JUDGMENT OF THE COURT (Grand Chamber)
24 September 2019 (*)
(Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data contained on websites — Directive 95/46/EC — Regulation (EU) 2016/679 — Search engines on the internet — Processing of data appearing on websites — Special categories of data referred to in Article 8 of Directive 95/46 and Articles 9 and 10 of Regulation 2016/679 — Applicability of those articles to operators of a search engine — Extent of that operator’s obligations with respect to those articles — Publication of data on websites solely for journalistic purposes or the purpose of artistic or literary expression — Effect on the handling of a request for de-referencing — Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union)
In Case C‑136/17,
REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 24 February 2017, received at the Court on 15 March 2017, in the proceedings
GC,
AF,
BH,
ED
v
Commission nationale de l’informatique et des libertés (CNIL),
interveners:
Premier ministre,
Google LLC, successor to Google Inc.,
THE COURT (Grand Chamber),
composed of K. Lenaerts, President, A. Arabadjiev, A. Prechal, T. von Danwitz, C. Toader and F. Biltgen, Presidents of Chambers, M. Ilešič (Rapporteur), L. Bay Larsen, M. Safjan, D. Šváby, C.G. Fernlund, C. Vajda and S. Rodin, Judges,
Advocate General: M. Szpunar,
Registrar: V. Giacobbo-Peyronnel, administrator,
having regard to the written procedure and further to the hearing on 11 September 2018,
after considering the observations submitted on behalf of:
– AF, by himself,
– BH, by L. Boré, avocat,
– Commission nationale de l’informatique et des libertés (CNIL), by I. Falque-Pierrotin, J. Lessi and G. Le Grand, acting as Agents,
– Google LLC, by P. Spinosi, Y. Pelosi and W. Maxwell, avocats,
– the French Government, by D. Colas, R. Coesme, E. de Moustier and S. Ghiandoni, acting as Agents,
– Ireland, by M. Browne, G. Hodge, J. Quaney and A. Joyce, acting as Agents, and M. Gray, Barrister-at-Law,
– the Greek Government, by E.-M. Mamouna, G. Papadaki, E. Zisi and S. Papaioannou, acting as Agents,
– the Italian Government, by G. Palmieri, acting as Agent, and F. De Luca and P. Gentili, avvocati dello Stato,
– the Austrian Government, by G. Eberhard and G. Kunnert, acting as Agents,
– the Polish Government, by B. Majczyna, M. Pawlicka and J. Sawicka, acting as Agents,
– the United Kingdom Government, by S. Brandon, acting as Agent, and C. Knight, Barrister,
– the European Commission, by A. Buchet, H. Kranenborg and D. Nardi, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 10 January 2019,
gives the following
Judgment
1 This request for a preliminary ruling concerns the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
2 The request has been made in proceedings between GC, AF, BH and ED and the Commission nationale de l’informatique et des libertés (French Data Protection Authority, France) (‘the CNIL’) concerning four decisions of the CNIL refusing to serve formal notice on Google Inc., now Google LLC, to de-reference various links appearing in the lists of results displayed following searches of their names and leading to web pages published by third parties.
Legal context
EU law
Directive 95/46
3 The object of Directive 95/46, in accordance with Article 1(1), is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to eliminate obstacles to the free flow of personal data.
4 Recitals 33 and 34 of Directive 95/46 state:
‘(33) Whereas data which are capable by their nature of infringing fundamental freedoms or privacy should not be processed unless the data subject gives his explicit consent; whereas, however, derogations from this prohibition must be explicitly provided for in respect of specific needs …
(34) Whereas Member States must also be authorised, when justified by grounds of important public interest, to derogate from the prohibition on processing sensitive categories of data …; whereas it is incumbent on them, however, to provide specific and suitable safeguards so as to protect the fundamental rights and the privacy of individuals;’
5 Article 2 of Directive 95/46 provides:
‘For the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); …
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
…
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; …
…
(h) “the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’
6 In Chapter II, Section I of Directive 95/46, headed ‘Principles relating to data quality’, Article 6 reads as follows:
‘1. Member States shall provide that personal data must be:
(a) processed fairly and lawfully;
(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. …
(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.
2. It shall be for the controller to ensure that paragraph 1 is complied with.’
7 In Chapter II, Section II of Directive 95/46, headed ‘Criteria for making data processing legitimate’, Article 7 provides:
‘Member States shall provide that personal data may be processed only if:
…
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).’
