GC and Others v CNIL

EUR-Lex - 62017CJ0136 - EN - EUR-Lex × Skip to main content Log in My EUR-Lex My EUR-Lex Sign in Register My recent searches (0) English English Select your language Official EU languages: bg български es Español cs Čeština da Dansk de Deutsch et Eesti keel el Ελληνικά en English fr Français ga Gaeilge hr Hrvatski it Italiano lv Latviešu valoda lt Lietuvių kalba hu Magyar mt Malti nl Nederlands pl Polski pt Português ro Română sk Slovenčina sl Slovenščina fi Suomi sv Svenska EUR-Lex Access to European Union law <a href="https://eur-lex.europa.eu/content/help/eurlex-content/experimental-features.html" target="_blank">More about the experimental features corner</a> Experimental features × Choose the experimental features you want to try Do you want to help improving EUR-Lex ? This is a list of experimental features that you can enable. These features are still under development; they are not fully tested, and might reduce EUR-Lex stability. Don't forget to give your feedback! Warning! Experimental feature conflicts detected. Replacement of CELEX identifiers by short titles - experimental feature. It replaces clickable CELEX identifiers of treaties and case-law by short titles. Visualisation of document relationships. It displays a dynamic graph with relations between the act and related documents. It is currently only available for legal acts. Deep linking. It enables links to other legal acts referred to within the documents. It is currently only available for documents smaller than 900 KB. Apply EUR-Lex Access to European Union law This document is an excerpt from the EUR-Lex website You are here EUROPA EUR-Lex home EUR-Lex - 62017CJ0136 - EN Help Print Menu EU law Treaties Treaties currently in force Founding Treaties Accession Treaties Other treaties and protocols Chronological overview Legal acts Consolidated texts International agreements Preparatory documents EFTA documents Lawmaking procedures Summaries of EU legislation Browse by EU institutions European Parliament European Council Council of the European Union European Commission Court of Justice of the European Union European Central Bank European Court of Auditors European Economic and Social Committee European Committee of the Regions Browse by EuroVoc EU case-law Case-law Reports of cases Directory of case-law Official Journal Access to the Official Journal Official Journal L series daily view Official Journal C series daily view Browse the Official Journal Legally binding printed editions Special edition National law and case-law National transposition National case-law JURE case-law Information Themes in focus EUR-Lex developments Statistics ELI register What is ELI ELI background Why implement ELI Countries implementing ELI Testimonials Implementing ELI Glossary EU budget online Quick search Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care). Search tips Need more search options? Use the Advanced search Document 62017CJ0136 Help Print Text Document information Abstract Case file Permanent link Download notice Save to My items Create an email alert Create an RSS alert ​ Judgment of the Court (Grand Chamber) of 24 September 2019.#GC and Others v Commission nationale de l'informatique et des libertés (CNIL).#Request for a preliminary ruling from the Conseil d'État.#Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data contained on websites — Directive 95/46/EC — Regulation (EU) 2016/679 — Search engines on the internet — Processing of data appearing on websites — Special categories of data referred to in Article 8 of Directive 95/46 and Articles 9 and 10 of Regulation 2016/679 — Applicability of those articles to operators of a search engine — Extent of that operator’s obligations with respect to those articles — Publication of data on websites solely for journalistic purposes or the purpose of artistic or literary expression — Effect on the handling of a request for de-referencing — Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union.#Case C-136/17. Judgment of the Court (Grand Chamber) of 24 September 2019. GC and Others v Commission nationale de l'informatique et des libertés (CNIL). Request for a preliminary ruling from the Conseil d'État. Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data contained on websites — Directive 95/46/EC — Regulation (EU) 2016/679 — Search engines on the internet — Processing of data appearing on websites — Special categories of data referred to in Article 8 of Directive 95/46 and Articles 9 and 10 of Regulation 2016/679 — Applicability of those articles to operators of a search engine — Extent of that operator’s obligations with respect to those articles — Publication of data on websites solely for journalistic purposes or the purpose of artistic or literary expression — Effect on the handling of a request for de-referencing — Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union. Case C-136/17. Judgment of the Court (Grand Chamber) of 24 September 2019. GC and Others v Commission nationale de l'informatique et des libertés (CNIL). Request for a preliminary ruling from the Conseil d'État. Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data contained on websites — Directive 95/46/EC — Regulation (EU) 2016/679 — Search engines on the internet — Processing of data appearing on websites — Special categories of data referred to in Article 8 of Directive 95/46 and Articles 9 and 10 of Regulation 2016/679 — Applicability of those articles to operators of a search engine — Extent of that operator’s obligations with respect to those articles — Publication of data on websites solely for journalistic purposes or the purpose of artistic or literary expression — Effect on the handling of a request for de-referencing — Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union. Case C-136/17. Court reports – general – 'Information on unpublished decisions' section ECLI identifier: ECLI:EU:C:2019:773 Expand all Collapse all Languages and formats available Language of the case Language BG ES CS DA DE ET EL EN FR GA HR IT LV LT HU MT NL PL PT RO SK SL FI SV HTML EN Toggle Dropdown BG ES CS DA DE ET EL EN FR GA HR IT LV LT HU MT NL PL PT RO SK SL FI SV PDF EN Toggle Dropdown BG ES CS DA DE ET EL EN FR GA HR IT LV LT HU MT NL PL PT RO SK SL FI SV Document published in the digital reports of cases. They have official status. Multilingual display Language 1 English (en) Bulgarian (bg) Spanish (es) Czech (cs) Danish (da) German (de) Estonian (et) Greek (el) English (en) French (fr) Croatian (hr) Italian (it) Latvian (lv) Lithuanian (lt) Hungarian (hu) Maltese (mt) Dutch (nl) Polish (pl) Portuguese (pt) Romanian (ro) Slovak (sk) Slovenian (sl) Finnish (fi) Swedish (sv) Language 2 Please choose Bulgarian (bg) Spanish (es) Czech (cs) Danish (da) German (de) Estonian (et) Greek (el) English (en) French (fr) Croatian (hr) Italian (it) Latvian (lv) Lithuanian (lt) Hungarian (hu) Maltese (mt) Dutch (nl) Polish (pl) Portuguese (pt) Romanian (ro) Slovak (sk) Slovenian (sl) Finnish (fi) Swedish (sv) Language 3 Please choose Bulgarian (bg) Spanish (es) Czech (cs) Danish (da) German (de) Estonian (et) Greek (el) English (en) French (fr) Croatian (hr) Italian (it) Latvian (lv) Lithuanian (lt) Hungarian (hu) Maltese (mt) Dutch (nl) Polish (pl) Portuguese (pt) Romanian (ro) Slovak (sk) Slovenian (sl) Finnish (fi) Swedish (sv) Display Text JUDGMENT OF THE COURT (Grand Chamber) 24 September 2019 ( *1 ) (Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of personal data contained on websites — Directive 95/46/EC — Regulation (EU) 2016/679 — Search engines on the internet — Processing of data appearing on websites — Special categories of data referred to in Article 8 of Directive 95/46 and Articles 9 and 10 of Regulation 2016/679 — Applicability of those articles to operators of a search engine — Extent of that operator’s obligations with respect to those articles — Publication of data on websites solely for journalistic purposes or the purpose of artistic or literary expression — Effect on the handling of a request for de-referencing — Articles 7, 8 and 11 of the Charter of Fundamental Rights of the European Union) In Case C‑136/17, REQUEST for a preliminary ruling under Article 267 TFEU from the Conseil d’État (Council of State, France), made by decision of 24 February 2017, received at the Court on 15 March 2017, in the proceedings GC, AF, BH, ED v Commission nationale de l’informatique et des libertés (CNIL), interveners: Premier ministre, Google LLC , successor to Google Inc., THE COURT (Grand Chamber), composed of K. Lenaerts, President, A. Arabadjiev, A. Prechal, T. von Danwitz, C. Toader and F. Biltgen, Presidents of Chambers, M. Ilešič (Rapporteur), L. Bay Larsen, M. Safjan, D. Šváby, C.G. Fernlund, C. Vajda and S. Rodin, Judges, Advocate General: M. Szpunar, Registrar: V. Giacobbo-Peyronnel, administrator, having regard to the written procedure and further to the hearing on 11 September 2018, after considering the observations submitted on behalf of: – AF, by himself, – BH, by L. Boré, avocat, – Commission nationale de l’informatique et des libertés (CNIL), by I. Falque-Pierrotin, J. Lessi and G. Le Grand, acting as Agents, – Google LLC, by P. Spinosi, Y. Pelosi and W. Maxwell, avocats, – the French Government, by D. Colas, R. Coesme, E. de Moustier and S. Ghiandoni, acting as Agents, – Ireland, by M. Browne, G. Hodge, J. Quaney and A. Joyce, acting as Agents, and M. Gray, Barrister-at-Law, – the Greek Government, by E.-M. Mamouna, G. Papadaki, E. Zisi and S. Papaioannou, acting as Agents, – the Italian Government, by G. Palmieri, acting as Agent, and F. De Luca and P. Gentili, avvocati dello Stato, – the Austrian Government, by G. Eberhard and G. Kunnert, acting as Agents, – the Polish Government, by B. Majczyna, M. Pawlicka and J. Sawicka, acting as Agents, – the United Kingdom Government, by S. Brandon, acting as Agent, and C. Knight, Barrister, – the European Commission, by A. Buchet, H. Kranenborg and D. Nardi, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 10 January 2019, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ( OJ 1995 L 281, p. 31 ). 