Google may refuse to accede to a request for de-referencing of personal data falling within the special categories only if it is strictly necessary for protecting the freedom of information of internet users

Privacy. Prohibition of processing of personal data under Directive 95/46 applies to Google: subject to the exceptions provided for by the directive, Google has the obligation to comply with a request for de-referencing to web pages containing personal data. Google may refuse the accede to a request for de-referencing of personal data falling within the special categories when processing is covered by the exception in Article 8(2)(e) of the directive: the processing relates to data which are manifestly made public by the data subject or is necessary for the establishment, exercise or defence of legal claims. Google must ascertain whether the inclusion of the link in the list of results is strictly necessary for protecting the freedom of information of internet users potentially interested in accessing that web page by means of such a search, protected by Article 11 of the Charter: on the basis of all the relevant factors of the particular case and taking into account the seriousness of the interference with the data subject’s fundamental rights to privacy and protection of personal data laid down in Articles 7 and 8 of the Charter, ascertain, having regard to the reasons of substantial public interest referred to in Article 8(4) of Directive 95/46 or Article 9(2)(g) of Regulation 2016/679 and in compliance with the conditions laid down in those provisions. Data relating to legal proceedings brought against an individual conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46. Google is required to accede to a request for de-referencing relating to links to web pages displaying such information, where the information relates to an earlier stage of the legal proceedings in question and no longer corresponds to the current situation in so far as the data subject’s fundamental rights override the rights of potentially interested internet users.

IPPT20190924, CJEU, GC v Google

C-136/17 - ECLI:EU:C:2019:773