!J;;L ,,,o
TO BE TYPED or PRINTED

' ~5]:S
Pagel

LISTING PROFORMA

~U;p;;TIONS : 1. ONLY TYPE the information in the relevant boxes. 3. DO NOT Staple the Sheet.

L.

2. DO NOT TYPE OUTSIDE THE BOXES.

• \ =w£ (c)

IN THE HIGH COURT OF DELHI AT NEW DELHI

C.,oT~o

.

IN TaliMA._TTER_Qf:-

I NAME I )._<:~_~

Year

Number

.

I ,t0)f(_\ I

\
V\Y S,,\-n j'r\

ys O.oV

I\J"fl ~ ~

CQtJ_Y\ ~~\l>

$ ojn£V5

~art

c:TP~T~P:T~:r (!;

HI

1

vs

[NMm

I

OF

•
-- I

.... FIRST DEFENDANT I RESPONDENT

I

~===============~ c --1~

1 (a) Case Category
(b) Case Category
'-~·~·~~·:.."

_._,_,J __,L.

•L.:/oJ __ ,_, ~-'-'L,___._____,__'£2-i_ _ ,__,._,~,

o

'••-

I ..· . · ..· ..... : : ' ,. .. :

2 (a) Date of Decision of Court I
Authority of First Instance

I. .

(b) Case Patticulars

c .. . ·.

Number

I

)

•..

•

•

~~J

•

OF

•

[

..,.

oL.-''~'·'-"

A-'''···-"

.

I

•

•

.

"

]

•

'I

•

•

J

. ..

(c) Authority passing the
above order

. ..

3(~)

Date of Decision of Appellate I
Revisional Court I Authority

(b) Case Particulars

'''·'

[

'' '..
..

,

. ·:
,

..

I

c~-~ ·-~·~~·-

Number

OF

1

'

I

:J

-····-

..

"--'

(c) Court I Authority passing
the above orde~

.. ·~~~--~~'-·· -~~.~. .. . --~. .--.-.. ._ ..

I -_.

. .~ . .

I.

4(a) Similar Matter
Case Type

I

Number

'I·

[,_ ~. ~-~-- _,_,

(b) Date of Decision

I

l

.. I

I

OF

.

. ::

I

- . . 'I

5 Statute Involved

__..

_______________

C .. ( . . _ _ I

Date of Imou1med order

•

___

......_........._.......,..__._....,_..........--......................

DATE

,-~0\ ~\ \ ~0
'

!b I

......._~.'

Final order

Lawyers Code

0

InterlocutorY order

I i2 )SZ? /I~ I

0

•

~

,. \

{.;

~~~/

•.>.

~')

~;;

(:~

~~~

~k

.W

:~:

r~-;

 ·'<Xoolil&t\001SI\I\199im@QI;>O-c>X~I®li,!!$1:;:;:;lM%6%6~~»;)g.Qm~'!:;'%:)~~~"?;;"<O:){';(")).~,/?x",x;-_y,.;.. .... "M.'\•..v,.Y._.{~·:r:.:•:•:i:')'l;,"~":'.oJ•':..Y-JY".:;,.-;..o.~·..::~'\W):X•J.")'".!'::XX~.Jf?tr:>.,'"'{zy:">l'~«.r:l);.'K,a'r'v.u..,-,.\'~":"<I<;'<~'\N'uJ,_~,I""=dt."'ii~ll,..:''~(.</..l.~-,'i'':r)"">.X:"'>-·Z~~···=ru.',r,t,.l-,.,,.,,

~

'"

· -""'"'"""-~'•"•~··"-'-"'"'~ X~~-~;<>'XoOO/M~~;!;il,&'i),;N~""-v;:<;{Z·;,y,;.,·~:y;:~;{;·:;.,J.::.fi~!.!,~~.{~;;,0l:··:iio•'-c":''':c::;:;:Y'!,:i~;b:1,

7j

~

~~

~~·

'

i~

~

e

(d

(!
(fl"

~;

:~

\:C(

IN THE HIGH COURT OF DELHI AT NEW DEtHI

~
~

26

"~

EXTRAORDINARY ORIGINAL CIVIL JURISDICTION

~

:g
~

OF 2016

WP (C) NO.

~~
~

""~~

IN THE MATTER.OF:
LAKSH VIR SINGH YADA

~~;

~~

V

......PETITIONER

:~~~
~..,~

r.
:~!
''""'

~?
~::")

?:~>

VERSUS

UNION OF INDIA & OTHERS

...... RESPONDENTS

~~~
:::c
;o_:
,.._

~~:

INDEX

~1

::~~:
~0

~.:.c::

§~

PAGE
NO.

PARTICULARS

SL.NO.
1

Court Fees

2
3

'

4

Proof of services

5

Urgent Application

,:}~

6

List of dates and synopsis

7

Writ Petition under Articles 226/227 of the
constitution of India alor1g with Affidavit

8.

ii:;;
(5_,~

~:

~~
ii-:
i•v

[j"~

~<

b

""

'

g~·

y
5

'.

ANNEXURE P-1

;;-

8

g-36
3~~'iJ_.

Copy ofthe order dated 13.10.2015
ANNEXURE -P-2

9.
.

Copy of the letter dated 25.01.2016 written by \.\J.--~i
'

Petitioner to Respondent No.4
10.

ANNEXURE -P-3
Copy of the email dated 25.01.2016 written by

~-l!L

Petitioner to Respondent No 2 & 3.
i

11.

ANNEXURE ~P~4(COLLY)

Y?--{3

Copy of the m1icles showing how nowadays
_,

-;.-

t~

t5~

~
../

Notice ofMotion

.·,c

IX.

;}.-

''

~- -·

~'E

'

Memo of Parties

~

~·-:

>

U·
r::

~i

 ~

·~OM'·=~M'I.'~~<»»~~~:r,~<>~~!>::~~~e:m~;l:=;;ml';:::-&;.;I~%::1~}1~~~&:::~~~~::):;~'§g:~;J6:t1~8:l?rf~::i:~!i'
.

"
~

~

companies have started doing due diligence of the
prospective employees through Google, Facebook
I

and Linkedin etc.

I

11.

I

ANNEXURE -P-5
Copy of the order of the European Court· of

bl\·- ~5

1

Justice in the case of Google V. Mario Costeja

I

[C131112]

12

ANNEXURE -P-6

~v-lo8

Copy of the Data Protection Directive 95/46/EU
13

ANN;EX!IB.E -P-7
Copy of the Proposed General Data Protection

)o3- 1~3

Regulation (GDPR)
..

14

Application under section 151 of the Code of Civi
Procedure 1908 on behalf of the Petitioner for Ad-

\9-'-{ ·- \M-

,.,

('{

~~·

ff~

Interim Ex-Parte Interim Reliefs

'(•

·:·

~.;;~;

15

.'.:;~~

Application on behalf of the petitioner/applicant

~::.

,.J

··:

::;";o

under Section 151 of C.P.C. seeking exemption
from

filing

certified/ typed

copy

of Dim

~-:-

'e-&-l3o

···-·;

U.::..:
,~··::

Annexure, Handwritten, marked & with law
margin with affidavit
16

V akalatnama
-·---

)3 \

-------~

PETITIONER

THRO~Gl\ _ ~ ~~ ~

R~~ ~AN & AKASH VAJP AI
ADVOCATES
496, GREATER KAILASH -I
NEW DELHI
NEW DELHI
DATED~2016

f~;.

~·/

 ~t':"1i~i>'~fu~::

···::~~"«~..:!::."J~\:h.:'w.'"$~ki"~@~t:1~i:rz,~:-::%illZ:::i;J2-?!??~~;??~~~ .·:: :

...........,

®;~:·

~""'
~;z~r

\

f

~

,~

IN THE HIGH COURT OF DELHI AT NEW DELHI

~

(

EXTRAORDINARY ~ORIGINAL CIVIL JURISDICTION

~

~

~

WP(C)NO.

OF 2016

~

~

·

~

~

IN THE MATTER OF:

~·

LAKSH VIR SINGH YADAV

...... PETITIONER

VERSUS
UNION OF INDIA & OTHERS

...... RESPONDENTS

COURT FEE

GOVERNMENT OF NCT OF DELHI
e-Court Fee
DATE & TIME:

29-JAN-2016 14:02:15

NAMES OF THE ACC/ REGISTERED USER :

SHCIL

LOCAIION:

DELHI HIGH COURT

e-COUAT RECEIPT NO :

DLCT2943A16010337

e-COUAT FEE AMOUNT :

lit SO

( Rupees Eighty Only)

Ill \IIIII \lll\111111111111111111111111111111111111

II III II IIll

DLCT2943A16010337

Statutory Alert :The authenticity of this e-Court fee receipt should be verified at www.shcllestamp.com . Any discrepancy In the
details on this receipt and as available on the website renders it invalid. In case of any discrepancy please inform the Competent
Authority. this receipt is valid only after verification & locking by the Court Official.

 .. -...-,::s-:...,::.;."~"::•,c

•·....,.. ......,..,.... "X'-:."-'.':.Ot)b!':~·z~Y·~

,_.

~lt'*'
~w

~

IN THE HIGH COURT OF DELHI AT NEW DELHI
EXTRAORDINARY ORIGINAL CIVIL JURISDICTION
OF 2016

WP (C) NO.
IN THE MATTER OF:

...... PETITIONER

LAKSH VIR SINGH YADA V
VERSUS

...... RESPONDENTS

UNION OF INDIA & OTHERS

MEMO OF PARTES

...... Petitioner

Laksh Vir Singh Y adav

Versus

Union of India
Ministry of Communication &
Information Technology
Through its Secretary
Electronics Niketan, 6, CGO Complex,
Lodhi Road, New Delhi: 110003
Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
Through Google India Pvt. Ltd.

Google India Private Ltd.
Unitech Signature Tower-II
Tower-B, Sector-15
Part-II Village Silokhera
. Gurgaon 122001
India

...... Respondent No. 1

...... Respondent No. 2

...... Respondent No.3

 ~~'<'>XZ:<R>;~;:<:c<0wJ.l.W~W~\l'&l"cl'!lft8!'J,'i'$'i').''iC?lX<Jt~·v:;i!{~/¢;$$.S(?J§§;i§W,i~(.~~'JfiSi!&"W/..~l$!%1~~4Pflii'!t!.t.1?JJ;':f;v~~Ji!YJds::i:j%":

~

g){

@i
··"""'&

~~

],

*?i}}

1~,:
iJ

,.
f~.,

IKanoon Software Development Pvt. Ltd.
B-205, No. 44/3B, KNO 709
Ashish JK Apartments
Thubarahalli Extended Road,
Thubarahalli
Near Kundalahahlli Gate
Bengaluru-560037
I

f·~·

0\·"

~~:;.

And also at

y

/:;

826, First Floor
11
2nd Cross, i
Main Road
Inditanagar
· Bengaluru-560008

,'

...... Respondent No.4
( :~·

Register General
Delhi High Court
Sher Shah Road,
New Delhi - 110503

~ ..:~

...... Respondent No. 5

~

"

"-,.
-':

PETITIONER

THROUG!f

"'-~ ~
~

[/{6~

NEW DELHI
DATED: ?;,o/o/ J 2016

MADAN & AKASH VAJP AI
ADVOCATES
496, GREATER KAILASH -I
NEWqELHI

 !

"

@)

~~
I

IN THE HIGH COURT OF DELHI AT NEW DELHI
EXTRAORDINARY ORIGINAL CIVIL JURISDICTION
OF 2016

WP (C) NO.

~~;

~~:

IN. THE MATtER OF;
LAKSH VIR SINGH YADA V

...... PETITIONER

{:

VERSUS
UNION OF INDIA & OTHERS

...... RESPONDENTS

Notice of Motion

Sir,
The enclosed Writ Petitiort in the aforesaid matter is being filed on
behalf of Mr. Laksh Vir Singh Yadav and is likely to be listed

D\ )Ol-/0/2016. Please take notice accordingly.

PETITIONER

THROUGH

•

~

(;)(\"~
{) v

1

-~HIT MADAN & AKASH VAJPAI
ADVOCATES
496, GREATER KAILASH -I
NEW DELHI

'NEW DELHI
DATED:3!2ja/2016

r-'~'

 -------.-,-

».:«

~ · ~~~~{~~~~~"?x;~~z~1t?i~£%~W5~:~~~~~:;~rf~~~~~~~??:::~:~~~~?.

~

t~'
v
t2

~

~·

,,~

,3

~*
\>;:./

rf;'
)j

~
~

~

,,~~
~::,

IN THE HIGH COURT OF DELHI AT NEW DELHI

~-~'

,"·\

•:(

EXTRAORDINARY, ORIGINAL CIVIL JURISDICTION

:,:,

'

WP(C)NO.

OF 2016

{:.

r'·

IN THE MATTER OF:

\.-:.

~;~

LAKSH VIR SINGH YADA V

...... PETITIONER

~:..·
·".:
,.5'.~
;~;

f.(.

~i~

VERSUS
UNION OF INDIA & OTHERS

.~-·

~:-:£

...... RESPONDENTS

~
(;~
1)
)!.(

~;.

)~·

PROOF OF SERVICES

~

~
r;;
~'
"r-:1
;;~:
~~~

~
~
~5
If~"·

~1
f~

\~i~
;:.:·.
>·.

