GC and Others v Commission nationale de l'informatique et des libertés (CNIL)

1.

Reconciling the right to privacy and to the protection of personal data with the right to information and to freedom of expression in the internet era is one of the main challenges of our time. It is not surprising, therefore, that over recent years a number of cases raising legal questions connected with that problem have been brought before the Court.

2.

Once a question has been addressed and settled, new questions arise. That phenomenon is all the more problematic because very often the legal framework was not adopted with the internet era in mind. The case in the main proceedings, like Case C‑507/17, Google (Territorial scope of de-referencing), in which my Opinion is also delivered on the same day as in the present case, is a good example of that: how and to what extent do the obligations imposed by a 1995 directive on data protection, namely Directive 95/46/EC, ( 2 ) apply to a search engine such as Google, an undertaking created in 1998?

3.

In its landmark judgment of 13 May 2014, Google Spain and Google, ( 3 ) the Court held that, under Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46, individuals have a ‘right to be forgotten’ ( 4 ) that may entail an obligation for the operator of a search engine to remove the links to information relating to the individual in question. ( 5 ) The present case is a continuation of that judgment. In fact, following that judgment, a large number of new questions have arisen, concerning in particular the processing of what is known as ‘sensitive’ data, relating to racial or ethnic origin, political opinions and religious or philosophical beliefs.

4.

That is why, when I interpret the law as it exists, I shall also refer both to the legislation in force and to the interpretation of that legislation in the judgment in Google Spain and Google. ( 6 )

5.

In short, my proposal to the Court is twofold: first, as a general rule, the internet links to sensitive data should, on request, be systematically removed by the operator of a search engine; and, second, freedom of expression must be respected. In that regard, I invite the Court to interpret its judgment in Google Spain and Google ( 7 ) in such a way as to take due account of freedom of expression.

6.

According to Article 1, the purpose of Directive 95/46 is to protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, and to eliminate obstacles to the free flow of those data.

7.

Article 2 of Directive 95/46 provides that, ‘for the purposes of [that] Directive:

…

…

8.

Article 3 of that directive, entitled ‘Scope’, provides in paragraph 1:

‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.’

9.

Article 4 of that directive, entitled ‘National law applicable’, provides:

‘1.   Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where:

…’

10.

In Chapter II, Section I of Directive 95/46, entitled ‘Principles relating to data quality’, Article 6 provides:

‘1.   Member States shall provide that personal data must be:

2.   It shall be for the controller to ensure that paragraph 1 is complied with.’

11.

In Chapter II, Section II of Directive 95/46, entitled ‘Criteria for making data processing legitimate’, Article 7 provides:

‘Member States shall provide that personal data may be processed only if:

…

12.

Chapter II, Section III of Directive 95/46, entitled ‘Special categories of processing’, consists of Articles 8 and 9. Article 8 of that directive entitled ‘The processing of special categories of data’, provides:

‘1.   Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

2.   Paragraph 1 shall not apply where:

…

4.   Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority.

5.   Processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority.

Member States may provide that data relating to administrative sanctions or judgments in civil cases shall also be processed under the control of official authority.

6.   Derogations from paragraph 1 provided for in paragraphs 4 and 5 shall be notified to the Commission.

…’

13.

Article 9 of Directive 95/46, entitled ‘Processing of personal data and freedom of expression’, states:

‘Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.’

14.

Article 12 of that directive, entitled ‘Right of access’, provides:

‘Member States shall guarantee every data subject the right to obtain from the controller:

…

…’

15.

Article 14 of that directive, entitled ‘The data subject’s right to object’, provides:

‘Member States shall grant the data subject the right:

…’

16.

Article 28 of that directive, entitled ‘Supervisory authority’, is worded as follows:

‘1.   Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

…

3.   Each authority shall in particular be endowed with:

…

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4.   Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

…

6.   Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

…’

17.

Pursuant to Article 99(2), Regulation 2016/679 is to apply from 25 May 2018. Article 94(1) of that regulation provides that Directive 95/46 is repealed with effect from that date.

18.

Article 9 of that regulation, entitled ‘Processing of special categories of personal data’, provides:

‘1.   Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

2.   Paragraph 1 shall not apply if one of the following applies:

…

…

…’

19.