2 The request has been made in proceedings between GC, AF, BH and ED and the Commission nationale de l’informatique et des libertés (French Data Protection Authority, France) (‘the CNIL’) concerning four decisions of the CNIL refusing to serve formal notice on Google Inc., now Google LLC, to de-reference various links appearing in the lists of results displayed following searches of their names and leading to web pages published by third parties. Legal context EU law Directive 95/46 3 The object of Directive 95/46, in accordance with Article 1(1), is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to eliminate obstacles to the free flow of personal data. 4 Recitals 33 and 34 of Directive 95/46 state: ‘(33) Whereas data which are capable by their nature of infringing fundamental freedoms or privacy should not be processed unless the data subject gives his explicit consent; whereas, however, derogations from this prohibition must be explicitly provided for in respect of specific needs … (34) Whereas Member States must also be authorised, when justified by grounds of important public interest, to derogate from the prohibition on processing sensitive categories of data …; whereas it is incumbent on them, however, to provide specific and suitable safeguards so as to protect the fundamental rights and the privacy of individuals;’ 5 Article 2 of Directive 95/46 provides: ‘For the purposes of this Directive: (a) “personal data” shall mean any information relating to an identified or identifiable natural person (“data subject”); … (b) “processing of personal data” (“processing”) shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; … (d) “controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; … … (h) “the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.’ 6 In Chapter II, Section I of Directive 95/46, headed ‘Principles relating to data quality’, Article 6 reads as follows: ‘1. Member States shall provide that personal data must be: (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. … (c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed; (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified; (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use. 2. It shall be for the controller to ensure that paragraph 1 is complied with.’ 7 In Chapter II, Section II of Directive 95/46, headed ‘Criteria for making data processing legitimate’, Article 7 provides: ‘Member States shall provide that personal data may be processed only if: … (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).’ 8 Articles 8 and 9 of Directive 95/46 appear in Chapter II, Section III, headed ‘Special categories of processing’. Article 8, headed ‘The processing of special categories of data’, provides: ‘1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. 2. Paragraph 1 shall not apply where: (a) the data subject has given his explicit consent to the processing of those data, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his consent; or … (e) the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims. … 4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority. 5. Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases shall also be processed under the control of official authority. …’ 9 Article 9 of Directive 95/46, headed ‘Processing of personal data and freedom of expression’, states: ‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’ 10 Article 12 of Directive 95/46, headed ‘Right of access’, provides: ‘Member States shall guarantee every data subject the right to obtain from the controller: … (b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data; …’ 11 Article 14 of Directive 95/46, headed ‘The data subject’s right to object’, provides: ‘Member States shall grant the data subject the right: (a) at least in the cases referred to in Article 7(e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the processing instigated by the controller may no longer involve those data; …’ 12 Article 28 of Directive 95/46, headed ‘Supervisory authority’, reads as follows: ‘1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive. … 3. Each authority shall in particular be endowed with: – investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties, – effective powers of intervention, such as, for example, that … of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing … – … Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts. 4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim. … 6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State. The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information. …’ Regulation (EU) 2016/679 13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 , and corrigendum OJ 2018 L 127, p. 2 ) applies, in accordance with Article 99(2), from 