.'

j·~:;

(/
(-,
r.;

(".c

,·.i

(::

 ~&ffi'&;,w~"'Z%"'~«-~;;."»x~~i~:,;:z::ocw:=::;~Y.~~;r~::;»;.~<"Z~):ia:;,-::~·~'2;::!~£gr::"f.~t"~~{t'::~2;1:3E~tii:t~r~~~?:::si~18~~~,;lli~T::lt!~W815~
.

.

~

.

~

~

v

~

~
~
r

~

2

~

~

~

-~

IN THE HIGH COURT OF DELHI AT NEW DELHI

~
~

l

~
,?.

EXTRAORDINARY ORIGINAL CIVIL JURISDICTION
I

~

•>

;~

OF 2016

WP(C)NO.

:~

i::

if

~~
(',

IN THE MATTER OF:

,)

~

...... PETITIONER

LAKSH VIR SINGH Y ADAV

®

I

~·~

~~

fc

VERSUS
UNION OF INDIA & OTHERS

~1

...... RESPONDENTS

~

~

;-~­

___

,

~j

~,..~

URGENT APPLICATION

<=

1\}1

l<.i:

Jt;

'"-"

~

~~

~:-~

~~~

"-~

To
The Registrar
High Court of Delhi
New Delhi-110003

!{::

=>
~~,-;
~: ~~
...:~

§
;?'"'

/~

?'

~tv:

Sir,

~:5

Kindly treat the accompanying petition on an urgent basis as per the

w
_;(

~";~
e.;:
c.

0"-

High Court Rules. The reason for urgency is:

G:-..

rr.·

~1
~::

})~

~::;

~:"
F
L~

~';;

~--~
.;

~:·-

PETITIONER

~::::

:~::~.
.~:;:

?..-:

THROUGH

J~~

ROHIT MADAN & AKASH VAJPAI
ADVOCATES
496, GREATER KAILASH -I
NEW DELHI

NEW DELHI
DATED;__!,t-,)oJ

J 2016

u
~{
,-:~.

~-:.

.,.·;

~jt)
~-·

r

 ~. '

'

~~~

r

o((5'<&

6."~..:.'8?,.-;.

~:,.0;'9

•

IN THE HIGH COURT OF DELHI AT NEW DELHI
EXTRAORDINARY ORIGINAL CIVIL JURISDICTION
I

OF 2016

WP (C) NO.

IN THE MATTER OF:
...... PETITIONER

LAKSH VIR SINGH YADAV
VERSUS

...... RESPONDENTS

UNION OF INDIA & OTHERS

SYNOPSIS & LIST OF DATES

13.10.2015

District Court, Saket passed an order in the Criminal
Revision Petition No. 01/2015 i.e. Mrs. Krishna
Yadav V. Smt. Priya & Others, wherein name of the
Petitioner

appeared

as

husband

of the

First

Respondent albeit there was no role of the Petitioner
in the aforesaid criminal case whatsoever.
Respondent No. 4 i.e. Indian Kanoon uploaded the
order of the District Court in the Criminal Revision
Petition No. 0112015 i.e. on its website and giving the
impression that Petitioner was involved m some
criminal proceedings. Copy of the order dated
13.10.2015 is enclosed here as ANNEXURE P-1.
Petitioner got to know that anyone who searches his
name on Google will find the aforesaid judgment on
the second number of search result and consequently
giving this impression to everyone that Petition~r was
involved in some sort of criminal proceeding in India.

 ~~~~WX'l-3%~~'»=~~~*-~"'bW-ij-~(~&~W~~*&~lli~~W~~~~~:~~~~~\<~~~;;~~~~7:":~~~~~~~~~~:·~·'·:~?::)~:-::."":?:t·~:~~,::.~s-.·

h,,·:

;::/·.c

~y

;:.-·

~w»

,,

:~;:~

8

~>:2:l

~~~%

i:J.:':";!.

~J.

:·

,::"~·

:·::,;

~>

25.01.2016

25.01.2016

Petitioner tried to contact Petitioner No. 4 and made a
request for taking down the aforesaid judgment
through letter dated 25.01.2016 as Petitioner wanted
this order to be expunged, from the website of
Respondent No.4. Copy of the letter dated 25.01.2016
is enclosed here as ANNEXURE P-2
Petitioner tried to contact Respondent No. 2 and 3 and
send an email dated 25.01.2016 through his Counsel
for removing the Concerned Uniform Resource
1.e.
Locator
(URL)
http://indjankanoon.org/doc/85426826/ from the
search result and also made a request that material
detrimental to the Petitioner must not be the first hit irt
the search result as he has no role in the aforesaid
case and because it's giving a bad name to the
Petitioner which will further jeopardize his
prospective employment opportunities, being a NRI
living in Dubai employed with prestigious
organisation. This issue pertaining to aforesaid
criminal case in which his name has appeared had
been fully resolved and therefore that reference to his
name in the aforesaid criminal case is now entirely
irrelevant. Copy of the email dated 25.01.2016 is
enclosed here as ANNEXURE P-3. Some of the
articles showing how nowadays companies have
started doing due diligence of the prospective
employees through Google, Facebook and Linkedin
are enclosed here as ANNEXURE P-4 (Colly)
Petitioner did not receive any communication from
Respondent No.2 and

3 nor did Responded No.2 and

3 remove aforesaid Uniform Resource Locator (URL)
i.e. from its server.
Hence, this Writ Petition because order passed in the
aforesaid criminal case was the first hit showing up in
the

search

result

and

whenever

anyone , type

Petitioner's name in Google search engine and it
violates

his

right to

privacy

Petitioner's bad social image.

and

also

create

v~-

;>
':;-

,-

~- ~,.

,-

:%

 :~~~v;._s_;:;,~~'~'"S"5-5S~.i5)5:f~;:~SX~\0:~~~..;=.1.:.-~~{?.;¥L~~~~~~O:..;~;;:;J:;~-2-~~"S~~-:~~~?;~?.;Z~-;.;

~-" "·:.~ ."}~~< ··i:J~:~_-, ·~·~.' "'·--·

~;~

~

~3
IN THE HIGH COURT OF DELHI AT NEW DELHI

~t

EXTRAORDINARY' ORIGINAL CIVIL JURISDICTION
OF 2016

WP (C) NO.

·=::

IN THE MATTER OF:
...... PETITIONER

LAKSH VIR SINGH YADAV
VERSUS
UNION OF INDIA & OTHERS

...... RESPONDENTS

WRJT PETITION UNDER ARTICLE 226 OF THE CONSTITUTION OF
INDIA FOR ISSUING APPROPRIATE WRIT OR DIRECTIONS TO
RESPONDENTS No. 2-3 TO REMOVE THE AFORESAID URL FROM
THEIR SEARCH INDEX/ENGINE SO THAT NO THIRD PARTY HAS
ACCESS TO CONFIDENTIAL INFORMATION OF THE PETITIONER

TO
THE HON'BLE CHIEF JUSTICE
AND HIS COMPANION JUSTICES OF THE
HON'BLE DELHI HIGH COURT
MOST RESPECTFULLY SHOWETH

1. The Petitioner Laksh Vir Singh Yadav is a person of Indian
origin being an Indian Citizen till23.05.2013
2. Petitioner recently acquired British Citizenship on 23.05.2013
and presently residing in Dubai, UAE and employed as Senior
Law Officer with HSBC.

 w~;_~J;~~xo..v:<~~&;tw~w.z~0~'Xf~~*-~?YN.'Z!::~~:~£~~.r.«.--~llJ:;~«?~lill;'Xt."«?,:~~'§..~~JYr)~1~~:::r.·c§rttK1t&~rts:~~')}~~rry:_$:!2E'!.~~~~~t:8·~:ta~?t?f:~W..~~~~~::r4~?~}~'f:~?.fB~~l':;~~:~:

t~

~~:
,.
y;"r

t~J

®

""ff§

t{J

~t:
~(

0!!.~

~<·~

;~:.:.

~

3. This Writ Petition pertains to the moot question of how to

2~

~~~

~:·,,_

govern information qn the internet, a space which is growing

~~
~= -~

:~; ~

increasingly important in society and also one that presents a
unique social environment that persistently challenges courts
and policy makers. Petitioner seeks liberty to raise following
questions of law before this Hon'ble Court through this Writ
Petition:
A. Whether Petitioner has "Right to be forgotten" or "Right to
~--·

Delink" in the context of the aforesaid facts

and

.

>::
h'-/
ly-,.J

circumstances of the case?
!.j

B. Whether Petitioner has right to ask Respondent No.2 and 3
to Remove all the links related to him on its search index,
which

is irrelevant and obsolete &

jeopardize his

prospective employment opportunities ?

::-~;;

>
•.-:.
ft.

r:.<.~

,__:-;;.
(~.
(:~·--

C. Whether data controllers or intermediaries such as Google,

~-!:~_

are required to delete information that is "inadequate,

f.!::--

~--~;

~s;,

&=

irrelevant or no longer relevant" if they receive a request for
removal of such data?
D. Whether data subject or Petitioner has the right to erasure of
lawfully published material?
E. Whether there is any obligation on the search engines to
delete those information which contains personal data and
which has been lawfully published by the third parties and
which is kept on the web page from which it originates but
which is irrelevant, excess and harmful to the image of the
Petitioner?

J

}_

~:;··;

~~-;~'­
~~~~-

 ~

~?Q:&

\\
F. Whether Right to privacy are to be interpreted as meaning
I

that, in order to comply with the right to privacy the operator
of a search engine is obliged to remove from the list of
results displayed following a search made on the basis of a
person's name links to web pages, published by third parties
and containing information relating to that person, also in a
case where that name or information is not erased
beforehand or simultaneously from those web pages, and
even, as the case may be, when its publication in itself on
those pages is lawful ?

G. whether Article 21 of the Constitution and Rule 3 of the
Information Technology (Intermediaries guidelines) Rules,
2011 are to be interpreted as enabling the data subject or
affected person to require the operator of a search engine to
remove from the list of results displayed following a search
made on the basis of his name links to web pages published
lawfully by third parties and containing true information
relating to him, on the ground that that information may be
prejudicial to him or that he wishes it to be 'forgotten' after
a certain time ?

H. Whether right to have disable information that is in
contravention of sub-rule (2) given in rule 3(4) of the
Information Technology (Intermediaries guidelines) Rules,
2011 extend to enabling the affected person to address
himself to search engines in order to prevent indexing of the
information relating to him personally, published on third
parties' web pages, invoking his wish that such information
should not be known to internet users when he considers that
it might be prejudicial to him or he wishes that the particular
.

)

 ~

w
Ci
~1

~

~

'":

®

',_
information being subject matter of present writ petition be
consigned to oblivion, even though the information m
I

question has been lawfully published by third parties?