Article 10 of that regulation, entitled ‘Processing of personal data relating to criminal convictions and offences’, states:

‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’

20.

Article 17 of that regulation, entitled ‘Right to erasure (“right to be forgotten”)’, is worded as follows:

‘1.   The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

2.   Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

3.   Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

21.

Article 18 of Regulation 2016/679, entitled ‘Right to restriction of processing’, provides:

‘1.   The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

…

2.   Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

3.   A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.’

22.

Article 21 of that regulation, entitled ‘Right to object’, provides in paragraph 1:

‘The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.’

23.

Article 85 of that regulation, entitled ‘Processing and freedom of expression and information’, states:

‘1.   Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.

2.   For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

3.   Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.’

24.

Directive 95/46 was implemented in French law by loi no 78-17 relative à l’informatique, aux fichiers et aux libertés (Law No 78-17 on information technology, data files and civil liberties) of 6 January 1978.

25.

G.C., A.F., B.H. and E.D. all requested Google LLC to de-reference various links to pages published by third parties in the list of results displayed by the search engine operated by that company in response to a search against their respective names, which it refused to do.

26.

More specifically, G.C. requested the de-referencing of a link referring to a satirical photomontage placed online, under a pseudonym, on 18 February 2011 on the channel YouTube, depicting her alongside the local mayor, whom she served as head of cabinet, and explicitly drawing attention to the intimate relationship between them and also to the impact of that relationship on her own political career. That photomontage was placed online during the campaign for the cantonal elections in which G.C. was then a candidate. When her request for de-referencing was refused she was neither an elected local representative nor a candidate for local elective office and no longer served as the local mayor’s head of cabinet.

27.

A.F. requested the de-referencing of links referring to an article in the daily newspaper Libération of 9 September 2008, reproduced on the site of the Centre contre les manipulations mentales (Centre against mental manipulation) (CCMM), concerning the suicide of a member of the Church of Scientology in December 2006. A.F. is mentioned in that article in his capacity as public relations officer of the Church of Scientology, an occupation which he has since ceased to exercise. Furthermore, the author of the article at issue states that he contacted A.F. in order to obtain his version of the facts and describes the comments received on that occasion.

28.

B.H. requested the de-referencing of links to articles, mainly in the press, concerning the judicial investigation opened in June 1995 into the funding of the Parti républicain (PR), in which he was questioned with a number of businessmen and political personalities. The proceedings against him were closed by an order discharging him on 26 February 2010. Most of the links are to articles contemporaneous with the opening of the investigation and therefore do not mention the outcome of the proceedings.

29.

E.D. requested the de-referencing of links to two articles published in Nice Matin and le Figaro reporting the criminal hearing during which he was sentenced to 7 years’ imprisonment and an additional penalty of 10 years’ social and judicial supervision for sexual assaults on children under the age of 15. One of the accounts of the court proceedings also mentions several intimate details relating to E.D. that were revealed during the hearing.

30.

After Google refused their requests, the applicants lodged complaints with the Commission nationale de l’informatique et des libertés (French Data Protection Authority) (‘the CNIL’) claiming that it should order Google to de-reference the links at issue. By letters dated 24 April 2015, 28 August 2015, 21 March 2016 and 9 May 2016, the President of the CNIL informed the applicants that their complaints had been closed.

31.

The applicants then lodged applications against the CNIL’s refusal to serve formal notice on Google to proceed with the requested de-referencing. Those applications were joined by the referring court.

32.

The Conseil d’État (Council of State, France) found that those requests present a number of serious issues with respect to the interpretation of Directive 95/46 and, by decision of 24 February 2017, received at the Court on 15 March 2017, decided to stay proceedings and to refer the following questions to the Court for a preliminary ruling:

33.

A.F., B.H., Google, the French Government, Ireland, the Greek, Italian, Austrian, Polish and United Kingdom Governments and the European Commission lodged written observations.

34.

B.H., Google, the French Government, Ireland, the Greek, Austrian and Polish Governments and the Commission presented oral argument at the hearing on 11 September 2018.

35.

The questions submitted by the referring court concern not the interpretation of the provisions of Regulation 2016/679 but the interpretation of the provisions of Directive 95/46. In fact, that regulation, which has been applicable since 25 May 2018, ( 8 ) repealed the directive with effect from that date. ( 9 )

36.