25 May 2018. Article 94(1) of that regulation provides that Directive 95/46 is repealed with effect from that date. 14 Recitals 1, 4, 51, 52 and 65 of Regulation 2016/679 state: ‘(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her. … (4) The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, … the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, … … (51) Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. … (52) Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and other fundamental rights … … (65) A data subject should have … a “right to be forgotten” where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. … However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information …’ 15 Article 4(11) of Regulation 2016/679 defines ‘consent’ as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’. 16 Article 5 of Regulation 2016/679, headed ‘Principles relating to processing of personal data’, provides in paragraph 1(c) to (e): ‘Personal data shall be: … (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; … (“storage limitation”).’ 17 Article 9 of Regulation 2016/679, headed ‘Processing of special categories of personal data’, provides: ‘1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. 2. Paragraph 1 shall not apply if one of the following applies: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; … (e) processing relates to personal data which are manifestly made public by the data subject; … (g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject; …’ 18 Article 10 of Regulation 2016/679, headed ‘Processing of personal data relating to criminal convictions and offences’, provides: ‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’ 19 Article 17 of Regulation 2016/679, headed ‘Right to erasure (“right to be forgotten”)’, reads as follows: ‘1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; …’ 20 Article 21 of Regulation 2016/679, headed ‘Right to object’, provides in paragraph 1: ‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’ 21 Article 85 of Regulation 2016/679, headed ‘Processing and freedom of expression and information’, provides: ‘1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. 2. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information. …’ French law 22 Directive 95/46 was implemented in French law by Loi No 78-17, du 6 janvier 1978, relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 of 6 January 1978 on information technology, data files and civil liberties), in the version applicable to the facts of the main proceedings. 23 Article 11 of that law states that, among its functions, the CNIL is to ensure that the processing of personal data is carried out in accordance with the provisions of that law, and that, on that basis, it is to receive claims, petitions and complaints relating to the processing of personal data and is to inform their authors of their outcome. The disputes in the main proceedings and the questions referred for a preliminary ruling 24 GC, AF, BH and ED each requested Google to de-reference, in the list of results displayed by the search engine operated by Google in response to searches against their names, various links leading to web pages published by third parties; Google, however, refused to do this. 25 More particularly, GC requested the de-referencing of a link leading to a satirical photomontage placed online pseudonymously on 18 February 2011 on YouTube, depicting her alongside the mayor of a municipality whom she served as head of cabinet and explicitly referring to an intimate relationship between them and to the impact of that relationship on her own political career. The photomontage was placed online during the campaign for the cantonal elections in which GC was then a candidate. On the date on which her request for de-referencing was refused she was neither a local councillor nor a candidate for local elective office and no longer served as the head of cabinet of the mayor of the municipality. 26 AF requested de-referencing of links leading to an article in the daily newspaper Libération of 9 September 2008, reproduced on the site of the Centre contre les manipulations mentales (Centre against mental manipulation) (CCMM) (France), concerning the suicide of a member of the Church of Scientology in December 2006. AF is mentioned in that article in his capacity as public relations officer of the Church of Scientology, an occupation which he has since ceased to exercise. Furthermore, the author of the article states that he contacted AF in order to obtain his version of the facts and describes the comments received on that occasion. 27 BH requested the de-referencing of links leading to articles, mainly in the press, concerning the judicial investigation opened in June 1995 into the funding of the Parti républicain (PR), in which he was questioned with a number of businessmen and political personalities. The proceedings against him were closed by an order discharging him on 26 February 2010. Most of the links are to articles contemporaneous with the opening of the investigation and therefore do not mention the outcome of the proceedings. 