~.
\;r~:

1·~,:

u:,

iti

~~

~

?;

~~
~j~

~~:

·.;~:~

I. Whether Respondent No.I should frame guidelines enabling

affected persons to address himself to search engines or
intermediary in order to prevent indexing of the information
relating to him personally, published on third parties' web
pages, invoking his wish that such information should not be
known to internet users when he considers that it might be

~:~
·~·
:_(::
<:..;

:.-:._·

K;:

~}.~;
(;,:~

~i ~·.

~~~:.

~- ::-

:,~~ ~

~~·~~

prejudicial to him or he wishes such information to be
consigned to oblivion, even though the information m
question has been lawfully published by third parties?

4. In view of the aforesaid facts and circumstances of the case, the
Petitioner is preferring the instant petition on the following
amongst other grounds:

GROUNDS

Foreign judgments and Laws

1. Because European Court of Justice which is the highest judicial
authority of the European Union in the landmark case of Google
V. Mario Costeja [C 131112] dated 13.05.2014 had ordered Google
to remove the links related to Mario Costeja on its website and
effectively read a "right to be forgotten" or "Right to delink" into
existing EU data protection law. Right to delink broadly, provides
that an individual may be allowed to control the information

 ®·

?
available about them on the web by removing such information in
certain situations Court has held that:
I

36 ... ... ... .It is undisputed that that activity of search engines plays
a decisive role in the overall dissemination of those data in that it
renders the latter accessible to any internet user making a search
on the basis of the data subject's name, including to internet users
who otherwise would not havefound the web page on which those
data are published.
3 7. Also, the organization and aggregation of information
published on the internet that are effected by search engines with
the aim offacilitating their users' access to that information may,
when users carry out their search on the basis of an individual's
name, result in them obtaining through the list of results a
structured overview of the information relating to that individual
that can be found on the internet enabling them to establish a more
or less detailed profile of the data subject.
38. In as much as the activity of a search engine is therefore liable
to affect significantly, and additionally compared with that of the
publishers of websites, the fundamental rights to privacy and to
the protection ofpersonal data, the operator of the search engine
as the person determining the purposes and means of that activity
must ensure, within the framework of its responsibilities, powers
and capabilities, that the activity meets the requirements of
Directive 95/46 in order that the guarantees laid down by the
directive may have full effect and that effective and complete
protection of data subjects, in particular of their right to privacy,
may actually be achieved.

81. In the light of the potential seriousness of that interference, it
is clear that it cannot be justified by merely the economic interest
which the operator of such an engine has in that processing.
However, inasmuch as the removal of links from the list of results
could, depending on the information at issue, have effects upon the
legitimate interest of internet users potentially interested in having
access to that information, in situations such as that at issue in the
main proceedings a fair balance should be sought in particular
between that interest and the data subject's fundamental rights
under Articles 7 and 8 ofthe Charter.
82. Following the appraisal ofthe conditions for the application of
Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46 which is to be carried out when a

 --N=•·•-•·"'"""'"'"""'«"'W""'~-WiW>;'t"""A~!JWii!!~i;\'tWK«i%f-lil~i@lli!'ll'l0'?c'f&1K7{'1WC'i!'~ieZ~:fuimfi1:\]i~

;
!

®

t~
request such as that at issue in the main proceedings is lodged
with it, the supervisory authority or judicial authority may order
the operator of the search engine to remove from the list of results
displayed following a search made on the basis of a person's name
links to web pages published by third parties containing
information relating to that person, without an order to that effect
presupposing the previous or simultaneous removal of that name
and information - of the publisher's own accord or following an
order of one of those authorities -from the web page on which
they were published.
87 Indeed, since the inclusion in the list of results, displayed
following a search made on the basis of a person's name, of a web
page and of the information contained on it relating to that person
makes access to that information appreciably easier for any
internet user making a search in respect of the person concerned
and may play a decisive role in the dissemination of that
information, it is liable to constitute a more significant
interference with the data subject's fundamental right to privacy
than the publication on the web page.
88 In the light of all the foregoing considerations, the answer to
Question 2(c) and (d) is that Article 12(b) and subparagraph (a) of
the first paragraph of Article 14 of Directive 95/46 are to be
interpreted as meaning that, in order to comply with the rights laid
down in those provisions and in so far as the conditions laid down
by those provisions are in fact satisfied, the operator of a search
engine is obliged to remove from the list of results displayed
following a search made on the basis of a person's name links to
web pages, published by third parties and containing information
relating to that person, also in a case where that name · or
information is not erased beforehand or simultaneously from those
web pages, and even, as the case may be, when its publication in
itself on those pages is lawful.
94 Therefore, if it is found, following a request by the data subject
pursuant to Article 12(b) of Directive 95146, that the inclusion in
the list of results displayed following a search made on the basis of
his name of the links to web pages published lawfully by third
parties and containing true information relating to him personally
is, at this point in time, incompatible with Article 6(1)(c) to (e) of
the directive because that information appears, having regard to
all the circumstances of the case, to be inadequate, irrelevant or
no longer relevant, or excessive in relation to the purposes of the
processing at issue carried out by the operator of the search
engine, the information and links concerned in the list of results
must be erased.

.:..-.

 1}

97. As the data subject may, in the light of his fundamental rights
under Articles 7 and 8 of the Charter, request that the information
in question no longer be made available to the general public by
its inclusion in such a list of results, it should be held, as follows in
particular ?om paragraph 8] of the present judgment, that those
rights override, as a rule, not only the economic interest of the
Operator of the search engine but also the interest of the general
public in finding that information upon a search relating to the
data subject?s name. However, that would not be the case if it
appeared, for particular reasons, such as the role played by the
data subject in. public life, that the interference with his
fundamental rights is justified by the preponderant interest of the
general public in having, on account of inclusion in the list of
results, access to the information in question.

99 It follows from the foregoing considerations that the answer to
Question 3 is that Article 12(b) and subparagraph of the first
paragraph of Article 14 of Directive 95/46 are to be interpreted as
meaning that, when appraising the conditions for the application
of those provisions, it should inter alia be examined whether the
data subject has a right that the information in question relating to
him personally should, at this point in time, no longer be linked to
his name by a list of results displayed following a search made on
the basis of his name, without it being necessary in order to find
such a right that the inclusion of the information in question in
that list causes prejudice to the data subject. As the data subject
may, in the light of his fundamental rights under Articles 7 and 8
of the Charter, request that the information in question no longer
be made available to the general public on account of its inclusion
in such a list of results, those rights override, as a rule, not only
the economic interest of the operator of the search engine but also
the interest of the general public in having access to that
information upon a search relating to the data subject?s name.
However, that would not be the case if it appeared, for particular
reasons, such as the role played by the data subject in public life,
that the interference with his fundamental rights is justified by the
preponderant interest of the general public in having, on account
of its inclusion in the list of results, access to the information in
question.

Copy of the order in the case of Google V. Mario Costeja

1/ 12] is enclosed here as Annexure P-5



r' 

'~.- ;=: ·. ~,~~~·r~::g~!:·~~:f:;~·.:;~~- -~~\:~.,y::<

'~~~~x-~"./'"':·~~{2?X~~>~-x:;.z;x:rz&:&·~~~y;5~·s.J;~~~~:15::-~_t.,~~:::~~,t:;::;~;.;;y'")~~\:0:~~Jc::C~~;;;:,5g,x-_:.o~~ .,::;::;·.-::--;;:-;..:/

®

!~
2. Because after pronouncing the aforesaid judgment now Individuals
in Europe can make a request to Google to take down personal
I

data from its search index.

3. Because Petitioner is not asking for the deletion of the aforesaid
order which is legally tenable and true record but only asking to
delink the material or remove from the search index so it may not
affect his prospective employment opportunities.

4. Because intermediary has the task of ensuring that personal data
are processed 'fairly and lawfully', that they are 'collected for
specified, explicit and legitimate purposes and not further
processed in a way incompatible with those purposes', that they
are 'adequate, relevant and not excessive in relation to the
purposes for which they are collected and/or further processed',
that they are 'accurate and, where necessary, kept up to date' and,
finally, that they are 'kept in a form which permits identification of
data subjects for no longer than is necessary for the purposes for
which the data were collected or for which they are further
processed'. In this context, the intermediary must take every
reasonable step to ensure that data which do not meet the
requirements of that provision are erased or rectified.

5. Because data subject may oppose the indexing by a search engine
of personal data relating to him where their dissemination through

•Q

 '""-"''X-""':-twmw~f:~"''"~M"~x;::;;~»~::%5~~-:;:~jw;;.g@~(:Q('x~"li::~«;;;;~r:<~c~;~~.~~':J):i,,~':•''{':):'XXcl;;:~~~l:'fl')';~:::"?.r,'i'%~1f!J¥l:I);Y;c;J;f!'Y/}"::~~~;l~'~'i<'c?'?;:'i::·:>:?<!YS~~r~~srt??;:;;·,;;i:',''·(':~:~(:!':~~c:.;:2'':,:
(·:v
\(~·

r~~;;

~l~

?l~,

~
~

11the search engine is prejudicial to him and his fundamental rights

~~

i"1'.

~

:~;~

'!:;

'<·.

~·--

:}!
:r~

to the protection of those data and to privacy which encompass the
I

:~,

::.~
:~3

~"~

'right to be forgotten' override the legitimate interests of the

~{:;:
i~-;,

~"-~

g;

operator of the search engine and the general interest in freedom of

2
g-~,
(_~)

~~!

r~:-::

f~:

information.

~~~~

6. Because even initially lawful processing of accurate data may, in
the course of time, become incompatible with the directive where
those data are no longer necessary in the light of the purposes for
··-:

which they were collected or processed. That is so in particular
where they appear to be inadequate, irrelevant or no longer
relevant, or excessive in relation to those purposes and in the light

:~; ~:
~,-,

r~·:

iJ:,-;

;,::
.

of the time that has elapsed.

:~:

f·'

;·,,

7. Because aforesaid judgment i.e. Google V. Mario Costeja
[C131112] per se provides an example of this balancing exercise.

-~:

While the Court ordered Google to delete access to the information

w

~1

:•'

deemed irrelevant by the Spanish citizen, it did not rule that the
content of the underlying newspaper archive had to be changed in
the name of data protection (paragraph 88 of the Court's ruling).
The Spanish citizens' data may still be accessible but is no longer
ubiquitous. This is enough for the citizen's privacy to be respected.

8. Because Claimants had a right to request Google to delink certain
associated hits with their names from the webpage. The Court does

,')

;~

~.

 ~
~

18
not create any absolute right to be forgotten and nor does it say
that the material detrimental to the person must not be the first hit.
I

This flows from a larger right to information privacy, which
encompasses a right against aggregation of information in a
detrimental manner that prevents the claimant from telling his
story.

9. Because Interpreting Article 12(b) and Article 14 of the EU Data
Protection Directive, the Court concluded that Search Engines are
obligated to remove from the list of results displayed based on the
search made on a person's name, those links to the web pages
published by third parties or information relating to that person if
the data subject (the person about whom the data is searched)
requests for such removals even if the publication of those
contents were legal. In arriving at its conclusion, the court heavily
relied on the fundamental right to personal freedom and privacy
and the European Union Directive.

1O.Because The entire case was decided based on EU' s Data
Protection Directive 95/46/EU, which is designed to ensure
privacy of individuals and protection of all personal data collected
for every individual especially as it relates to processing, using, or
exchanging such data. Europe's data protection laws are intended
to secure potentially damaging, private information about
individuals.

~(':

 ®

13
The below mentioned references, may be useful as a guidance tool
before this Hon'ble Court which interpreting the rights of the
I

Petitioner to privacy and the right to delink the confidential
information relating to the Petitioners' personal life from easy
access to the users' of the internet not just in India but globally.

Some of the important Articles of the Directive are given below
for the ready reference of this Hon'ble Court:

Preamble:
(2) Whereas data processing systems are designed to serve man;
whereas they must, whatever the nationality or residence of
natural persons, respect their fundamental rights and freedoms,
notably the right to privacy, and contribute to economic and social
progress, trade expansion and the wellbeing of individuals;
(1 0) Whereas the object of the national laws on the processing of

personal data is to protect fundamental rights and freedoms,
notably the right to privacy, which is recognized both in Article 8
of the European Convention for the Protection of Human Rights
and Fundamental Freedoms and in the general principles of
Community law; whereas, for that reason, the approximation of
those laws must not result in any lessening of the protection they
afford but must, on the contrary, seek to ensure a high level of
protection in the Community

Article 1

Object of the Directive
In accordance with this Directive, Member States shall protect the
fundamental rights and freedoms of natural persons and in
particular their right to privacy with respect to the processing of
personal data.

~

'

 ~.
.