Since it is apparent that, in French administrative procedural law, the law applicable to a dispute is the law in force on the day on which a contested decision was adopted, there can be no doubt that it is Directive 95/46 that is applicable to the dispute in the main proceedings. Consequently, it is the provisions of that directive that the Court is required to interpret.

37.

The backdrop to the questions submitted by the referring court in the present case is the landmark judgment in Google Spain and Google, ( 10 ) in which the Court held, in particular — and what is of interest for the present case —, that:

38.

The facts of the case that gave rise to the judgment in Google Spain and Google ( 15 ) concerned what were indeed personal data, but not ‘sensitive’ data within the meaning of Article 8 of Directive 95/46. That leads us to the first question.

39.

By its first question, the referring court asks whether, having regard to the specific responsibilities, powers and capabilities of the operator of a search engine, the prohibition imposed on other controllers of processing data caught by Article 8(1) and (5) of Directive 95/46 is also applicable to such an operator.

40.

Under Article 8(1) of Directive 95/46, Member States are to prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.

41.

Article 8(5) of that directive states that processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases are also to be processed under the control of official authority.

42.

It should be noted that Article 8 of Directive 95/46 was not at issue in the case that gave rise to the judgment in Google Spain and Google. ( 16 ) That simple assertion leads me to suppose that, contrary to what Google suggests in its observations, the answer to the first question cannot be inferred from that judgment. The fact that that case did not relate to sensitive data referred to in Article 8(1) of Directive 95/46 does not mean that a search engine is not subject to that provision.

43.

In his Opinion in Google Spain and Google, Advocate General Jääskinen gave the following reasons for his argument (which was not followed by the Court) that an internet search engine service provider is not a ‘controller’ of personal data on source web pages hosted on third-party servers: ‘An opposite opinion would entail internet search engines being incompatible with EU law, a conclusion I would find absurd. Specifically, if internet search engine service providers were considered [to be] controllers of the personal data on third-party source web pages and if on any of these pages there would be “special categories of data” referred to in Article 8 of … Directive [95/46] (e.g. personal data revealing [racial or ethnic origin,] political opinions or religious [or philosophical] beliefs[, trade-union membership] or data concerning the health or sex life of individuals), the activity of the internet search engine service provider would automatically become illegal, when the stringent conditions laid down in that article for the processing of such data were not met.’ ( 17 )

44.

That passage highlights the problems and the issues involved in the present case. Since Directive 95/46, which dates from 1995, and the obligations imposed in which are in principle addressed to the Member States, had not been drafted with search engines in their present form in mind, its provisions do not lend themselves to an intuitive and purely literal application to such search engines. It was precisely for that reason that, just as in the present case, the referring courts had doubts in the case that gave rise to the judgment in Google Spain and Google ( 18 ) and referred the matter to the Court.

45.

It is therefore impossible to take an ‘all or nothing’ approach to the applicability of the provisions of Directive 95/46 to search engines. In my view, it is necessary to examine each provision from the aspect of whether it is capable of being applied to a search engine.

46.

If Article 8(1) of Directive 95/46 were to be applied literally to a search engine, the effect would be that any processing of the data listed in that provision would be prohibited, subject to the exceptions provided for in Article 8(2) of that directive.

47.

In that regard, I note that none of the parties that have submitted observations argues in favour of such a strict interpretation, and they are quite correct not to do so.

48.

A literal application of Article 8(1) of Directive 95/46 would require a search engine to ascertain that a list of results displayed following a search carried out on the basis of the name of a natural person does not contain any link to internet pages comprising data covered by that provision, and to do so ex ante and systematically, that is to say, even in the absence of a request for de-referencing from a data subject.

49.

To my mind, an ex ante systematic control is neither possible nor desirable.

50.

In the judgment in Google Spain and Google, ( 19 ) the Court observed that ‘inasmuch as the activity of a search engine is therefore liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of its responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved’. ( 20 )

51.

It is possible to draw two conclusions from that passage. First of all, as the Commission maintains in its observations, Directive 95/46 proceeds from the principle that every controller must satisfy all the requirements which that directive lays down, including those provided for in Article 8.