8 Articles 8 and 9 of Directive 95/46 appear in Chapter II, Section III, headed ‘Special categories of processing’. Article 8, headed ‘The processing of special categories of data’, provides:
‘1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.
2. Paragraph 1 shall not apply where:
(a) the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his consent; or
…
(e) the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims.
…
4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.
5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.
Member States may provide that data relating to administrative sanctions or judgments in civil cases shall also be processed under the control of official authority.
…’
9 Article 9 of Directive 95/46, headed ‘Processing of personal data and freedom of expression’, states:
‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’
10 Article 12 of Directive 95/46, headed ‘Right of access’, provides:
‘Member States shall guarantee every data subject the right to obtain from the controller:
…
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
…’
11 Article 14 of Directive 95/46, headed ‘The data subject’s right to object’, provides:
‘Member States shall grant the data subject the right:
(a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data;
…’
12 Article 28 of Directive 95/46, headed ‘Supervisory authority’, reads as follows:
‘1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
…
3. Each authority shall in particular be endowed with:
– investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,
– effective powers of intervention, such as, for example, that … of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing …
– …
Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
…
6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.
The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.
…’
Regulation (EU) 2016/679
13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) (OJ 2016 L 119, p. 1, and corrigendum OJ 2018 L 127, p. 2) applies, in accordance with Article 99(2), from 25 May 2018. Article 94(1) of that regulation provides that Directive 95/46 is repealed with effect from that date.
14 Recitals 1, 4, 51, 52 and 65 of Regulation 2016/679 state:
‘(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.
…
(4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, … the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, …
…
(51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. …
(52) Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and other fundamental rights …
…
(65) A data subject should have … a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’
15 Article 4(11) of Regulation 2016/679 defines ‘consent’ as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.
16 Article 5 of Regulation 2016/679, headed ‘Principles relating to processing of personal data’, provides in paragraph 1(c) to (e):
‘Personal data shall be:
…
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; … (“storage limitation”).’
17 Article 9 of Regulation 2016/679, headed ‘Processing of special categories of personal data’, provides:
‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.
2. Paragraph 1 shall not apply if one of the following applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
…
(e) processing relates to personal data which are manifestly made public by the data subject;
…
(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
…’
18 Article 10 of Regulation 2016/679, headed ‘Processing of personal data relating to criminal convictions and offences’, provides:
‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’
19 Article 17 of Regulation 2016/679, headed ‘Right to erasure (“right to be forgotten”)’, reads as follows:
‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
(a) for exercising the right of freedom of expression and information;
…’
20 Article 21 of Regulation 2016/679, headed ‘Right to object’, provides in paragraph 1:
‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’
21 Article 85 of Regulation 2016/679, headed ‘Processing and freedom of expression and information’, provides:
‘1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
…’
French law
22 Directive 95/46 was implemented in French law by Loi No 78-17, du 6 janvier 1978, relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 of 6 January 1978 on information technology, data files and civil liberties), in the version applicable to the facts of the main proceedings.
23 Article 11 of that law states that, among its functions, the CNIL is to ensure that the processing of personal data is carried out in accordance with the provisions of that law, and that, on that basis, it is to receive claims, petitions and complaints relating to the processing of personal data and is to inform their authors of their outcome.
The disputes in the main proceedings and the questions referred for a preliminary ruling
24 GC, AF, BH and ED each requested Google to de-reference, in the list of results displayed by the search engine operated by Google in response to searches against their names, various links leading to web pages published by third parties; Google, however, refused to do this.
25 More particularly, GC requested the de-referencing of a link leading to a satirical photomontage placed online pseudonymously on 18 February 2011 on YouTube, depicting her alongside the mayor of a municipality whom she served as head of cabinet and explicitly referring to an intimate relationship between them and to the impact of that relationship on her own political career. The photomontage was placed online during the campaign for the cantonal elections in which GC was then a candidate. On the date on which her request for de-referencing was refused she was neither a local councillor nor a candidate for local elective office and no longer served as the head of cabinet of the mayor of the municipality.
26 AF requested de-referencing of links leading to an article in the daily newspaper Libération of 9 September 2008, reproduced on the site of the Centre contre les manipulations mentales (Centre against mental manipulation) (CCMM) (France), concerning the suicide of a member of the Church of Scientology in December 2006. AF is mentioned in that article in his capacity as public relations officer of the Church of Scientology, an occupation which he has since ceased to exercise. Furthermore, the author of the article states that he contacted AF in order to obtain his version of the facts and describes the comments received on that occasion.