28 ED requested the de-referencing of links leading to two articles published in Nice Matin and Le Figaro reporting the criminal hearing during which he was sentenced to 7 years’ imprisonment and an additional penalty of 10 years’ social and judicial supervision for sexual assaults on children under the age of 15. One of the accounts of the court proceedings also mentions several intimate details relating to ED that were revealed at the hearing. 29 Following the rejections by Google of their requests for de-referencing, the applicants in the main proceedings brought complaints before the CNIL, seeking for Google to be ordered to de-reference the links in question. By letters dated 24 April 2015, 28 August 2015, 21 March 2016 and 9 May 2016 respectively, the president of the CNIL informed them that the procedures on their complaints had been closed. 30 The applicants in the main proceedings thereupon made applications to the referring court, the Conseil d’État (Council of State, France), against those refusals of the CNIL to serve formal notice on Google to carry out the de-referencing requested. The applications were joined by the referring court. 31 Finding that the applications raised several serious difficulties of interpretation of Directive 95/46, the Conseil d’État (Council of State) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: ‘(1) Having regard to the specific responsibilities, powers and capabilities of the operator of a search engine, does the prohibition imposed on other controllers of processing data caught by Article 8(1) and (5) of Directive 95/46, subject to the exceptions laid down there, also apply to this operator as the controller of processing by means of that search engine? (2) If Question 1 should be answered in the affirmative: [(a)] Must Article 8(1) and (5) of Directive 95/46 be interpreted as meaning that the prohibition so imposed on the operator of a search engine of processing data covered by those provisions, subject to the exceptions laid down by that directive, would require the operator to grant as a matter of course the requests for de-referencing in relation to links to web pages concerning such data? [(b)] From that perspective, how must the exceptions laid down in Article 8(2)(a) and (e) of Directive 95/46 be interpreted, when they apply to the operator of a search engine, in the light of its specific responsibilities, powers and capabilities? In particular, may such an operator refuse a request for de-referencing, if it establishes that the links at issue lead to content which, although comprising data falling within the categories listed in Article 8(1), is also covered by the exceptions laid down by Article 8(2) of the directive, in particular points (a) and (e)? [(c)] Similarly, when the links subject to the request for de-referencing lead to processing of personal data carried out solely for journalistic purposes or for those of artistic or literary expression, on which basis, in accordance with Article 9 of Directive 95/46, data within the categories mentioned in Article 8(1) and (5) of the directive may be collected and processed, must the provisions of Directive 95/46 be interpreted as allowing the operator of a search engine, on that ground, to refuse a request for de-referencing? (3) If Question 1 should be answered in the negative: [(a)] Which specific requirements of Directive 95/46 must be met by the operator of a search engine, in view of its responsibilities, powers and capabilities? [(b)] When the operator establishes that the web pages at the end of the links subject to the request for de-referencing comprise data whose publication on those pages is unlawful, must the provisions of Directive 95/46 be interpreted as: – requiring the operator of a search engine to remove those links from the list of results displayed following a search made on the basis of the name of the person making the request; or – meaning only that it is to take that factor into consideration in assessing the merits of the request for de-referencing, or – meaning that this factor has no bearing on the assessment it is to make? Furthermore, if that factor is not irrelevant, how is the lawfulness of the publication on web pages of the data at issue which stem from processing falling outside the territorial scope of Directive 95/46 and, accordingly, of the national laws implementing it to be assessed? (4) Irrespective of the answer to be given to Question 1: [(a)] whether or not publication of the personal data on the web page at the end of the link at issue is lawful, must the provisions of Directive 95/46 be interpreted as: – requiring the operator of a search engine, when the person making the request establishes that the data in question have become incomplete or inaccurate, or are no longer