52.

Next, and although that passage is formulated as an obligation placed on the operator of a search engine, ( 21 ) such an operator can act only within the framework of its responsibilities, powers and capabilities. In other words, such an operator may be incapable of ensuring the full effect of the provisions of Directive 95/46, precisely because of its limited responsibilities, powers and capabilities.

53.

Article 8 of Directive 95/46 must therefore be interpreted in such a way as to take account of the responsibilities, powers and capabilities of an operator of a search engine.

54.

In that regard, an ex ante application of Article 8(1) of Directive 95/46 to an operator of a search engine must be precluded. An ex ante control of internet pages which are referenced as the result of a search does not fall within the responsibilities or the capabilities ( 22 ) of a search engine. The task of the operator of a search engine is, as its title indicates, to search, find, point to and make available, by means of an algorithm that allows information to be found in the most effective manner. Conversely, it is not for the operator of a search engine to monitor, indeed to censure. The operator of a search engine acts for the purposes of the search and reacts for the purposes of the de-referencing of a search result. That, in any event, is how I understand the judgment in Google Spain and Google. ( 23 )

55.

By the same token, and as the Commission also emphasises, the prohibitions and restrictions laid down in Article 8(1) of Directive 95/46 cannot apply to an operator of a search engine as though it had itself caused the sensitive data to appear in the internet pages referenced. Logically, the activities of a search engine intervene only after (sensitive) data have been placed online and are secondary in nature.

56.

Accordingly, the prohibitions and restrictions laid down in Article 8(1) of Directive 95/46 can apply to a search engine only because of that referencing and therefore by means of an ex post facto verification, on the basis of a de-referencing request by the data subject.

57.

I therefore propose that the answer to the first question should be that, within the framework of the responsibilities, powers and capabilities of an operator of a search engine, Article 8(1) and (5) of Directive 95/46 applies, in principle, to the activities of such an operator of a search engine.

58.

The detailed rules of such an application are addressed by the second question.

59.

The second question, which is submitted in case the Court should find that Article 8(1) and (5) of Directive 95/46 is applicable to the processing carried out by an operator of a search engine, consists of three parts.

60.

The referring court seeks in essence

61.

I shall address those sub-questions in the order in which they are raised.

62.

The starting point is that, in the absence of justification within the meaning of Articles 8 and 9 of Directive 95/46, the refusal by the operator of a search engine to de-reference an internet page is contrary to Article 8(1) or (5) of that directive.

63.

Google, and also Ireland, the Austrian and the United Kingdom Governments maintain that this is an important but non-decisive factor in the context of the weighing-up of the rights and interests that the operator of the search engine should carry out for each request for de-referencing, including that relating to links to internet sites that process particular categories of data, within the meaning of Article 8(1) or (5) of Directive 95/46.

64.

The French, Italian and Polish Governments, and also the Commission, on the other hand, maintain that the prohibition of processing set out in Article 8(1) and (5) of Directive 95/46 means that the operator of the search engine which receives a request for de-referencing must systematically grant that request, that is to say, without being required or being able to check elements other than the absence of justification.

65.

I support the latter position.

66.

In fact, the wording of Article 8(1) and (5) of Directive 95/46 leaves no room for doubt that it imposes an obligation prohibiting the processing of the sensitive data set out in that provision. I find it difficult to see how, in such a situation, that obligation might be considered to be one of a number of elements to be taken into account when examining a request for de-referencing.

67.

Such an approach constitutes a logical extension of the case that gave rise to the judgment in Google Spain and Google. ( 24 ) It will be recalled that that case concerned only data the publication of which was in itself lawful. Consequently, the Court initially stated that the operator of a search engine was obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web pages published by third parties and containing information relating to that person — even where that publication in itself was lawful ( 25 ) — and then proceeded to weigh up the rights of the data subject with the economic interest of the operator of the search engine and with the interest of the general public in having access to the information in question. ( 26 )

68.