27 BH requested the de-referencing of links leading to articles, mainly in the press, concerning the judicial investigation opened in June 1995 into the funding of the Parti républicain (PR), in which he was questioned with a number of businessmen and political personalities. The proceedings against him were closed by an order discharging him on 26 February 2010. Most of the links are to articles contemporaneous with the opening of the investigation and therefore do not mention the outcome of the proceedings.
28 ED requested the de-referencing of links leading to two articles published in Nice Matin and Le Figaro reporting the criminal hearing during which he was sentenced to 7 years’ imprisonment and an additional penalty of 10 years’ social and judicial supervision for sexual assaults on children under the age of 15. One of the accounts of the court proceedings also mentions several intimate details relating to ED that were revealed at the hearing.
29 Following the rejections by Google of their requests for de-referencing, the applicants in the main proceedings brought complaints before the CNIL, seeking for Google to be ordered to de-reference the links in question. By letters dated 24 April 2015, 28 August 2015, 21 March 2016 and 9 May 2016 respectively, the president of the CNIL informed them that the procedures on their complaints had been closed.
30 The applicants in the main proceedings thereupon made applications to the referring court, the Conseil d’État (Council of State, France), against those refusals of the CNIL to serve formal notice on Google to carry out the de-referencing requested. The applications were joined by the referring court.
31 Finding that the applications raised several serious difficulties of interpretation of Directive 95/46, the Conseil d’État (Council of State) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Having regard to the specific responsibilities, powers and capabilities of the operator of a search engine, does the prohibition imposed on other controllers of processing data caught by Article 8(1) and (5) of Directive 95/46, subject to the exceptions laid down there, also apply to this operator as the controller of processing by means of that search engine?
(2) If Question 1 should be answered in the affirmative:
[(a)] Must Article 8(1) and (5) of Directive 95/46 be interpreted as meaning that the prohibition so imposed on the operator of a search engine of processing data covered by those provisions, subject to the exceptions laid down by that directive, would require the operator to grant as a matter of course the requests for de-referencing in relation to links to web pages concerning such data?
[(b)] From that perspective, how must the exceptions laid down in Article 8(2)(a) and (e) of Directive 95/46 be interpreted, when they apply to the operator of a search engine, in the light of its specific responsibilities, powers and capabilities? In particular, may such an operator refuse a request for de-referencing, if it establishes that the links at issue lead to content which, although comprising data falling within the categories listed in Article 8(1), is also covered by the exceptions laid down by Article 8(2) of the directive, in particular points (a) and (e)?
[(c)] Similarly, when the links subject to the request for de-referencing lead to processing of personal data carried out solely for journalistic purposes or for those of artistic or literary expression, on which basis, in accordance with Article 9 of Directive 95/46, data within the categories mentioned in Article 8(1) and (5) of the directive may be collected and processed, must the provisions of Directive 95/46 be interpreted as allowing the operator of a search engine, on that ground, to refuse a request for de-referencing?
(3) If Question 1 should be answered in the negative:
[(a)] Which specific requirements of Directive 95/46 must be met by the operator of a search engine, in view of its responsibilities, powers and capabilities?
[(b)] When the operator establishes that the web pages at the end of the links subject to the request for de-referencing comprise data whose publication on those pages is unlawful, must the provisions of Directive 95/46 be interpreted as:
– requiring the operator of a search engine to remove those links from the list of results displayed following a search made on the basis of the name of the person making the request; or
– meaning only that it is to take that factor into consideration in assessing the merits of the request for de-referencing, or
– meaning that this factor has no bearing on the assessment it is to make?
Furthermore, if that factor is not irrelevant, how is the lawfulness of the publication on web pages of the data at issue which stem from processing falling outside the territorial scope of Directive 95/46 and, accordingly, of the national laws implementing it to be assessed?
(4) Irrespective of the answer to be given to Question 1:
[(a)] whether or not publication of the personal data on the web page at the end of the link at issue is lawful, must the provisions of Directive 95/46 be interpreted as:
– requiring the operator of a search engine, when the person making the request establishes that the data in question have become incomplete or inaccurate, or are no longer up to date, to grant the corresponding request for de-referencing;
– more specifically, requiring the operator of a search engine, when the person making the request shows that, having regard to the conduct of the legal proceedings, the information relating to an earlier stage of those proceedings is no longer consistent with the current reality of his situation, to de-reference the links to web pages comprising such information?