~{)
Principles Relating to Data Quality
Article 6
1. Member States shall provide that personal data must be:

(a) Processed fairly and lawfully;
(b) Collected for specified, explicit and legitimate purposes and
not further processed in a way incompatible with those purposes.
Further processing of data for historical, statistical or scientific
purposes shall not be considered as incompatible provided that
Member States provide appropriate safeguards;
(c) Adequate, relevant and not excessive in relation to the
purposes for which they are collected and/or further processed;
(d) Accurate and, where necessary, kept up to date; every
reasonable step must be taken to ensure that data which are
inaccurate or incomplete, having regard to the purposes for which
they were collected or for which they are further processed, are
erased or rectified;
(e) Kept in a form which permits identification of data subjects for
no longer than is necessary for the purposes for which the data
were collected or for which they are further processed. Member
States shall lay down appropriate safeguards for personal data
stored for longer periods for historical, statistical or scientific use.
2. It shall be for the controller to ensure that paragraph 1 is
complied with.
Criteria for Making Data Processing Legitimate
Article 7

Member States shall provide that personal data may be processed
only if:
(f) processing is necessary for the purposes of the legitimate
interests pursued by the controller or by the third party or parties
to whom the data are disclosed, except where such interests are
overridden by the interests for fundamental rights and freedoms of
the data subject which require protection under Article 1 (1).

The Data Subject's Right of Access to Data
Article 12
Right of access

... .,

!_i,.

 @}

~\
Member States shall guarantee every data subject the right to
obtain from the controller:
I

(b) As appropriate the rectification, erasure or blocking of data
the processing of which does not comply with the provisions of this
Directive, in particular because of the incomplete or inaccurate
nature of the data

The data subject's right to object
Article 14
Member States shall grant the data subject the right:

at least in the cases referred to in Article 7 (e) and(/), to object at
any time on compelling legitimate grounds relating to his
particular situation to the processing of data relating to him, save
where otherwise provided by national legislation. Where there is a
justified objection, the processing instigated by the controller may
no longer involve those data;

Copy of the Data Protection Directive 95/46/EU is enclosed here
as ANNEXURE P-6.

ll.Because the

Proposed General Data Protection Regulation

(GDPR) applicable to European Union Countries, which will
replace the current data protection directive 95/46/EU in 2016, per
se recognises Right to be forgotten or Right to De link by inserting
Article 17 in the proposed version of GDPR. Article 17 of the
Proposed General Data Protection Regulation provides that the
data subject has the right to request erasure of personal data related
to him on any one of a number of grounds including
noncompliance with article 6.1 (lawfulness) that includes a case (f)
where the legitimate interests of the controller is overridden by the

~:.

 ®

,_,___
interests or fundamental rights and freedoms of the data subject.
Article 17 further elaborates and specifies the right of erasure
I

provided for in Article 12(b) of Directive 95/46/EC and provides
the conditions of the right to be forgotten, including the obligation
of the controller which has made the personal data public to
inform third parties on the data subject's request to erase any links
to, or copy or replication of that personal data.

Copy of the Proposed General Data Protection Regulation (GDPR)
is enclosed here as ANNEXURE P-7.

12.Because on 13 July, 2015, Russian President signed Law No. 264FZ or also known as "Law on the right to be forgotten" According
to this law an individual can request the removal of URLs for
searches of his or her name if such URLs link to the following
information on him or her: (i) information distributed in breach of
Russian

laws;

(ii)

inaccurate

information;

(iii)

irrelevant

information or (iv) information which has lost its meaning for the
individual because of subsequent events or actions of the
individual. The only exceptions are (i) information on events
which contain signs of crimes the term of prosecution for which
has not lapsed and (ii) information about the commitment of a
crime in respect of which the conviction has not lapsed.
The operators of a search engine have to process delisting
notifications within 10 business days (the first draft of the law

,:·:.:

 4f

?

gave the operators only 3 calendar days). The operators are also
prohibited from disclosing information about the receipt of a
I

delisting request. Therefore Law No. 264-FZ grants to Russian
citizens a right similar to the one granted to EU citizens by the
CJEU in Google Spain v. AEPD and Mario Costeja Gonzalez.

'

13.Similarly, Court of Appeal, California in the case of Melvin v.
Reid [ 112 Cal. App. 285, 297] has held that:

Any person living a life of rectitude has that right to happiness
which includes a freedom from unnecessary attacks on his
character, social standing or reputation.

Information Technology Act and Rules

14. Without prejudice to the aforesaid grounds, it is also respectfully
submitted by the Petitioner that the "Right to be forgotten" or
"Right to Delink" in India should be read within the framework of
legislation of Information Technology Act, 2000 (Section 79) and
Rule 3(2) of the Intermediary Guideline Rules, 2011. Under this
rule, intermediaries (including search engines for example,
Google, Bing, Yahoo! etc.) are liable for the content which is

 ~"~>'

®

~~

I
','

"invasive of another's privacy". For the sake of ready reference,
some of the important sections of the Information Technology Act
I

have been reproduced here:
~''·~·.:

2(1) (o) of the I. T. Act, 2008, defines the term Data.
"Data" means a representation of information, knowledge,
facts, concepts or instructions which are being prepared or
have been prepared in a formalized manner, and is intended to
be processed, is being processed or has been processed in a
computer system or computer network. , . and may be in any
form (including computer printouts magnetic or optical storage
media, punched cards, punched tapes) or stored internally in
the memory of the computer,·

2(1) (w) of the I. T. Act, 2008, defines the term Intermediary.

"Intermediary" with respect to any particular electronic
records, means any person who on behalf of another person
receives, stores or transmits that record or provides any service
with respect to that record and includes telecom service
providers, network service providers, internet service
providers, web hosting service providers, search engines,
online payment sites, online-auction sites, online market places
and cyber cafes.

Section 79 of the LT. Act, 2000 provides exemption from the
liability to intermediary in certain cases. It says that:

(l)Notwithstanding anything contained in any law for the time
being in force but subject to the provisions of sub-sections (2)
and (3), an intermediary shall not be liable for any third party
information, data, or communication link hosted by him.

(2) The provisions ofsub-section (1) shall apply if
(a) the function of the intermediary is limited to providing access
to a communication system over which information made
available by third parties is transmitted or temporarily stored;
or

 ®

»

(b) the intermediary does notInitiate the transmission
Select the receiver of the transmission, and
Select or modify the information contained in the
transmission
I

(c)

the intermediary observes due diligence while discharging his
duties under this Act and also observes such other guidelines
as the Central Government may prescribe in this behalf

(3) The provisions ofsub-section (1) shall not apply if(a) the intermediary has conspired or abetted or aided or induced
whether by threats or promise or otherwise in the commission
of the unlawful act
(b) upon receiving actual knowledge, or on being notified by the
appropriate Government or its agency that any information,
data or communication link residing in or connected to a
computer resource controlled by the intermediary is being used
to commit the unlawful act, the intermediary fails to
expeditiously remove or disable access to that material on that
resource without vitiating the evidence in any manner.

Similarly rule 3(2) of the Information Technology (Intermediaries
guidelines) Rules, 2011 also provides framework for the "Right to
be forgotten" or "Right to delink". Rule 3(2) says that:

Due diligence to be observed by intermediary - The intermediary
shall observe following due diligence while discharging his duties,
namely:1. The intermediary shall publish the rules and regulations,
privacy policy and user agreement for access-or usage of the
intermediary's computer resource by any person.

2. Such rules and regulations, terms and conditions or user
agreement shall inform the users of computer resource not to
host, display, upload, modify, publish, transmit, update or
share any information that a) belongs to another person and to which the user does
not have any right to;
.?.

 ~-:-x~~~"%:;~~'»}~'«>1«-:~~w.~::~::;;;'\Ko:::~'>:''>2":-x:::i;:-~~~::ZX~!:;~~x'&ll;:e~:~:::~~?':~~«~~;?",~'3Xi.%':?5~S~':9:~~>:~~8r'it?::~~:;;~~~@?:Y.~?:o~W.&~<t~~;~~

)Q

I
U

®

~
b) is
grossly harmful,
harassing,
blasphemous
defamatory, obscene, pornographic, paedophilic,
libellous, invasive of another's privacy, hateful, or
racially, ethnically objectionable, disparaging, relating
or encouraging money laundering or gambling, or
otherwise unlawful in any manner whatever;
c) harm minors in any way;
d) infringes any patent, trademark, copyright or other
proprietary rights;
e) violates any law for the time being in force;
f) deceives or misleads the addressee about the origin of
such messages or communicates any information
which is grossly offensive or menacing in nature;
g) impersonate another person;
h) contains software viruses or any other computer code,
files or programs designed to interrupt, destroy or
limit the functionality of any computer resource;
i) threatens the unity, integrity, defence, security or
sovereignty of India, friendly relations with foreign
states, or public order or causes incitement to the
commission of any cognizable offence or prevents
investigation of any offence or is insulting any other
nation
I

3. The intermediary shall not knowingly host or publish any
information or shall not initiate the transmission, select the
receiver of transmission, and select or modify the
information contained in the transmission as specified in
sub-rule (2):
Provided that the following actions by an intermediary
shall not amount to hosing, publishing, editing or storing
of any such information as specified in sub-rule: (2) (a) temporary or transient or intermediate storage of
information automatically within the computer resource
as an intrinsic feature of such computer resource,
involving no exercise of any human editorial control, for
onward transmission or communication to another
computer resource;
(b) removal of access to any information, data or
communication link by an intermediary after such
information, data or communication link comes to the
actual knowledge of a person authorized by the
intermediary pursuant to any order or direction as per the
provisions of the Act;
4. The intermediary, on whose computer system the
information is stored or hosted or published, upon obtaining

~

2'~~·

~~:

~"

;~,

;~
t~~...

f_~

;~~
~~

~

: ~~::

~

:

 ,,i:~~9.:C::::..~~,t;.:~-~~~·;(;:§-~~;:'{W-:-~X?.>-"$~~~~~~::9!{~«~~lli~-~\..f;;:X%9)05&~~X{o)?~~::~.::•:~~~!*'&~$.-::1.t-X~~:~~::.~">'n6~~~'\,~:~.·;-:~~,'&::~?::Zft~":~R.Y0~"':~,~~-;,,:)50C~(;:.':.5tr.~:·~.'·~-"

@

M-knowledge by itself or been brought to actual knowledge by
an affected person in writing or through email signed with
electronic signature about any such information as
mentioned in sub-rule (2) above, shall act within thirty six
hours and where applicable, work with user or owner of
such information to disable such information that is in
contravention of sub-rule (2). Further the intermediary shall
preserve such information and associated records for at least
ninety days for investigation purposes,
I

5. The Intermediary shall inform its users that in case of noncompliance with rules and regulations, user agreement and
privacy policy for access or usage of intermediary computer
resource, the Intermediary has the right to immediately
terminate the access or usage lights of the users to the
computer resource of Intermediary and remove noncompliant information.
6. The intermediary shall strictly follow the provisions of the
Act or any other laws for the time being in force.
7. When required by lawful order, the intermediary shall
provide information or any such assistance to Government
Agencies who are lawfully authorized for investigative,
protective, cyber security activity. The information or any
such assistance shall be provided for the purpose of
verification of identity, or for prevention, detection,
investigation, prosecution, cyber security incidents and
punishment of offences under any law for the time being in
force, on a request in writing staling clearly the purpose of
seeking such information or any such assistance.
8. The intermediary shall take all reasonable measures to
secure its computer resource and information contained
therein following the reasonable security practices and
procedures as prescribed in the Information Technology
(Reasonable security practices and procedures and sensitive
personal Information) Rules, 2011.
9. The intermediary shall report cyber security incidents and
also share cyber security incidents related information with
the Indian Computer Emergency Response Team.
lO.The intermediary shall not knowingly deploy or install or
modify the technical configuration of computer resource or
become party to any such act which may change or has the
potential to change the normal course of operation of the
computer resource than what it is supposed to "perform
thereby circumventing any law for the time being in force:

 --~~";•.;:r'",.

~

J-8
provided that the intermediary may develop, produce,
distribute or employ technological means for the sole
purpose of performing the acts of securing the computer
resource and information contained therein.
11. The intermediary shall publish on its website the name of
the Grievance Officer and his contact details as well as
mechanism by which users or any victim who suffers as a
result of access or usage of computer resource by any person
in violation of rule 3 can notify their complaints against such
access or usage of computer resource of the intermediary or
other matters pertaining to the computer resources made
available by it. The Grievance Officer shall redress the
complaints within one month from the date of receipt of
complaint.