In that regard, I shall allow myself to make a parenthetical observation concerning the case of Google Spain and Google. In so far as it is generally accepted that if information is lawful the person who issues it benefits in any event from the freedom of expression enshrined in Article 11 of the Charter, it would have been helpful if the Court had expressly mentioned that fundamental right. That would have revealed more clearly that it is not solely a question of weighing up Articles 7 and 8 of the Charter, on the one hand, and freedom of information, on the other, but that freedom of expression must also be taken into account. I shall return to this point in my analysis of Article 9 of Directive 95/46.

69.

On the other hand, I see no room for such a balancing exercise in the context of Article 8 of Directive 95/46. Provided that it is established that sensitive data have been processed, a request for de-referencing should be granted.

70.

I am well aware of the position expressed by the ‘“Article 29” Working Party on Data Protection’ ( 27 ) in its ‘Guidelines on the Implementation of the [Google Spain and Google] judgment’ ( 28 ) of 26 November 2014 ( 29 ) (‘the Guidelines’), according to which, first, in most cases of requests for de-referencing, it appears that more than one criterion will need to be taken into account in order to reach a decision; second, that no single criterion is, in itself, determinative; ( 30 ) and, third, as specifically regards Article 8 of Directive 95/46, ‘[data protection authorities] are more likely to intervene when [de-referencing] requests are refused’. ( 31 )

71.

In that regard, it seems obvious to me that a number of criteria must be taken into account before a decision is taken on a request for de-referencing. On the other hand, the assertion that a data protection authority would be more likely to intervene does not seem to me to be sufficiently affirmative and clear. If it is shown that data are sensitive data referred to in Article 8(1) and (5) of Directive 95/46, the processing of those data is then prohibited.

72.

Accordingly, it seems to me that preventing the possible amplification of such data by a search engine is also covered by the ratio legis of Article 8(1) and (5) of Directive 95/46. Since by virtue of that provision the legislature considers that the processing of certain data is unlawful, it follows, to my mind, that the separate processing of those data by an operator of a search engine is also unlawful, at least from the time when that operator has not granted a request for de-referencing.

73.

In other words, with Article 8 of Directive 95/46, the EU legislature has already resolved the question of sensitive data in that there can be no weighing up. That interpretation is supported by the fact that Regulation 2016/679 not only maintained the prohibition ( 32 ) of the processing of sensitive data but even extended those categories. ( 33 )

74.

Consequently, subject to the exceptions provided for in Directive 95/46, the prohibition imposed on an operator of a search engine of processing data covered by Article 8(1) and (5) of that directive requires that it systematically grant requests for de-referencing that relate to links leading to web pages on which such data appear.

75.

The referring court seeks clarification of only two of the five exceptions provided for in Article 8(2) of Directive 95/46.

76.

According to Article 8(2)(a) of Directive 95/46, paragraph 1 is not to apply where the data subject has given his explicit consent ( 34 ) to the processing of the data in question, except where the laws of the Member State provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject’s giving his consent. Article 8(2)(e) of Directive 95/46 states that paragraph 1 of that article is not to apply where the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims.

77.

In so far as, according to the solution which I propose to the Court, I consider that the prohibitions of processing laid down in Article 8(1) and (5) of Directive 95/46 apply, I consider that, in principle, the exceptions provided for in Article 8 of Directive 95/46 also apply, even though some of the exceptions provided for in Article 8(2) of Directive 95/46 seem to me to be more theoretical than practical so far as their applicability to a search engine is concerned. ( 35 ) The operator of a search engine may therefore refuse to grant a request for de-referencing where the conditions of Article 8(2) of that directive are fulfilled.

78.

In accordance with Article 9 of Directive 95/46, Member States are to provide for exemptions or derogations from, in particular, Article 8 of Directive 95/46 for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.

79.

The question that arises is whether the operator of a search engine may refuse to grant a request for de-referencing where it finds that the displaying of sensitive data on the page to which the link at issue leads is lawful because the processing carried out in that respect by the publisher of the internet page is covered by Article 9 of Directive 95/46.

80.

It should be observed that, in accordance with the judgment in Google Spain and Google, ( 36 ) it may well be that a request for de-referencing will succeed against the operator of a search engine but will fail against the publisher of the referenced web page because of Article 9 of Directive 95/46. The Court considered that ‘the processing by the publisher of a web page consisting in the publication of information relating to an individual may, in some circumstances, be carried out “solely for journalistic purposes” and thus benefit, by virtue of Article 9 of Directive 95/46, from derogations from the requirements laid down by the directive, whereas that does not appear to be so in the case of the processing carried out by the operator of a search engine. It cannot therefore be ruled out that in certain circumstances the data subject is capable of exercising the rights referred to in Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 against that operator but not against the publisher of the web page’. ( 37 )

81.