[(b)] Must Article 8(5) of Directive 95/46 be interpreted as meaning that information relating to the investigation of an individual or reporting a trial and the resulting conviction and sentencing constitutes data relating to offences and to criminal convictions? More generally, does a web page comprising data referring to the convictions of or legal proceedings involving a natural person fall within the ambit of those provisions?’
Consideration of the questions referred
32 The questions referred concern the interpretation of Directive 95/46, which was applicable at the time when the request for a preliminary ruling was submitted. That directive was repealed with effect from 25 May 2018, from which date Regulation 2016/679 applies.
33 The Court will consider the questions referred from the point of view of Directive 95/46, while also taking Regulation 2016/679 into account in its analysis of them, in order to ensure that its answers will in any event be of use to the referring court.
Question 1
34 By its first question, the referring court essentially asks whether the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out for the needs of the functioning of the search engine.
35 It must be recalled, first, that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 when that information contains personal data and, second, that the operator of the search engine must be regarded as the ‘controller’ in respect of that processing within the meaning of Article 2(d) of that directive (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 41).
36 The processing of personal data in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page, and that activity plays a decisive role in the overall dissemination of those data in that it renders the latter accessible to any internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published. Moreover, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet, enabling them to establish a more or less detailed profile of the data subject (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraphs 35 to 37).
37 Consequently, in so far as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of his responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 38).
38 The first question referred aims to determine whether, in the context of his responsibilities, powers and capabilities, the operator of a search engine must also comply with the requirements laid down by Directive 95/46 with respect to the special categories of personal data mentioned in Article 8(1) and (5) of the directive, where such data are among the information published or placed on the internet by third parties and are the subject of processing by that operator for the purposes of the functioning of his search engine.
39 As regards the special categories of data, Article 8(1) of Directive 95/46 provides that the Member States are to prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of data concerning health or sex life. Certain exceptions to and derogations from that prohibition are provided for inter alia in Article 8(2) of the directive.
40 Article 8(5) of Directive 95/46 states that the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases are also to be processed under the control of official authority.
41 The content of Article 8(1) and (5) of Directive 95/46 was taken over, with some changes, in Article 9(1) and Article 10 of Regulation 2016/679.
42 It must be stated, first, that it is apparent from the wording of those provisions of Directive 95/46 and Regulation 2016/679 that the prohibition and restrictions laid down by them apply, subject to the exceptions provided for by the directive and the regulation, to every kind of processing of the special categories of data referred to in those provisions and to all controllers carrying out such processing.
43 Next, no other provision of that directive or that regulation provides for a general derogation from that prohibition or those restrictions for processing such as that carried out in the context of the activity of a search engine. On the contrary, as already pointed out in paragraph 37 above, it follows from the general scheme of those instruments that the operator of a search engine must, in the same way as any other controller, ensure, in the context of his responsibilities, powers and capabilities, that the processing of personal data carried out by him complies with the respective requirements of Directive 95/46 or Regulation 2016/679.
44 Finally, an interpretation of Article 8(1) and (5) of Directive 95/46 or Article 9(1) and Article 10 of Regulation 2016/679 that excluded a priori and generally the activity of a search engine from the specific requirements laid down by those provisions for processing relating to the special categories of data referred to there would run counter to the purpose of those provisions, namely to ensure enhanced protection as regards such processing, which, because of the particular sensitivity of the data, is liable to constitute, as also follows from recital 33 of that directive and recital 51 of that regulation, a particularly serious interference with the fundamental rights to privacy and the protection of personal data, guaranteed by Articles 7 and 8 of the Charter.
45 While, contrary to the submissions of Google in particular, the specific features of the processing carried out by the operator of a search engine in connection with the activity of the search engine cannot thus justify the operator being exempted from compliance with Article 8(1) and (5) of Directive 95/46 and Article 9(1) and Article 10 of Regulation 2016/679, those specific features may, however, have an effect on the extent of the operator’s responsibility and obligations under those provisions.
46 It must be observed in this respect that, as the European Commission emphasises, the operator of a search engine is responsible not because personal data referred to in those provisions appear on a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search on the basis of an individual’s name, since such a display of the link in such a list is liable significantly to affect the data subject’s fundamental rights to privacy and to the protection of the personal data relating to him (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 80).
47 In those circumstances, having regard to the responsibilities, powers and capabilities of the operator of a search engine as the controller of the processing carried out in connection with the activity of the search engine, the prohibitions and restrictions in Article 8(1) and (5) of Directive 95/46 and Articles 9(1) and 10 of Regulation 2016/679 — as indicated by the Advocate General in point 56 of his Opinion and as stated in essence by all the parties who have expressed an opinion on the point — can apply to that operator only by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject.
48 It follows from the above that the answer to Question 1 is that the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject.
Question 2
49 By its second question, which consists of three parts, the referring court essentially asks
– whether the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the operator of a search engine is required by those provisions, subject to the exceptions provided for by the directive, to accede to requests for de-referencing in relation to links to web pages containing personal data falling within the special categories referred to by those provisions;
– whether Article 8(2)(a) and (e) of Directive 95/46 must be interpreted as meaning that, pursuant to that article, such an operator may refuse to accede to a request for de-referencing if he establishes that the links at issue lead to content comprising personal data falling within the special categories referred to in Article 8(1) but whose processing is covered by one of the exceptions laid down in Article 8(2)(a) and (e) of the directive; and
– whether the provisions of Directive 95/46 must be interpreted as meaning that the operator of a search engine may also refuse to accede to a request for de-referencing on the ground that the links whose de-referencing is requested lead to web pages on which the personal data falling within the special categories referred to in Article 8(1) or (5) of the directive are published solely for journalistic purposes or those of artistic or literary expression and the publication is therefore covered by the exception in Article 9 of the directive.
50 It should be noted, as a preliminary point, that in the context of Directive 95/46 requests for de-referencing such as those at issue in the main proceedings have their basis in particular in Article 12(b) of the directive, under which the Member States are to guarantee data subjects the right to obtain from the controller the erasure of data whose processing does not comply with the directive.
51 Moreover, in accordance with Article 14(a) of Directive 95/46, the Member States are to grant the data subject the right, at least in the cases referred to in Article 7(e) and (f) of the directive, to object at any time on compelling legitimate grounds relating to his or her particular situation to the processing of data relating to him or her, save where otherwise provided by national legislation.
52 In this respect, it must be recalled that the Court has held that Article 12(b) and Article 14(a) of Directive 95/46 must be interpreted as meaning that, in order to comply with the rights laid down in those provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages, published by third parties and containing information relating to that person, also in a case where that name or information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its publication in itself on those pages is lawful (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 88).
53 The Court has also held that, when appraising the conditions for the application of those provisions, it should inter alia be examined whether the data subject has a right that the information in question relating to him or her personally should, at the present point in time, no longer be linked to his or her name by a list of results displayed following a search made on the basis of his or her name, without it being necessary in order to find such a right that the inclusion of the information in question in that list causes prejudice to the data subject. As the data subject may, in the light of his or her fundamental rights under Articles 7 and 8 of the Charter, request that the information in question no longer be made available to the general public on account of its inclusion in such a list of results, those rights override, as a rule, not only the economic interest of the operator of the search engine but also the interest of the general public in having access to that information upon a search relating to the data subject’s name. However, that would not be the case if it appeared, for particular reasons, such as the role played by the data subject in public life, that the interference with his or her fundamental rights is justified by the preponderant interest of the general public in having, on account of its inclusion in the list of results, access to the information in question (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 99).
54 With respect to Regulation 2016/679, the EU legislature laid down, in Article 17 of the regulation, a provision specifically governing the ‘right to erasure’, also called the ‘right to be forgotten’ in the heading of that article.
55 In accordance with Article 17(1) of the regulation, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase those data without undue delay where one of the grounds set out in that provision applies. As grounds, the provision mentions the cases in which the personal data are no longer necessary in relation to the purposes for which they were processed; the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; the data subject objects to the processing pursuant to Article 21(1) or (2) of the regulation, which replaces Article 14 of Directive 95/46; the data have been unlawfully processed; the data have to be erased for compliance with a legal obligation; or the data have been collected in relation to the offer of information society services to children.
56 However, Article 17(3) of Regulation 2016/679 states that Article 17(1) of the regulation is not to apply to the extent that the processing is necessary on one of the grounds set out in Article 17(3). Among those grounds is, in Article 17(3)(a) of the regulation, the exercise of the right of freedom of expression and information.
57 The circumstance that Article 17(3)(a) of Regulation 2016/679 now expressly provides that the data subject’s right to erasure is excluded where the processing is necessary for the exercise of the right of information, guaranteed by Article 11 of the Charter, is an expression of the fact that the right to protection of personal data is not an absolute right but, as recital 4 of the regulation states, must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see also judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 48, and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 136).