15.Because natural corollary or interpretation which emerges from the
joint reading of the aforesaid sections and Rule is that intermediary
i.e. Respondent No. 2 and 3 have to grant the data subject or
affected person i.e. Petitioner herein, right to object at any time on
the grounds mentioned in sub-rule (a-i) of Rule 3(2) read with
Rule

3(4)

of the

Information Technology

(Intermediaries

guidelines) Rules, 2011 relating to his particular situation.

16.Because

the

aforesaid

intermediary

rules

mandate

the

intermediaries to impose a set of rules and regulations on users, the
terms of such regulations include a broad list of categories of
content which are prohibited from posting online. Any person
aggrieved by any content on the internet can ask the intermediaries
to take down such content. Intermediaries are obliged to remove
access to such content within a period of 36 hours from the time of
receipt of the complaint.

 w~;;;;;::~~""'<),'('''Yle,m;:>)?:,_•;@..:<>c:c1~""h~;.:9;$'~'>~='-~~~«;;;.~~-»m'"~~·X-»~-~~~;6.::.'«\'«~X">>%X~!t»l\XY/.h-~ss»?&·:m>oc::.o~~

~~ii
~-7::',:

~-:;:
,, ..... _

®

z:~­
~..::.

~~

1.','",

~~~:'

~~":-

17.Because the rules do not provide for the creator of the content i.e.
I

,.

Respondent NO.4 to respond to this complaint. In fact, the rules do

>(-

not even provide for the intermediaries to inform the user who
,_,.

posted the content regarding the complaint. The intermediaries

'\: ~

'"'""
•".;•j

~~52

which do not comply with a take-down notice lose the protection
from any legal liability that could arise over the content.

··~::.::~
~~~~

k;:

;: -~~:

t·
~' ,.

~-;·:

18.Because like EU Data Protection Directive (DPD), aforesaid rule

!.~~-·

1; . .

also provides affected person a right to ask search engmes or
~.::~:

intermediaries to remove results for queries that include their name
where those results are 'inadequate, irrelevant or no longer
relevant, or excessive in relation to the purposes for which they
were processed'.

19.Because analysis of some other provisions in the IT Act, like
section 79 in particular can be of relevance. The section 79
provides safe harbour provisions for 'intermediaries' in the form of
due diligence rules. The term 'intermediary' as defined in the IT
Act specifically includes search engines. The rules issued u/s 79
mandate the intermediaries to 'publish the rules and regulations,
privacy policy and user agreement for access-or usage of the
intermediary's computer resource by any person'. One of the
conditions which should be part of such terms and conditions that

~ '-

\~~

~;~
'~"

 @)

3{)
need to adhered to by the 'users of the computer resource' is not to
host, display, upload, modify, publish, transmit, update or share
I

any information that is invasive of another's privacy.

20.Because the intermediary 'upon obtaining knowledge by itself or been
brought to actual knowledge by an affected person in writing or
through signed email needs to act within thirty six hours and where
applicable, needs to work with user or owner of information to disable
information' that is in contravention of conditions laid out and
includes information which invades privacy. To put such provisions in
effect, the intermediary needs to publish on its website the name of
the Grievance Officer and his contact details as well as mechanism by
which complainants can notify their complaints. The Grievance
Officer needs to redress the complaints within one month of receiving
them. Simply put, it may be interpreted that search engines are
intermediaries under the IT Act and if they publish information
(through a link) which invades privacy of an individual, then they
need to provide a redressal mechanism through grievance officer and
work with the complainant to remove such information.

Right to Privacy encompasses "Right to be forgotten" or "Right to
De link":

'-

 ~~=@x~

.

-~~~~~~0:»-.~~;~.{~"«!~~~~-~;:~:~«¥h%{'(-<?'%t>>?J:~·~~;.-~~:>;,-~:·S:~~X~~~~'t~'"!<R'~W~·C:?X&X*l>~·~8·;:·~~~".':·).~,;:~v,x"&~·~·5'·~·;".,\"r;x,;oQO-.;:ox>t.<&.~d'~".::·."~).~:~~~·
~

R~~1
[~

m~

®

~)
21.Because Supreme Court in the case of People's Union of Civil

If:;~
:t:<\b

ti;
~~;;~

Liberties (PUCL) V Union of India [(1997)1SCC301], while
I

examining the Scope of Article 21 of the Constitution of India has

--\;

read Right to Privacy as a Fundamental Right requiring
Constitutional Protection and held that:
17. In R. Rajagopal alias R.R. Gopal and another v. State of
Tamil Nadu AIR1995SC264, Jeevan Reddy, J. speaking for the
Court observed that in recent times, right to privacy has
acquired constitutional status. The learned Judge referred to
Kharak's case, Govind's case and considered a large number of
American and English cases and finally came to the conclusion
that "the right to privacy is implicit in the right to life and
liberty guaranteed to the citizens of this country by Article 21.
It is a "right to be let alone". A citizen has a right "to safeguard
the privacy of his own, his family, marriage, procreation,
motherhood, child-bearing and education among other
matters".
18. We have, therefore, no hesitation in holding that right to
privacy is a part of the right to "life" and ''personal liberty"
enshrined under Article 21 of the Constitution. Once the facts in
a given case constitute a right to privacy, Article 21 is
attracted. The said right cannot be curtailed "except according
to procedure established by law". (emphasis supplied)

{_'

t-'

·;·.

;·"~

(.'.::

:.·'

22.Because considering the fact that privacy is a recognized
;,_~

fundamental right in India, and based on the above-mentioned
Provisions of Information Technology Act and Rules, it is

~~

~:;

"".'.

~~

~

respectfully submitted by the Petitioner that in a similar situation,

(·

Indian courts should also follow the line of thinking followed by

,,

the EU Court in the above-referred judgment. Once the Hon'ble
Court recognises this right, Individuals will get the right to seek
removal of irrelevant and incorrect personal data from the search
results.
33

\'

L-

~'

 32?

23.Because right to privacy permits the processing of personal data
where it is necessary for the purposes of the legitimate interests
pursued by the intermediary or by the third party or parties to
whom the data are disclosed, except where such interests are
overridden by the interests or fundamental rights and freedoms of
the individuals which require protection under Article 21 of the

Constitution of India.

24.Because Right to be forgotten is the desire of an individual to
determine the development of their life in an autonomous way,
without being perpetually or periodically stigmatized as a
consequence of a specific action performed in the past. This right
is not antithesis to freedom of information but it actually balance

between right to privacy and freedom of information.

25.Because some information is available to some people that does
not mean that the same information has no privacy interest
associated with it. Adopting this right to the Indian context would

go a long way in developing our cyber privacy jurisprudence.

26.Because evolution of the internet is constantly changing our
conceptions of individual privacy. Once any information made
public and shared on the internet remains available for access

across the world without an expiry date and due to the radically



- 

.N. 

!!Wi.

';;J,:;w

~

unrestricted spread of personal data across the web, people are no
longer able to control hpw and by whom and in what context their
personal data is being viewed. Therefore apparent immortality of
information on the web is making people assert their "right to be
forgotten": they claim a legal right to get irrelevant news and/or
other information about them deleted permanently from searches.

27 .Because processing of personal data, such as that at issue in the

main proceedings, carried out by the operator of a search engine is
liable to affect significantly the fundamental rights to privacy

28.Because where personal data storage is no longer necessary or is
irrelevant for the original purposes of the processing for which the
data was collected, removing those irrelevant and outdated links is
not tantamount to deleting content. A fair balance should be
sought between the legitimate interest of internet users and the
person's fundamental rights. Freedom of expression carries with it
responsibilities and has limits both in the online and offline world.
This balance may depend on the nature of the information in
question, its sensitivity for the person's private life and on the
public interest in having that information. The right to be forgotten
is certainly not about making prominent people less prominent or
making criminals less criminal.

29. Because the perfect example of setting balance between right to
have information and right to privacy is the fact that orders of the

,:.:-)

 

family Court do not come online. It upholds the fundamental right
of privacy of the individuals. To further the interest of the parties
to family litigation, it should be fair to argue that any ancillary
court proceedings emnating from the main family litigation should

also receive an equal protection of right to privacy of such parties;

30.Because Trial Court is not a Court of record and therefore
delinking that concerned page from the search result will not affect

anyone?s right to have information or public interest at large.

31.Because this issue pertaining to aforesaid criminal case in which
the name of the Petitioner has appeared had been amicably
resolved and therefore the reference to the name of the Petitioner

in the aforesaid criminal case is now entirely irrelevant.

32.That Petitioner has no alternate or other ef?cacious remedy under
any other law except approaching this Hon?ble Court under Article

226 of the Constitution of India.

33.Petitioner has not filed any other or similar writ or appeal on the

same issue before this court or the Hon?ble Supreme Court of

India.

erg-@117?

~:~~-7::~~~~;,0RQ~~x~6i~s:;;.~nz~~~~~~:i;::';:~j~(:t:::=~~~~;~?::y_c.:,~"~:)~;.:~c-~~zx~;~~)~;x.~·~y-t:9-:.~~illwh:af,;~t"EJ;r;;.:~~-~~-;.;.;-:;:,5:2-::u:-;~:~--:,:· . '~:·····!:·(~:.~:1-~:J~:.~~-·'·=-:·:~j::·~;;J~;,::'·

WI;.

36
PRAYER

In view of the above circumstances, it is most respectfully prayed
before this Hon'ble Court to:

I.

Issue a writ order or any direction, directing the Respondent
No. 1 to respect the right to privacy of the Petitioner and further
recognize the right to Delink private information of the
Petitioner from the Public domain including access of the
aforesaid information and also directing the Respondent No. 1
to frame necessary guidelines whereby confidential information
is given restricted access to third parties like Indian Kanoon etc.
including intermediary such as Google, yahoo etc.

II.

Issue

a writ order or any direction, directing the Respondent

No. 1 to issue guidelines directing intermediary like Google,
Yahoo etc to remove all the links related to third party on its
search index, which is irrelevant , inadequate, obsolete &
intrude Petitioner's right to privacy if they receive a request
for removal of such data from third party.

III.

Issue necessary directions to Respondent No. 2-4 to remove the
particular URL from their search engine so that no third party

 »2S'~s;::?.;~~~~.;;.~~~~~v~-~~.'&~~~~w~~}:K~~~~u;~~~~~l~-;&~~~~~"'t?~~2~~~W3?:~~~~~~~~~t~~g~m~;:~~~~~~

~

.

~

~

~
~

~~

r

~

.

~~

&

~

has access to confidential infon11ation of the P~titioner as

~

:~,

mentioned above.

IV.

Interpret Article 21 of the Constitution and Rule 3 of the

-~.

Infonnation Technology (Intermediaries guidelines) Rules,

~-.

2011 so that it enables the· data subject or affected person to
require the operator of a search engine to remove from the I ist
of results displayed following a search made on the basis of the

·'"·"

:;-;
:;{_.

Petitioners' name links to web pages published lawfully by

-~-

?-:
..:..

third parties and containing true information relating to him, on

~~,:-

the ground that. that information may be prejudicial to the
Petitioner or that the Petitioner wishes it to be 'forgotten' after a
certain time;

V.

Pass such other order/orders as the court may deem fit and
proper in the facts and circumstances of the case.

PETITIONER

THROUGH-~~

RO~AN

& AKASH VAJPAI
ADVOCATES
496, GREATER KAILASH -I
NEWQELHI

NEW DELHI
DATED_3o/o; ~2016
I

·'-·.'

 ~~.~~~~tm!~~----- -~

~~»?~sr:~:s~~;~"W«:M~$!.;t~;;n~~~~t~~~;~;1~~~~?J:i~'-~::~:~:~~~··.::~?~;;rs:;g~~*~ifg~:f:~~~:~;;~:{~:(:'!:~:~~~55}~~~~rr~~

~3

~J

~~();:

~

.~
g·:

38

~~

~~<NY
'(.~

~"r~::
~·:!

w
?~

IN THE HIGH COURT OF DELHI AT NEW DELHI

;j~_

;:5)

:~:;
~-''

!Q;

EXTRAORDINARY ORIGINAL CIVIL JURISDICTION

,,

_;!,

~~
OF 2016

WP (C) NO.