That key passage from the judgment in Google Spain and Google ( 38 ) constitutes the hard core of the reasoning designed to justify the establishment of a ‘right to be forgotten’: in order to protect the privacy and the right to the data of the data subject, it is possible to ‘shoot the messenger’ (even) if a ‘rectification at source’ is impossible, owing to the right to freedom of expression of a publisher of an internet page.

82.

There is a great temptation to interpret that passage as meaning that Article 9 does not apply to the operator of a search engine.

83.

I propose that the Court should resist such temptation.

84.

First, according to the settled case-law of the European Court of Human Rights (‘the Strasbourg Court), ‘in the light of its accessibility and its capacity to store and communicate vast amounts of information, the internet plays an important role in enhancing the public’s access to news and facilitating the dissemination of information in general’. ( 39 ) More specifically, in a case concerning an internet site which is one of the world’s largest file-sharing services on the internet, ( 40 ) the Strasbourg Court observed that ‘Article 10 of the Convention [for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950], ( 41 ) applies not only to the content of the information but also to the means of transmission or reception’. ( 42 )

85.

The right of the public to receive and impart information made available on the internet is protected by Article 11 of the Charter. ( 43 ) That concerns both the information on the source web pages and the information provided by internet search engines. ( 44 )

86.

Second, the only conclusion that can be drawn from that passage from the judgment in Google Spain and Google ( 45 ) is that Article 9 of Directive 95/46 does not apply as such directly to the activity of the operator of the search engine. As the activity of such an operator is secondary to the primary activity of the person issuing the information, it is logical that Article 9 of Directive 95/46 should be addressed in the first place to that person. However, the fact that the data on the internet page in question are covered by journalism or artistic or literary expression, within the meaning of Article 9 of Directive 95/46, cannot have the consequence of preventing the operator of a search engine, who, as I have stated above, is subject to the obligations laid down in Article 8 of that directive, from relying on Article 9 of Directive 95/46.

87.

The fact that the data on an internet page come within Article 9 of that directive must constitute a circumstance that may allow a request for de-referencing to be refused.

88.

Article 9 of Directive 95/46 gives concrete expression at the level of secondary law to freedom of expression and of information and also to freedom of the media, enshrined in Article 11 of the Charter. In other words, when the right to respect for privacy and the right to protection of data under Articles 7 and 8 of the Charter, on the one hand, are weighed against the right of the public to access the information at issue, on the other hand, the fact that that information comes from the pen of a journalist or constitutes an artistic or literary expression is a factor that must be taken into account.

89.

To summarise, although certain of the Court’s reasoning could have been formulated more clearly in the judgment in Google Spain and Google, ( 46 ) it cannot be precluded that freedom of expression is not to be taken into account in the examination of compliance with the conditions laid down in Article 12(b) and point (a) of the first paragraph of Article 14 of Directive 95/46 carried out in that judgment. To my mind, when weighing up the interest of potentially interested internet users in having access to an internet page via a search conducted on the basis of the data subject’s name against that data subject’s fundamental rights under Articles 7 and 8 of the Charter, it is also necessary to take into account the freedom of expression and freedom to receive and impart information of publishers and internet users guaranteed by Article 11 of the Charter.

90.

I find support for that analysis in the Guidelines, which state that ‘[Data Protection Authorities] recognise that depending on the context, it may be relevant to consider whether the information was published for a journalistic purpose. The fact that information is published by a journalist whose job is to inform the public is a factor to weigh in the balance. However, this criterion alone does not provide a sufficient basis for refusing a request, since the [judgment of the Court] clearly distinguishes between the legal basis for publication by the media, and the legal basis for search engines to organise search results based on a person’s name’. ( 47 )

91.