58 In that context, it should be recalled that Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 50).
59 Regulation 2016/679, in particular Article 17(3)(a), thus expressly lays down the requirement to strike a balance between the fundamental rights to privacy and protection of personal data guaranteed by Articles 7 and 8 of the Charter, on the one hand, and the fundamental right of freedom of information guaranteed by Article 11 of the Charter, on the other.
60 It is in the light of those considerations that an examination must be made of the conditions in which the operator of a search engine is required to accede to a request for de-referencing and thus to delete from the list of results displayed following a search on the basis of the data subject’s name the link to a web page on which there are personal data falling within the special categories in Article 8(1) and (5) of Directive 95/46.
61 It must be stated, to begin with, that the processing by the operator of a search engine of the special categories of data referred to in Article 8(1) of Directive 95/46 is capable in principle of being covered by the exceptions in Article 8(2)(a) and (e), mentioned by the referring court, which provides that the prohibition is not to apply where the data subject has given his or her explicit consent to such processing, except where the laws of the Member State concerned prohibit such consent, or where the processing relates to data which are manifestly made public by the data subject. Those exceptions have now been repeated in Article 9(2)(a) and (e) of Regulation 2016/679. In addition, Article 9(2)(g) of the regulation, which essentially reproduces Article 8(4) of Directive 95/46, allows the processing of those categories of data where it is necessary for reasons of substantial public interest, on the basis of European Union or Member State law which must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
62 With respect to the exception in Article 8(2)(a) of Directive 95/46 and Article 9(2)(a) of Regulation 2016/679, it follows from the definition of ‘consent’ in Article 2(h) of that directive and Article 4(11) of that regulation that the consent must be ‘specific’ and must therefore relate specifically to the processing carried out in connection with the activity of the search engine, and thus to the fact that the processing enables third parties, by means of a search based on the data subject’s name, to obtain a list of results including links leading to web pages containing sensitive data relating to him or her. In practice, it is scarcely conceivable — nor, moreover, does it appear from the documents before the Court — that the operator of a search engine will seek the express consent of data subjects before processing personal data concerning them for the purposes of his referencing activity. In any event, as inter alia the French and Polish Governments and the Commission have observed, the mere fact that a person makes a request for de-referencing means, in principle, at least at the time of making the request, that he or she no longer consents to the processing carried out by the operator of the search engine. In this connection, it should also be recalled that Article 17(1)(b) of the regulation mentions among the grounds justifying the ‘right to be forgotten’ the data subject’s withdrawal of the consent on which the processing is based in accordance with Article 9(2)(a) of the regulation, where there is no other legal ground for the processing.
63 By contrast, the circumstance, referred to in Article 8(2)(e) of Directive 95/46 and Article 9(2)(e) of Regulation 2016/679, that the data in question are manifestly made public by the data subject is intended to apply, as has been observed by all those who have made submissions on the point, both to the operator of the search engine and to the publisher of the web page concerned.
64 Consequently, in such a case, despite the presence on the web page referenced of personal data falling within the special categories in Article 8(1) of Directive 95/46 and Article 9(1) of Regulation 2016/679, the processing of those data by the operator of the search engine in connection with its activity, provided that the other conditions of lawfulness are satisfied, in particular those laid down by Article 6 of the directive or Article 5 of the regulation (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 72), is compliant with those provisions.
65 However, even in that case, the data subject may, pursuant to Article 14(a) of Directive 95/46 or Article 17(1)(c) and Article 21(1) of Regulation 2016/679, have the right to de-referencing of the link in question on grounds relating to his or her particular situation.
66 In any event, when the operator of a search engine receives a request for de-referencing, he must ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 or Article 9(2)(g) of Regulation 2016/679 and in compliance with the conditions laid down in those provisions, whether the inclusion of the link to the web page in question in the list displayed following a search on the basis of the data subject’s name is necessary for exercising the right of freedom of information of internet users potentially interested in accessing that web page by means of such a search, a right protected by Article 11 of the Charter. While the data subject’s rights protected by Articles 7 and 8 of the Charter override, as a general rule, the freedom of information of internet users, that balance may, however, depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information, an interest which may vary, in particular, according to the role played by the data subject in public life (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 81).