;;,

2

~-;
,~;

~

IN THE MATTER OF:

~
.:·:··
}_

LAKSH VIR SINGH Y ADAV
...... PETITIONER
VERSUS

/:;'{o,:~::~,~1~\

'·U~1QN OFINDI.A'fk
\,j~,'\ '. ·
_:;;:~>~'
. ",· .,,, ~ · ·
- -, ~ ·--/. ·<~~:~~23::~::~~~~::~;:-~y·
//c

!i

I -

.

,".:

I

.

...... RESPONDENTS

OTHERS
. . . .

''

AFFIDAVIT

. . .. .

.· ;g~~~v~~~4~~;i;thers:i~~~~rnt~J~· ~~~:~
having my office at
2~,1i>e$ ET\C.1.tt.V~~~
hereby solemnly affirms and'·4e.clares as under: ,. ·

c::-&

Ne\.J ~~ ~) 1'.

Do

...... ·- ... :

1. That I am the Petitioner herein in the aoovementio~~d ,Writ
Petition and competent to swear by way of the present affidavit.
~-.

A~'ss;~
·
~~ 00 ~.\r.-slr?.CYI~, ~_.. · . hat I have read and understood the contents mentioned in the
~.::; S1_--~·'?~,:··_,·_:-:·,7::·::~:j(\ ir eesent Writ Petition and that content mentioned therein· are
0

~l\ ~

. •·.•. :"·''-~''.•.:.

'!'.;·,:·

. ,~:.-.'~'':>'
... 2:J·"

f\\: ·. .·
·.-.

\, ~.

,

~-,~_),
... ,.,,.
~~~

·

·. · ''->

~I

#~hrue and conect to the best of my knowledge and belief based

.

<J':J~r

.-'eY
...

on the records available.

~,

Hi":h cour~~

~~!..... .1~

w~~.. \lw ~~"tt:ttkw

. J.J
\,

~~

O"lf
\

. ,. 'f
·

DEPONENT
VERIFICATION

'~"\i

-

r-

29 J~.\~ t.'U\'0

Verified at New Delhi on this

.

~O-

.-.\ ~-~:ewu
1-1-.at

~"

the contents of the above affidavit are true and correct to

,.,~\}~i·~~\~s,: the ~~-~t. o~ ~y knowledge and belief, that no part of it is false

!\,\_\1 ~.'' w "\\

0

~~'\\ ~'?\ \1; .."~ ~\~

·

'(\t)

sr..·;;~>:l!/:arM_
0~~@_g;r,~i!t11a~ been concealed therefrom.

St" , . .._

1:\.

\.1.

r--

.

:c···"<.:.f~....

~

~!.'; . :.·:.·.··. ·.· . ~.\ ..·. -~-.r.t:D. ·.~"X/'"
I:J.:r.:,·., ·
···
-~·-·
:.................
,n:;:.; :";-: .
. .t?. "·J -. . ' .>ri
a~~u1
1 /
. .r-:-.',..
. ~\l/

or: ....-.

. .

\ ·~

""J.."'
DEPONE.NT

\ ' .. /

•

~"' \J"' ~·

j

~ 0...,~

·_.f\·~ -~~!\~~ ''t::·:i '.

(~:~;:,',
';',:· . ;. ·-~, ..· .::· ·:·-~· ~·_·:· · :. i .. ,·('~.::.·;; '~
. . ..
· · · · ......... _,,,,,,,i, ;;,n:J ·

"'•li;~;;; •.J, .. ,.~,i.:.... .:,;_;-,~,.

O.s:~.'1

('·n.Nu...

Al/

do~o$,,-

_/

~

a

h

•

()

 ~'n·n efJl\ ~e~- \

~

39

In The Court Of Shri A.K.KJhar vs Srnt. Priya Laksh on 13 October, 2015

Delhi District Court
In The Court Of Shri A.K.Kuhar vs Smt. Priya Laksh on 13 October, 2015
Author: Sh. Ajay Kuhar

1
IN THE COURT OF SHRI A.K.KUHAR
ASJ/SPECIAL JUDGE-NDPS/SOUTH DISTRICT
SAKET COURT COMPLEX, NEW DELHI

r-~.
;'-'.;·,

:,(·

CR No. 01/15
Dr. Mrs. Krishna Yadav
W/o Late Dr. R.V.S. Yadav,
R/o C-8, Press Enc1ave Saket,
New De1hi-7

;}?
::.~'

~ :~
.... Revisionist

VERSUS
Smt. Priya Laksh
W/o Laksh Vir Singh Yadav
D!o Sh. Umesh Sharad Randive
R/o D-505, Raheja Nest, CHSL,
Near Lake Homes, Chandiva1i
Road, Powai, Mumbai.
Also at
C-8, Press Enclave Saket,
New Delhi-110017.
1.

~11

I

~~~i~
.

;~- ~

~-'

~i
r.*

E
g$.
(,(;

2.

m
~&·

Sh. Visha1 Randive
5/o Sh. Umesh Sharad Randive
R/o D-505, Raheja Nest, CHSL,
Near Lake Homes, Chandivali
Road, Powai, Mumbai.

i.~
~;;

r~~i
~r

3.

r- ....

Smt. Nirma1a Radive
W/o Sh. Umesh Sharad Randive
R/o D-505, Raheja Nest, CHSL,
Near Lake Homes, Chandivali
Road, Powai, Mumbai.

r·
;;'~

i";"

v::-

F-'

4.

':.·..;
~-:·
··"L

l(i

:<i

;: : ~1
~:-~
~

\~

.,.J

'd

CR No.01/15
ORDER

~_-.~ 1

:: :~ \

:-.:;

i;j
~: i
~;i'i

i:l
~~)xt:m

-._,>"-

:/:;.\

~

06.06.2015
13 .10. 2015
13.10.2015
Dr. Mrs. Krishna Yadav vs. Smt. Priya Laksh & Ors .

,.,,

~!:i

f~r!

. .... Respondents
Computer ID No: 02406R0190942015
Date of institution
Date of arguments
Date of order

:;1

.\

,,

Sh. Umesh Sharad Randive
R/o D-505, Raheja Nest, CHSL,
Near Lake Homes, Chandivali
Road, Powai, Mumbai.

Indian Kanoon - hltp://indlankanoon.org/doc/85426826/

·..

~~-

:.

::.:-~::
·(:~=:=

:e·;:

··>"

 tzX~
~~'

:'-\i)
I

In The Court Of Shri A.K.Kuhar vs Smt. Priya Laksh on 13 October, 2015

By this order I shall dispose of the Criminal Revision against the order dated 20.04.15 passed by
the Ld. ACMM, South District, Saket Courts, in complaint case no. 41/1/15, titled as Dr. Mrs.
Krishna Yadav vs. Smt. Priya Laksh Vir Singh Yadav and Others.
1.

2. Trial Court Record (TCR) has been summoned and perused. Arguments have been heard.
3. By the impugned order dated 20.04.2015, the Ld: ACMM, has disposed of the application u/s 156
(3) Cr.P.C. filed by the complainant/revisionist herein, alongwith the complaint u/s 200 Cr.P.C.
alleging commission of the offence u/s 504/506/323/427/452 !PC read with Section 34 IPC. The
Ld. counsel for the applicant has submitted that the revisionist is an old lady and is a Doctor by
profession working as Paediatrics Surgeon at Apollo Hospital, New Delhi. She has a son namely
Laksh Vir Singh Yadav, who works as a Legal Advisor at HSBC Bank in Dubai, U.A.E. He submitted
that the petitioner's son came into contact with Mr. Vishal Randive and the marriage was
solemnized between son of the revisionist and Ms. Priya Randive, the sister of Mr. Vishal Randive.
After the marriage, the relationship between them however, became sore. The Ld. counsel submitted
that the wife of the son of the petitioner and her family members are after the property of the
revisionist. He submitted that on 06.02.2015 when the revisionist was at her house at C-8, Press
Enclave, Saket, New Delhi, Mr. Umesh Randive, father of Ms. Priya R.andive came at around 4:00
pm alongwith 2-3 persons. The petitioner was abused and threatened to give a share in her property
to Ms. Priya Randive. Similarly, on 18.02.2015, again few persons came to her house at around 8:oo
pm and extended similar threats. A complaint with regard to these incident was given to the SHO,
PS-Saket, on 12.02.2015 and 23.02.2015.
CR No.o1j15 Dr. Mrs. Krishna Yadav vs. Smt. Priya Laksh & Ors.
However, the police has not taken any action. He submitted that there is a specific direction in the
case of Lalita Kumari vs. State of U.P ., that in case the allegations disclosing a cognizable offence,
the police has to register an FIR.
4. The Ld. counsel for submitted that a complaint was filed before the Ld. Magistrate with
application u/s 156 (3) Cr.P.C., but the Ld. ACMM, vide impugned order has dismissed the same
without considering the allegations. It is submitted that the Ld. ACMM, did not consider the gravity
of the offence, nor the fact that the complainant is a senior citizen and that she has persistent threat
to her life. The Ld. ACMM in the impugned order has referred to the allegations made in the
complaint about the incident of 06.02.2015 and 18.02.2015. Before disposing of this application ujs
156 (3) Cr.P.C., he called the "action taken report" from SHO, PS-Saket, to confirm whether any FIR
has been registered or not. Having verified the facts and considering the allegations in the
complaint, it was opined that the allegations made in the complaint, are well within the personal
knowledge of the complainant and no field investigation is required for collecting any evidence. The
application ujs 156 (3) Cr.P.C. was dismissed. He listed the matter for complainant's examination
ujs 200 Cr.P.C.

s. When a complaint regarding commission of cognizable offence is made to the police, then no
doubt police has to register an FIR ujs 154 Cr.P.C. In case the SHO of the Police Station failed to

~==~
~· ~
:=~~
~;