Finally, it should be observed that Article 17 of Regulation 2016/679, which now codifies the ‘right to be forgotten’, provides, in paragraph 3(a), for an exception to that right where processing is necessary for exercising the right of freedom of expression and information. That exception applies to all the grounds that may substantiate a right to be forgotten that are set out in Article 17(1) of Regulation 2016/679 and therefore even, for example, in a situation where the personal data have been unlawfully processed (paragraph 1(d)). Regulation 2016/679 therefore recognises a limitation of the right to de-referencing for reasons relating to freedom of expression and information, even if the processing concerns sensitive data.

92.

I therefore propose that the Court’s answer to the second question should be that, under Article 8(1) and (5) of Directive 95/46, an operator of a search engine is required to systematically grant requests for de-referencing that relate to links leading to web pages containing sensitive data referred to in that provision, subject to the exceptions provided for in Directive 95/46, such as those provided for in Article 8(2)(a) and (e) of that directive. Conversely, the fact that the data on the internet page at issue come within Article 9 of Directive 95/46 constitutes a circumstance that may allow a request for de-referencing to be refused. In such a situation, the operator of a search engine must weigh up, on the one hand, the right to respect for privacy and the right to protection of the data under Articles 7 and 8 of the Charter and, on the other, the right of the public to have access to the information at issue and also the right to freedom of expression of the person from whom the information emanates, on the basis of Article 11 of the Charter.

93.

As the third question is raised ‘if [the first question] should be answered in the negative’, and I propose that it should be answered in the affirmative, there is no need to answer the third question.

94.

The fourth question consists of two parts.

95.

By the first part of this question, the referring court asks the Court whether, when the person making the request establishes that the personal data published on the internet page to which the link at issue leads have become incomplete or inaccurate, or are no longer up to date, the operator of a search engine is required to grant the request for de-referencing.

96.

The referring court thus seeks to ascertain whether such an obligation exists when the person making the request shows that, having regard to the conduct of the legal proceedings, the information relating to an earlier stage of those proceedings is no longer consistent with the current reality of his situation.

97.

By the second part of the fourth question, which refers in particular to the main proceedings involving B.H. and E.D., the referring court seeks to ascertain whether the information relating to the investigation of an individual or reporting a trial and the resulting conviction and sentencing constitutes data relating to offences and to criminal convictions, within the meaning of Article 8(5) of Directive 95/46, and, in particular, whether a web page comprising data referring to the convictions of or legal proceedings involving a natural person fall within the ambit of that provision.

98.

It is appropriate to answer the second part before the first part.

99.

In accordance with Article 8(5) of Directive 95/46, processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases are also to be processed under the control of official authority.

100.

I am of the view that information relating to legal proceedings published on internet pages, such as those at issue in the cases involving B.H. and E.D., constitutes data within the meaning of Article 8(5) of Directive 95/46. Even if criminal proceedings have not resulted in a conviction, the data in question are data relating to an offence.

101.

There remains the first part of the fourth question, relating to the conclusions that must be drawn from that finding as regards articles, in particular press articles, which report an earlier stage of legal proceedings and which by definition are no longer up to date.

102.

Having regard to the answer proposed in the context of the third part of the second question, I consider that, in the case of a press article, it is appropriate to take a nuanced approach, in so far as the data in question are personal data reported solely for journalistic purposes.

103.

In that regard, in the words of the Guidelines, ‘EU Member States may have different approaches as to the public availability of information about offenders and their offences. Specific legal provisions may exist which have an impact on the availability of such information over time. [Data Protection Authorities] will handle such cases in accordance with the relevant national principles and approaches. As a rule, [Data Protection Authorities] are more likely to consider the [de-referencing] of search results relating to relatively minor offences that happened a long time ago, whilst being less likely to consider the [de-referencing] of results relating to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case basis’. ( 48 )

104.

By the same token, I consider that it would be appropriate to carry out an examination on a case-by-case basis, in which the operator of a search engine would be required to weigh up, on the one hand, the right to respect for privacy and the right to protection of data under Articles 7 and 8 of the Charter and, on the other, the right of the public to have access to the information in question, while taking account of the fact that that information is journalistic information or constitutes an artistic or literary expression.

105.

Having regard to all of the foregoing considerations, I propose that the Court should answer the questions for a preliminary ruling submitted by the Conseil d’État (Council of State, France) as follows: