest may be sufficient, depending on what data is involved (consider ePrivacy) and depending on the result of your legitimate interest balancing test alternatively, you may require every visitors consent to track their conversions – unlikely to result in good data additionally, such use of Google Ads may run into issues around international transfers due to the Schrems II ruling this kind of stuff is difficult, and no one is really doing this correctly :/
Your confusion might be caused by the fact that even with a contract, only the data necessary for that contract is covered under the GDPR. So yes, while there might be an &quot;execution of contract&quot; under the T&amp;C, this would only cover necessary data. That means you can't ask arbitrary signup data under the guise of a contract. If you need to deliver a physical product, you can store a physical address. If it's an online service, you can store an email address or similar handle. But you can't mix the two. A physical address is unnecessary for the execution of a contract that's not physical in nature. Now, you mention &quot;consent&quot;. Under GDPR, this is a distinct justification besides &quot;execution of contract&quot;. You might have consent to store a physical address in addition to an online address, e.g. if you offer a customer to physically mail a password request form. This consent is additional to the contract. Also note that the bit above only covers the lawful reasons for the processing of personal data (article 6). You also have to obey the other GDPR rules, e.g. fully inform the user, make sure that consent is freely given, etc.