67 Furthermore, where the processing relates to the special categories of data mentioned in Article 8(1) and (5) of Directive 95/46 or Article 9(1) and Article 10 of Regulation 2016/679, the interference with the data subject’s fundamental rights to privacy and protection of personal data is, as observed in paragraph 44 above, liable to be particularly serious because of the sensitivity of those data.
68 Consequently, where the operator of a search engine receives a request for de-referencing relating to a link to a web page on which such sensitive data are published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data laid down in Articles 7 and 8 of the Charter, ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 or Article 9(2)(g) of Regulation 2016/679 and in compliance with the conditions laid down in those provisions, whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter.
69 It follows from all the above considerations that the answer to Question 2 is as follows:
– The provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the operator of a search engine is in principle required by those provisions, subject to the exceptions provided for by the directive, to accede to requests for de-referencing in relation to links to web pages containing personal data falling within the special categories referred to by those provisions.
– Article 8(2)(e) of Directive 95/46 must be interpreted as meaning that, pursuant to that article, such an operator may refuse to accede to a request for de-referencing if he establishes that the links at issue lead to content comprising personal data falling within the special categories referred to in Article 8(1) but whose processing is covered by the exception in Article 8(2)(e) of the directive, provided that the processing satisfies all the other conditions of lawfulness laid down by the directive, and unless the data subject has the right under Article 14(a) of the directive to object to that processing on compelling legitimate grounds relating to his particular situation.
– The provisions of Directive 95/46 must be interpreted as meaning that, where the operator of a search engine has received a request for de-referencing relating to a link to a web page on which personal data falling within the special categories referred to in Article 8(1) or (5) of Directive 95/46 are published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data laid down in Articles 7 and 8 of the Charter, ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of the directive and in compliance with the conditions laid down in that provision, whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter.
Question 3
70 As this question is asked only in the event that Question 1 is answered in the negative, there is no need to answer it, given the affirmative answer to Question 1.
Question 4
71 By its fourth question, the referring court essentially asks whether the provisions of Directive 95/46 must be interpreted as meaning that
– first, information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46, and
– second, the operator of a search engine is required to accede to a request for de-referencing relating to links to web pages displaying such information, where the information relates to an earlier stage of the legal proceedings in question and, having regard to the progress of the proceedings, no longer corresponds to the current situation?
72 In this respect, it must be stated, as the Advocate General observed in point 100 of his Opinion and as submitted inter alia by the French Government, Ireland, the Italian and Polish Governments and the Commission, that information concerning legal proceedings brought against an individual, such as information relating to the judicial investigation and the trial and, as the case may be, the ensuing conviction, is data relating to ‘offences’ and ‘criminal convictions’ within the meaning of the first subparagraph of Article 8(5) of Directive 95/46 and Article 10 of Regulation 2016/679, regardless of whether or not, in the course of those legal proceedings, the offence for which the individual was prosecuted was shown to have been committed.
73 Consequently, by including in the list of results displayed following a search carried out on the basis of the data subject’s name links to web pages on which such data are published, the operator of a search engine carries out a processing of those data which, in accordance with the first subparagraph of Article 8(5) of Directive 95/46 and Article 10 of Regulation 2016/679, is subject to special restrictions. As the Commission observed, such processing may, by virtue of those provisions and subject to compliance with the other conditions of lawfulness laid down by that directive, be lawful in particular if appropriate and specific guarantees are provided for by national law, which may be the case where the information in question has been disclosed to the public by the public authorities in compliance with the applicable national law.
74 As regards those other conditions of lawfulness, it must be recalled that it follows from the requirements laid down in Article 6(1)(c) to (e) of Directive 95/46, now repeated in Article 5(1)(c) to (e) of Regulation 2016/679, that even initially lawful processing of accurate data may over time become incompatible with the directive or the regulation where those data are no longer necessary in the light of the purposes for which they were collected or processed. That is so in particular where they appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those purposes and in the light of the time that has elapsed (judgment of 13 May 2014, Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 93).
75 However, as stated in paragraph 66 above, even if the processing of data referred to in Article 8(5) of Directive 95/46 and Article 10 of Regulation 2016/679 does not correspond to the restrictions laid down by those provisions or the other conditions of lawfulness, such as those laid down in Article 6(1)(c) to (e) of the directive and Article 5(1)(c) to (e) of the regulation, the operator of a search engine must still ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of the directive or Article 9(2)(g) of the regulation and in compliance with the conditions laid down in those provisions, whether the inclusion of the link to the web page in question in the list displayed following a search on the basis of the data subject’s name is necessary for exercising the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter.
76 In this respect, it must be recalled that it follows from the case-law of the European Court of Human Rights that applications brought by individuals for the prohibition under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950, of the making available on the internet by the various media of old reports of criminal proceedings that had been brought against them call for an examination of the fair balance to be struck between their right to respect for their private life and inter alia the public’s freedom of information. In seeking that fair balance, account must be taken of the essential role played by the press in a democratic society, which includes reporting and commenting on legal proceedings. Moreover, to the media’s function of communicating such information and ideas there must be added the public’s right to receive them. The European Court of Human Rights acknowledged in this context that the public had an interest not only in being informed about a topical event, but also in being able to conduct research into past events, with the public’s interest as regards criminal proceedings varying in degree, however, and possibly evolving over time according in particular to the circumstances of the case (ECtHR, 28 June 2018, M.L. and W.W. v. Germany, CE:ECHR:2018:0628JUD006079810, §§ 89 and 100 to 102).
77 It is thus for the operator of a search engine to assess, in the context of a request for de-referencing relating to links to web pages on which information is published relating to criminal proceedings brought against the data subject, concerning an earlier stage of the proceedings and no longer corresponding to the current situation, whether, in the light of all the circumstances of the case, such as, in particular, the nature and seriousness of the offence in question, the progress and the outcome of the proceedings, the time elapsed, the part played by the data subject in public life and his past conduct, the public’s interest at the time of the request, the content and form of the publication and the consequences of publication for the data subject, he or she has a right to the information in question no longer, in the present state of things, being linked with his or her name by a list of results displayed following a search carried out on the basis of that name.
78 It must, however, be added that, even if the operator of a search engine were to find that that is not the case because the inclusion of the link in question is strictly necessary for reconciling the data subject’s rights to privacy and protection of personal data with the freedom of information of potentially interested internet users, the operator is in any event required, at the latest on the occasion of the request for de-referencing, to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, which means in particular that links to web pages containing information on that point must appear in first place on the list.
79 Having regard to the above considerations, the answer to Question 4 is that the provisions of Directive 95/46 must be interpreted as meaning that
– first, information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46, and
– second, the operator of a search engine is required to accede to a request for de-referencing relating to links to web pages displaying such information, where the information relates to an earlier stage of the legal proceedings in question and, having regard to the progress of the proceedings, no longer corresponds to the current situation, in so far as it is established in the verification of the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 that, in the light of all the circumstances of the case, the data subject’s fundamental rights guaranteed by Articles 7 and 8 of the Charter override the rights of potentially interested internet users protected by Article 11 of the Charter.
Costs
80 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1. The provisions of Article 8(1) and (5) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject.
2. The provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the operator of a search engine is in principle required by those provisions, subject to the exceptions provided for by the directive, to accede to requests for de-referencing in relation to links to web pages containing personal data falling within the special categories referred to by those provisions.
Article 8(2)(e) of Directive 95/46 must be interpreted as meaning that, pursuant to that article, such an operator may refuse to accede to a request for de-referencing if he establishes that the links at issue lead to content comprising personal data falling within the special categories referred to in Article 8(1) but whose processing is covered by the exception in Article 8(2)(e) of the directive, provided that the processing satisfies all the other conditions of lawfulness laid down by the directive, and unless the data subject has the right under Article 14(a) of the directive to object to that processing on compelling legitimate grounds relating to his particular situation.
The provisions of Directive 95/46 must be interpreted as meaning that, where the operator of a search engine has received a request for de-referencing relating to a link to a web page on which personal data falling within the special categories referred to in Article 8(1) or (5) of Directive 95/46 are published, the operator must, on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data laid down in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of the directive and in compliance with the conditions laid down in that provision, whether the inclusion of that link in the list of results displayed following a search on the basis of the data subject’s name is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter.
3. The provisions of Directive 95/46 must be interpreted as meaning that
– first, information relating to legal proceedings brought against an individual and, as the case may be, information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46, and
– second, the operator of a search engine is required to accede to a request for de-referencing relating to links to web pages displaying such information, where the information relates to an earlier stage of the legal proceedings in question and, having regard to the progress of the proceedings, no longer corresponds to the current situation, in so far as it is established in the verification of the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 that, in the light of all the circumstances of the case, the data subject’s fundamental rights guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union override the rights of potentially interested internet users protected by Article 11 of the Charter.
[Signatures]