1) The prohibition on processing special category data applies to every kind of processing and to all controllers. No provision of the Directive or GDPR provides for a general derogation from that prohibition in the context of an activity of a search engine. Further, an interpretation of Art 8(1) and (5) of the Directive or Arts 9(1) and 10 of the GDPR that excluded the activity of a search engine would run counter to the purpose of those provisions, which is to ensure enhanced protection because of the sensitivity of the data.
However, a search engine operator is responsible for compliance with the prohibitions and restrictions in Art 8(1) and (5) of the Directive and Arts 9(1) and 10 of the GDPR because the search engine references the webpage and displays a list of results following a search for a person’s name, not because personal information appears on webpages by third parties. Therefore, the prohibitions and restrictions only apply to the search engine operator by reason of that referencing and following a de-referencing request by the data subject.
(a) A search engine operator is in principle required, subject to the prescribed exceptions, to accede to requests for de-referencing in relation to links to webpages containing personal data falling within the special categories.
(b) Processing by a search engine operator of special category data is capable of being covered by the exceptions in Arts 8(2)(a) and (e) of the Directive and Arts 9(2)(a) and (e) of the GDPR. However, it is scarcely conceivable that a search engine operator would seek the express and specific consent of data subjects before processing data concerning them for the purposes of referencing activity. By contrast, the exception in (e) for information that has ‘manifestly been made public by the data subject’ is intended to apply to the operator of a search engine. Therefore, a search engine operator could refuse to accede to a request for de-referencing if they established that the links in issue lead to content covered by this exception, provided that: (1) the processing satisfies all other conditions of lawfulness, and (2) the data subject does not have a right to object to that processing on grounds relating to their particular situation (see Art 14(a) Directive and Arts 17(1)(c) and 21(1) GDPR).
(c) Where the operator of a search engine receives a de-referencing request relating to a link to a webpage containing special category data, the operator must ascertain whether the inclusion of that link is strictly necessary to protect the freedom of information of internet users potentially interested in accessing that webpage by means of a search. As a general rule, the data subject’s rights protected by Arts 7 and 8 of the Charter override the freedom of information of internet users protected by Art 11. However, the balance may vary in specific cases. The operator should consider:
(i) all the relevant factors of the particular case, including the nature and sensitivity of the information and interest of the public in having the information;
(ii) the seriousness of the interference with the data subject’s fundamental rights, noting that where processing relates to special category data the interference is liable to be particularly serious; and
(iii) the reasons of substantial public interest in Art 8(4) of the Directive or Art 9(2)(g) of the GDPR.
3) Information concerning legal proceedings brought against an individual (such as information relating to the judicial investigation, trial and ensuing conviction) is data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Art 8(5) of the Directive and Art 10 of the GDPR. This is regardless of whether or not the offence was shown to have been committed.
4) If a request for de-referencing concerns links to a webpage containing information about legal proceedings which is no longer current, the search engine operator is required to accede to the request if, in all the circumstances of the case, the data subject’s fundamental rights override the rights of potentially interested internet users. Even if they refuse the request, the search engine operator is required to adjust the list of results in such a way that the overall picture it gives the internet user reflects the current legal position, meaning that in particular links containing information on the current legal position must appear in first place on the list.