up to date, to grant the corresponding request for de-referencing; – more specifically, requiring the operator of a search engine, when the person making the request shows that, having regard to the conduct of the legal proceedings, the information relating to an earlier stage of those proceedings is no longer consistent with the current reality of his situation, to de-reference the links to web pages comprising such information? [(b)] Must Article 8(5) of Directive 95/46 be interpreted as meaning that information relating to the investigation of an individual or reporting a trial and the resulting conviction and sentencing constitutes data relating to offences and to criminal convictions? More generally, does a web page comprising data referring to the convictions of or legal proceedings involving a natural person fall within the ambit of those provisions?’ Consideration of the questions referred 32 The questions referred concern the interpretation of Directive 95/46, which was applicable at the time when the request for a preliminary ruling was submitted. That directive was repealed with effect from 25 May 2018, from which date Regulation 2016/679 applies. 33 The Court will consider the questions referred from the point of view of Directive 95/46, while also taking Regulation 2016/679 into account in its analysis of them, in order to ensure that its answers will in any event be of use to the referring court. Question 1 34 By its first question, the referring court essentially asks whether the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out for the needs of the functioning of the search engine. 35 It must be recalled, first, that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 when that information contains personal data and, second, that the operator of the search engine must be regarded as the ‘controller’ in respect of that processing within the meaning of Article 2(d) of that directive (judgment of 13 May 2014, Google Spain and Google, C‑131/12 , EU:C:2014:317 , paragraph 41 ). 36 The processing of personal data in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page, and that activity plays a decisive role in the overall dissemination of those data in that it renders the latter accessible to any internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published. Moreover, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet, enabling them to establish a more or less detailed profile of the data subject (judgment of 13 May 2014, Google Spain and Google, C‑131/12 , EU:C:2014:317 , paragraphs 35 to 37 ). 37 Consequently, in so far as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of his responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved (judgment of 13 May 2014, Google Spain and Google, C‑131/12 , EU:C:2014:317 , paragraph 38 ). 38 The first question referred aims to determine whether, in the context of his responsibilities, powers and capabilities, the operator of a search engine must also comply with the requirements laid down by Directive 95/46 with respect to the special categories of personal data mentioned in Article 8(1) and (5) of the directive, where such data are among the information published or placed on the internet by third parties and are the subject of processing by that operator for the purposes of the functioning of his search engine. 39 As regards the special categories of data, Article 8(1) of Directive 95/46 provides that the Member States are to prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of data concerning health or sex life. Certain exceptions to and derogations from that prohibition are provided for inter alia in Article 8(2) of the directive. 40 Article 8(5) of Directive 95/46 states that the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases are also to be processed under the control of official authority. 41 The content of Article 8(1) and (5) of Directive 95/46 was taken over, with some changes, in Article 9(1) and Article 10 of Regulation 2016/679. 42 It must be stated, first, that it is apparent from the wording of those provisions of Directive 95/46 and Regulation 2016/679 that the prohibition and restrictions laid down by them apply, subject to the exceptions provided for by the directive and the regulation, to every kind of processing of the special categories of data referred to in those provisions and to all controllers carrying out such processing. 43 Next, no other provision of that directive or that regulation provides for a general derogation from that prohibition or those restrictions for processing such as that carried out in the context of the activity of a search engine. On the contrary, as already pointed out in paragraph 37 above, it follows from the general scheme of those instruments that the operator of a search engine must, in the same way as any other controller, ensure, in the context of his responsibilities, powers and capabilities, that the processing of personal data carried out by him complies with the respective requirements of Directive 95/46 or Regulation 2016/679. 44 Finally, an interpretation of Article 8(1) and (5) of Directive 95/46 or Article 9(1) and Article 10 of Regulation 2016/679 that excluded a priori and generally the activity of a search engine from the specific requirements laid down by those provisions for processing relating to the special categories of data referred to there would run counter to the purpose of those provisions, namely to ensure enhanced protection as regards such processing, which, because of the particular sensitivity of the data, is liable to constitute, as also follows from recital 33 of that directive and recital 51 of that regulation, a particularly serious interference with the fundamental rights to privacy and the protection of personal data, guaranteed by Articles 7 and 8 of the Charter. 45 While, contrary to the submissions of Google in particular, the specific features of the processing carried out by the operator of a search engine in connection with the activity of the search engine cannot thus justify the operator being exempted from compliance with Article 8(1) and (5) of Directive 95/46 and Article 9(1) and Article 10 of Regulation 2016/679, those specific features may, however, have an effect on the extent of the operator’s responsibility and obligations under those provisions. 46 It must be observed in this respect that, as the European Commission emphasises, the operator of a search engine is responsible not because personal data referred to in those provisions appear on a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search on the basis of an individual’s name, since such a display of the link in such a list is liable significantly to affect the data subject’s fundamental rights to privacy and to the protection of the personal data relating to him (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C‑131/12 , EU:C:2014:317 , paragraph 80 ). 47 In those circumstances, having regard to the responsibilities, powers and capabilities of the operator of a search engine as the controller of the processing carried out in connection with the activity of the search engine, the prohibitions and restrictions in Article 8(1) and (5) of Directive 95/46 and Articles 9(1) and 10 of Regulation 2016/679 — as indicated by the Advocate General in point 56 of his Opinion and as stated in essence by all the parties who have expressed an opinion on the point — can apply to that operator only by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject. 48 It follows from the above that the answer to Question 1 is that the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject. Question 2 49 By its second question, which consists of three parts, the referring court essentially asks – whether the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the operator of a search engine is required by those provisions, subject to the exceptions provided for by the directive, to accede to requests for de-referencing in relation to links to web pages containing personal data falling within the special categories referred to by those provisions; – whether Article 8(2)(a) and (e) of Directive 95/46 must be interpreted as meaning that, pursuant to that article, such an operator may refuse to accede to a request for de-referencing if he establishes that the links at issue lead to content comprising personal data falling within the special categories referred to in Article 8(1) but whose processing is covered by one of the exceptions laid down in Article 8(2)(a) and (e) of the directive; and – whether the provisions of Directive 95/46 must be interpreted as meaning that the operator of a search engine may also refuse to accede to a request for de-referencing on the ground that the links whose de-referencing is requested lead to web pages on which the personal data falling within the special categories referred to in Article 8(1) or (5) of the directive are published solely for journalistic purposes or those of artistic or literary expression and the publication is therefore covered by the exception in Article 9 of the directive. 50 It should be noted, as a preliminary point, that in the context of Directive 95/46 requests for de-referencing such as those at issue in the main proceedings have their basis in particular in Article 12(b) of the directive, under which the Member States are to guarantee data subjects the right to obtain from the controller the erasure of data whose processing does not comply with the directive. 51 Moreover, in accordance with Article 14(a) of Directive 95/46, the Member States are to grant the data subject the right, at least in the cases referred to in Article 7(e) and (f) of the directive, to object at any time on compelling legitimate grounds relating to his or her particular situation to the processing of data relating to him or her, save where otherwise provided by national legislation. 52 In this respect,