~~;
~\
~

~·;~
,:::;.-,

;.;;
Iridian Kanoon • http:/lindiankanoon.org/doc/85426826/

 (,·'3!./Q
~~~~~

!<;7;i!?.r.

"--\\
In The Court Of Shri A.K.K~har vs Smt. Priya Laksh on 13 October, 2015

register the FIR u.s 154 (1) Cr.P.C., the complainant
can approach the DCP (or SSP as the case may
I
be) ujs 154(3) Cr.P.C. However, the facts as revealed from the TCR, show that the revisionist did not
approach the DCP concerned for registration of the FIR ujs 154 (3) Cr.P.C. It is also noticed that
there is no affidavit ofthe revisionist alongwith the application ujs 156 (3) Cr.P.C. before the Trial
Court.
CR No.01/15 Dr. Mrs. Krishna Yadav vs. Smt. Priya' Laksh & Ors.
In a recent case of Priyanka Shrivastava vs. State of U.P. in Crl. Appeal No. 781/12, the Hon'ble
Supreme Court has observed that an application ujs 156 (3) Cr.P.C. should be supported by an
affidavit duly sworn by the applicant, who seeks the invocation of the jurisdiction of the Magistrate.
Apart from this, it was also observed that there has to be a prior application ujs 154 (1) Cr.P.C. and
us 154 (3) Cr.P.C. before filing a petition ujs 156 (3) Cr.P.C. In the present case, however, neither
there is any material to show that the revisionist also approached the DCP concerned for
registration of the FIR, nor there is any affidavit in support of the averments in the applicationujs
156 (3) Cr.P.C.
6. Even otherwise, if a complainant fails to get an FIR registered of a cognizable offence, he is not
remedyless. He has a right to file a criminal complaint ujs 200 Cr.P.C. read with Section 190 Cr.P.C.
befol'e the Magistrate having jurisdiction to take the cognizance of the offence. The Magistrate can
either proceed under Chapter XV or he can proceed under Chapter XII of Cr.P.C. and direct the
police ujs 156 (3) of Code to investigate the matter and submit a report. The Magistrate take a
decision to proceed under Chapter XV or Chapter XII of the Code depending upon the allegations in
the complaint and the evidence in support thereof. In case Skipper Bewerages Pvt. Ltd. vs. State in
2001 IV AD (Delhi) 625, it was observed by the Hon'ble Delhi High Court that Magistrate has to
apply mind before passing an order ujs 156 (3) of the Code and the power ought to be exercised
primarily in those cases where the allegations are quite serious or evidence, is beyond the reach of
the complainant or custodial interrogation appears to be necessary for some recovery of article or
discovery of the facts.
7· The nature of allegations leveled against the complainant, do not call for any field or scientific
investigation. The CR No.o1j15 Dr. Mrs. Krishna Yadav vs. Smt. Priya Laksh & Ors.
evidence is within the control of the complainant. The Ld. Magistrate, therefore has aptly exercised
his jurisdiction to proceed with the complaint ujs 200 Cr.P.C.
8. I have not found any illegality or irregularity in the exercise of the jurisdiction by the Ld. ACMM,
while declining the prayer ujs 156 (3) Cr.P.C. The criminal revision petition, therefore, stands
dismissed.
9. TCR be sent back with a copy of this order.
10.

The criminal revision file be consigned to Record Room.

Indian Karioon • http://indiankarioon.org/doc/85426826/

 -'-;/"_,-;.-:,

£·~,

{'.~~

'r\~

«::~1"

.:~::·

I

In The Court Of Shri A.K.Kuhar vs Smt. Priya Laksh on 13 October, 2015

Announced in the open Court on
13th October, 2015

CR No.01/15

Indian Kanoon • http:l/lndiankanoon.org/doc/85426826/

(Ajay Kumar Kuhar)
Special Judge (NOPS)
South District: Saket

Dr. Mrs. Krishna Yadav vs. Smt. Priya Laksh & Ors.

I

 ~~

'PnYJ~yJU ·te_ P~ J-

.

""'::}~

-,,1

'

!~~~

@~

t,lri

~<%."

~:::1

ROHIT MADAN
(ADVOCATE)

. Part -1, New Delhi
9871588064, 011-29242928

7

~~

~\ ~
~
S- 496 Greater Kailash
'

,if~

:~-~

:~~

NOTICE

~-~·.:l

'~~- ~
.·<:

,:~:· ::

To

Sushant Sinha

i

a

~.I
~

~

~
't

~
:.:.. i
~;

I
~
~~A

~

~

~
~

~

~

Director
IKanoon Software Development Pvt. Ltd.
B-205, No. 44/3B, KNO 709
Ashish JK Apartments
Thubarahalli Extended Road,
Thubarahalli
Near Kundalahahlli Gate
Bengaluru-560037

And also at
826, First Floor
2nd Cross, 7th Main Road
Indiranagar
Bengaluru-5 60008

25.01.2016

~
~

~j'
~

~

q'~~
~
~

Dear Mr. Sinha

I

I am sending this notice on behalf of my client, Laksh Yadav with a request

~

to take down the following URL (http:/lindiankanoon.org/doc/854268.26/).

~
~l
~

~

~
~
~

Your Company website namely Indian Kanoon had published/uploaded

... 1

order of the Session Court, Saket, New Delhi in a Criminal Case (already

sr).

settled) dated 13.10.2015, which has nothing to do with my client but my

~

client's name is appearing in the aforesaid order. Now if anyone searches

~

~

name of my client on Google, aforesaid order of the Court appears on the

I

second position of the search list or search index which not only giving an

~

~

impression that my client was involved in some kind of criminal case ;which

~

Companies have started doing due diligence of their prospective employees

r.

1
(\1

~

~

~
~

8

~

,~

is not true but also affecting his right to Privacy. Nowadays when

I•

v
~

j

.,.•I

,
4

MADAN ASSOCIAiES
Advocates & Legal Consultants .... wlier•J'r+roricmo'i•.,, i.r a hahi't

~
~g

Chamber: 151, Lawyers Chambers, Delhi High Court, New Delhi

~

I rohitmada@gmail.com II rohitt@madanassociates.com I
I www.madanassociates.com I

·.....__~-

 e

ROHITMADAN
{ADVOCATE)

K~'J

S- 496 Greater
Part -1, New Delhi
9871588064,011-Z9242928

through Google, Facebook and Linkedin etc, coming anyone's name m
criminal case will definitely affects his/her future employment opportunities
and will create his/her bad image.

It is also pertinent to mention that recently European Court of Justice in the
landmark case of Google V. Mario Costeja [C 131112] dated 13.05.2014
had ordered Google to remove the links related to Mario Costeja on its
website and effectively read a "right to be forgotten" or "Right to delink"
into existing EU data protection law. Hon'ble Court has held that data
controllers or intermediaries are required to delete information that is
"inadequate, irrelevant or no longer relevant" if they receive a request

for removal of such data.

Therefore I sincerely make a request to look into the matter and remove this
aforesaid URL from your database because it is irrelevant and obsolete
information & jeopardize my client's prospective employment opportunities.

j

.Pi'
':!

t~
;:~

~j

?J

;Jj
<· ~
>~
\.i

-''/(\l
/".•

...

:-~ ·::

R.ohit Madan
Advocate
+91-9711904919
S-496, Greater Kailash
New Delhi-110048
India.

·.":~

·,·,
\<.1

~~
~~

-;.,.
~-~

r.

~~

~~
~~
~

~l

___.____

~----~----------*-------------------~~~~~"
MADAN ASSOCIATES
Advocates & Legal Consultants ......-liereJ'r<fBssionali.mo is a lialiit
ChambE!r: 151, Lawyers Chambers, Delhi High Court, New Delhi
I rOhitmada@gmail.com 1I rohitt@madanassoci.ates.com I
I www.madant'lc;snr.ii'ltPc;.rnm I

$.'

f·
i-'."

 -~eture f--3

'-P

=-

~

e

S· 496 Greater l<ailash

ROHIT MADAN
(ADVOCATE)

Part ·1, New, Delhi

9871588064,011-29242928
NOTICE

To
The Grievance Officer
Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
;.·~.:

25.01.2016

USA

iS'
~:-~

;~~

~
~

Re:

Request for delinking /removing the URL from the search result or Search

index

~~1

@!
g
t?o
.~~

~~

Dear Mr. James Rauen

);;}]

i!r;.
:•

'[1)
-~

I
~~
t~

~H
{~'I

I am writing this email on behalf of my client, Laksh Yadav with a request to
delink the following URL (http:l/iiidiankanoon.org/doc/85426.82.6/) from your
search result or search Index. "Indian Kanoon" an Indian Website had
published/uploaded order of the Session Court, Saket, New Delhi in a Criminal
Case (already settled) dated 13.10.2015, which has nothing to do with my client

-~

but rny client's name is appearing in the aforesaid order. Now if anyone searches

~~

name of my client on Google, aforesaid order of the Court appears on the second

'-'l

~1

~~~

~,,

1~- ~-l.'

1.
~~

1)~

~::;1
~~

t~

'l1i

position of the search list or search index which not only giving an impression that
my client was involved in some kind of criminal case which is not true but also
affecting his right to Privacy. Nowadays when Companies have started doing due
diligence of their prospective employees through Google, Face book and Linkedin

};".;.

~~~

fi

'-"J

;:~.~

I
l;~

ff~
~-~

'1"\l
):l;:

etc, coming anyone's name in criminal case will definitely affects his/her future
employment opportunities and will create his/her bad image. It is pertinent to
mention that my client is not asking for the deletion of the aforesaid order which is
legally tenable and true record but only asking to delink the material or remove
from the search index so it may not affect his image or prospective employment
opportunities.

!ih

l~;.::~

'{!-~

Ii
i;\!

~~~
h~
-1,~

i%~

MADAN ASSOCIATES

Advocates & Legal Consultants ....wiloreJ'ro.fo.t.ricmrli.nr, '" 11IMnt
Chamber: 151, Lawyers Chambers, Delhi High Court, New Delhi
I rohitmada@gmail.com II rohitt@madanassociates.com 1
I www.madanassociates.com I

 ~rt

'

@@

ROHIT MADAN
(ADVOCATE)

S- 496 Greater Kailash
Part -1, New Delhi

9871588064,011-29242928
·- .
--"
,_

-

-------'---

---

It is also pertinent to mention that recently European Court of Justice in the
I

landmark case of Google V. Mario Costeja {C 131/12] dated 13.05.2014 had
ordered Google to remove the links related to Mario Costeja on its website atillge
effectively read a "right to be forgotten" or "Right to d~link" into existing EU data
protection law. Hon'ble Court has held that data controllers or intennediaries such

as Coogle, are required to delete information that is "inadequate, irrelevant or
no longer relevant" ifthey receive a request for removal of such data.
Therefore I sincerely make a request to look into the matter and delink this URL
from your search result or search index, because it is irrelevant and obsolete

it1formation & jeopardize my client's prospective employment opportunities.

'-!'l

.·>
;-··;

----.

.

~

,...-

RohitMadan
Advocate
+91-9711904919
S-496, Greater Kailash

New Delhi-11 0048
India.

:.-·]
·.'·:1

"':·:·'

",I

:-·~-; ~--·

;:'::1

::·:)

!j~
li~
\

MADAN ASSOCIATES
Advocates & Legal Cor\s~ltants .... wh"orsJ'rofo.rionaR...... iuh"uii't
Chamber: 151, Lawyers Chambers, Oelhl High Court, New Deihl

~?.

I rohltmada@gmall.com II rohltt@madanassoclates.com I

~:;~

l www.madanassociates.com 1

.,j

~-~~

·:.:.:1

 ~~~@XW~*b~;;~;~~~t~~~~~~~~~~~~~~$~::-~=~~::~,~«{~~.~~:~~~;~~~~~~~:~~s~~~~;}~~-~~~?~;~~~~~J~:~~,~~t~J-~:;~~~~:,x::;~~~,:-

•

~

·

'

~r1€f\JY€_

.

r-'{

~

I

'I;
'"<'

.~
~~

'1-

~

\.j

~
II
~·''

~

~~

~

I

I

l

«

~

~

m~

i

56% of employers check applicants' Facebook, Unkedln, Twitter I ZDNet

11/01/2016

·SW

~

I

~

"<''

~

~

~

~

MUST READ HOW TO BLOCK WINDOWS 10 UPGRADES ON YOUR BUSINESS NETWORK (AND AT HOME, TOOl

~
~

~

~

I«

~

M
"t~

56% of employers check ~pplicants• Facebook, Linkedln,
•
Tw1tter

1

~

More than half of employers check the profiles of applicants on social
networks like Facebook, Linkedln. and Twitter. Here's what both employers

I

g(~

·~1
f•. ·~

0,

MENU

~tv.l

I
~

I. •

•

~

*~j
~::

IN

.

~

&
xe:

.

By Emil Protalinski for Friending Facebook I January 16,2012 ··16'.19 GMT 121:49 ISTII Topic: Networking

r.~
<&~

%

~

~
;0,\

~

!http://www zdnet.com/blog/facebook/56-of-employers-check-applicants-facebook-linkedin-twitter /74461

~

~
~
~

~

.
~

~

AA

I

~j

Nowadays. the documents you submit to your potential employer

~

(cover letter. resume.references) will not be the only h~ or she looks

;g

at. In fact. more than half of employers are probably go1ng to also

~

check out your accounts on social networks.

~

s

~
w
~
~

~1:

G:

~

~

~

~

~

The data comes from the UK business psychology firm OPP
(http:/ /www.opp.eu.coml.
·

which is presenting its findings this week at the

British Psychological Society (BPS (http:! /www.bps.org.uk/l) conference

(http:! /www.zdnet.com/l

~

of-employers-check-

~~;

.

:'"~
~

on occupational psychology. One of the papers by the business

~~t~

psychologists covers a 2011 study into the use of social networks

~

such as Facebook, Linkedln. and Twitter.

~

56 percent of employers said that they were likely to check out the social media presence of

~

~
~~J

i

I
'

~

~
~
11:
~~~;:
,'11",\

?J·'
>~
:.\~.

'

::?i
~:

~j

'~~"

r1

~~

~

~

~

linkedin-twitter /7 446l

~l

ic~'J
,,,,,

,..

~~
;~o"

potential employees (although 27 percent of those surveyed said they would be
uncomfortable with the same being done to them). 37 percent of people say they change
their persona online- so looking at their online presence may be misleading anyway. On the
other hand, a recent study said your Facebook personality is genuine

~~::

~:·.:;

iJ~

~_;-.

(http:/ /www.zdnet.com/blog/facebook/your-facebook-personality-is-genuine-study/7237),

so it may not be

that misrepresentative after all.

""·:

t]
:0ijlj

appl1cants-facebook'

r~.-.~

http:/IWWW.zdnet.com/article/56-of•employers-check-applicarits-facebook-linkedill-twitter/

 ~~

.~~···
~~~

11/01/2016

56% of employers check applicants' Facebook, Unkedl~, Twitter 1ZDNet

So what advice does the OPP have for jobseekers? It's all common sense: lock down your
Facebook profile, and behave on Linkedln as you would at a professional networking event. It
also wouldn't hurt to check your Facebook privacy settings .
(http:/ /www.zdnet.com/blog/facebook/facebook-moves-privacy-controls-inline-simplifies-sharing/2948%20).

Meanwhile, employers need to tread carefully to avoid breaking the law, avoiding racist,

I
~~
~-;i

~

;::·\·

I

sexi?t or anti-religious biases that might surface. On the other hand, if they do fire someone
who misuses social media, there could be accusations of discrimination or unfair dismissal.
not to mention potential damage to an organisation's reputation.
When I worked at RIM last year, I got in hot water for this article: RIM announces Facebook
app for BlackBerry PlayBook (http:!!www.zdnet.comlblog/facebooklrim-announces-facebook-app-for-

t·.!l,.

m
&

~~~
~

~~

blackberry-playbook/1321).

Although I had a disclaimer, it included my opinioh, which made RIM

look good and Face book look bad. I've said it before and I'll say it again: in today's day and

~

~

1

age, companies need a clearly stated policy for social networks,

~
~

See also:

~

!j
~

~

~

I
~

Q

~~

• 48% of job seekers have used Facebook to look for work
(http:/ /www.zdnet.com/blog/facebook/ 48-of-job-seekers-have-used-facebook-to-look-for-work/5486)

• Job recruiters increasingly using Facebook to find candidates
(http:/ /www.zdnet.com/blog/facebook/job-recruiters-increasingly-using-facebook-to-find-candidates/2373)

~

~

~

• Facebook partners with US government to reduce unemployment

~

~

~

~

~
~

~

~

~

I

~

~
~
rn
~

~~

·~
9
\:(

i

(http://www .zdnet.com/blog/facebook/ face book-partners-with-us-government-to-reduceunemployment/ 4782)

• Facebook apps have created 2oo.ooo US jobs (study)
(http:/ /www.zdnet.com/blog/facebook/facebook-apps-have-created-2000oo-us-jobs-study/3806)

• Judge: fired for complaining on Facebook? You're rehired!
(http:/ /www.zdnet.com/blog/facebook/judge-fired-for-complaining-on-facebook-youre-rehired/3463)

• Employer demands Facebook login credentials during interview
(http:/ /www.zdnet.com/blog/facebook/employer-demands-facebook-login-credentials-during!nterview/327)

,,,
~

I
~

~
~
~

I
~

1.1

~

~

~

~~

http:/lwww.zdnet.com/article/SS.of-employers-check-applicants-facebook-linkedin-twitter/

 ;··,,,

~~'
~~;_

"~

,;..

;. ~ :-

~

,,.:i~:·

v

56% of employers check applicants' Facebook, Unkedln: Twitter I ZDNet

11/01/2016

~~~

I

RECOMMENDED FOR YOU

·,:,;

"{-.

So long Surface Pro 4.
I'm going with the iPad
Pro I ZDNet

How to take control of
Windows 10 updates
and upgrades (even if
you don't own a...

_·.·~;
•·

;)
;.-

;~.::

Powered by

Learn more

for you
;.;:,_

~-:;·

~;.~
:.J,

JOIN DISCUSSION

~\s
. . .<-

~

SHOW COMMENTS

RECOMMENDED FOR YOU

Wireless Security Survey 2015
White Papers provided by FORTINET

%READ MORE

CES 2016: Amazon Echo·s Alexa plays a starring role (and
http:/lwww.zdnet.com/article/58-of-employers-check-app\lcants-facebook-llnkedln-twltter/

 T"'"'""""'~"'~"""'h~""""''"''""'''"'~~;w;;0\11[52C';'1 ''''"'"'''

'!','$1>!!3''""i

s·'()

;;:~

It~t~

\<."iq

~-· J

&~:

I

(:"'

(.::·

:: :~

f~t8

;:_,~

~~-~r~

~g)4

:~~~~~

56% of employers check applicants' Facebook, Linkedln, Twitter 1ZDNet

11/01/2016

~~1

I
~~~\:

~
ff1~,~!
~:);1

she·s not even there)
By creating an intelligent cloud platform with voice services, Amazon
continues to see third-party products integrate Alexa as the invisible
interface of the future.

~~
;y_::

By Kevin Tofel for Mobile Platforms I January 8, 2016 --19:39 GMT (01:09 ISTl I Topic: Amazon

t1·~

'*

~ti~;~~

1~.
l~i

.,'.:.•...1

)},

~~:?}

~~~
.
t;J~
,;~'

~-i~

-'.'1

~~

~f.~i

;~...~.:
\·•!

~

~

~

t

~
:i

•
i1J
~

~H
~

~~
~

~

Ask an Amazon t:cho, "Alexa, where are you?" And ybu're sure to get any number of witty

>.;:"

'
~

~

responses. One of them won't be, ''I'm at the Consumer Electronics Show," however. You'd be

I

hard pressed to know that.

~
~

~
~

I
.

A number of hardware makers took to CES by announcing Amazon Echo integration through

'

~

I~ .
~

~
~

Alexa, even though Amazon itself isn't at the show. As The Verge's Nick Statt notes, this is
"Am~zon's

stealth takeover of the smart home at CES 2016.

(http:/ /www.theverge.coni/2016/1/7/10719202/amazon-alexa-ces-2016-takeover-smart-home)"

~

"~
~

How can that be?

MORE CES 2016

'1
~

2

~

http:/lwwW.zdnet.com/article/56-of-employers-check-applicants-facebook-linkedin-twitter/

~~

~

1~
~

~

I~){i

~~

~

~•..
~

Vi'"

 -~~~~~;;&.~~~Yf&ito~i£.~:::i:»:i:i..'1::;:(:~~~;~.:;:;;;:::wxs~2:!~'?J~r;j·~~;~;:~:~,~~':::?i'5 ~;::·?~~:::::r;'~

>'),

:r;•
,(:,!

~;.

:·~
•,.\

~

'1,(,

·'··'
~~~

~:

31

~

~
~J

~~-~

(
?·~·

~;~

•~

,,*

·~- <

::-.i
~;r

~"~.~.·.~

•I
~

~

'~

~
~

(·•

,.i'-

,,...
t:"

11/01/2016

It's simple really, and if you've been following Alexa

~@
~

Virtual reality faces five hurdles

t:~!

most.

ces-buzz/)

preview of its free Alexa Voice Service. for example.

(http://www .zdnet.corn/ article I samsung-

~5

the voice controls and cloud smarts into their own

fl,1
~

products. And as evidenced by a number of CES

'
~

product launches, some companies are tapping into

power-a-sneak-peek-at-the-coolest-

Alexa.

robotics-trends-of-ces/)

~

Take the $29 TrackR Bravo tag

Meet this year's weird, wonderful
and worst tech

ij
'>:i

~

(http:/ /www.cnet.conVnews/alexa-where-are-my-keys-trackr-

(http:/ /www.zdnet.com/pictures/ces-

I

syncs-with-amazon-echo-to-help-you-find-your-stuff/).

'

The coolest robotics trends of CES
(http:/ /www.zdnet.com/article/roving-

You

~

you find your stuff. This year, TrackR Bravo will

(http:/ /www.zdnet.corn/article/why-

m

integrate with Alexa so that you can simply ask her to

every-tech-company-is-now-a-securitycompany/)

find your tagged belongings.

~
~

~

~

CNEl: How to dominate CES 2016

Earlier this week, Ford announced it too would
integrate with the Amazon Echo

$

(http://www.zdnet.com/article/alexa-is-my-garage-door-dosed-

e

ford-wants-your-car-to-talk-to-amazon-echo/).

~

!
~

~
~

:y~

(http:/ /www.cnet.com/news/ dominateces-2016-with-cnet/)

I
~

.c.:;

attach the small. round Bluetooth enabled device to

fu~

lli

>
r:.;

tech/)

As loT takes center stage, security
gets lost in the wings

~

,;·.i

";,:

201G-rneet-this-years-weirdest-and-worst-

your taptop bag, coat, keys or what have you to help

~

,·
r.,:
[,i

apj)Lianees-ernotional-pluck·and-cloud-

A
~
~.9

M
M

~;~

o.<

}',

M

~

2016/)

~

~

~1

0

That allows third-party hardware makers to integrate

I

')

{'c,)

Sam sung smart TVs will all be loT
compatible

I
~

~

@
,,
~:.8

smart-tvs-will-all-be-iot-compatible-from-

%

I

'•i-·~

(http:/ /www.zdnet.com/ article/virtualreality-faces-five-hurdles-to-justify-the·

w

~

~~

a product. but Alexa is really the platform that matters

Back in August. Amazon introduced a developer

~

4-business-trends-to-rule-them-all/)

created perhaps one of the best voice-activated cloud

I~

•

I

4 business trends to rule them all
(http:/ /www.zdnet.com/ article/ ces-2016-

over the past year. you'd know why. Amazon has
platforms for the smart home yet. Yes, Amazon Echo is

~""

~;li

56% of employers check applicants' Facebook, Unkedln, Twitter I ZDNet

The system will work both ways: from Alexa to your

car and vice-versa.
i

'

(rordJpgj
'
'

\.~.

m
t:J
:~

·:j

~

:s
*.·\i

i'~
,J~:;

~~

:l"~i

:t;~

http:/lwww.zdnet.colli/artlcle/56-of-elliployers-check-applicants-facebook-linkedin-twitter/

;·

 r~····-r~"""'""'"'"'''>l®:M=~·ill~Gl'u\t:;~"Mr%%f'11tlli-1§~

~

I

1
j

~
l

'
'

~:

,~:~ji

~;~

5~3

ii~
f;J~
ft.:{~

~~;~

·-·§

~(,1
~(·,;:

;~1~
-~. :,~
!·r.JI

56% of employers check applicants' Facebook, Unked!n, Twitter 1ZDNet

11/01/2016

~~;§1
1~~

Ford is working to integrate its in-car systems with smart home packages.

~

Photo: Business Wire

;)1
~~

*~

~)~

f~;:~j
~~-

Sitting at home you might want to know the fuel range of your Ford vehicle: Simply ask Alexa

F·)]
,[,1

and she can tell you. But when behind the wheel, you can use an Echo as welL Perhaps like

h.~~

me, ,you have various smart home devices such as lights or a thermostat connected to your

~·f
;;,j
t}~

)fj
{,}I
({~i

Echo. A few miles from home, you can tell Alexa to turn on lights and adjust the temperature,

~~

simply by speaking to the in-car Ford system.

~

j.l'h

Then there's lrivoxia's Triby (http:/ /www.invoxia.com/en/tribyl:

~

A small Bluetooth speaker with a magnet so you can

~~

attach it to various things around the home. Alexa will

~j~
5t

~~

~
;\%

}.,"),~

'1'1
t-&
~~

~-q

~~
~Yt

'_.:;_1

SEE ALSO

Amazon Echo: It sucks. It's
awesome. It sucks. We want two
more

be built in so that different family members can request

(http:/ /www.zdnet.com/ article/ amazon-

music playback or make voice-over-IP calls

echO-it-sueks-its-awesome-it-sucks-we-

(http:/ /www.invoxia.com/ sites/ default/files/images/2016.01.04-•
_tribY. _a nnounces_amazon _alexa _integra tion.pdf).

want-two-niore/)

A dozen tips and tricks
(http:/ /www.zdnet.com/ artiCle/ a-

\1J

q

\~>.\
-~·:1

~i~i

llill

Why the sudden the movement fer third-party Alexa

f\'1!

adoption? Simply put. Amazon is providing all of the

~~

tools to make it easy and free for developers and device

i;g
;~;il

{t
~l
"

:;,<,j

dozen-helpful-amazon-echo-how-to-tipsand-tricks/)

Echo: Sorry, you're no SONOS
(http:/ /www.zdnet.com/ article/amazon-

makers.

~;:~

echo-sorry-youre-no-sonos/)

V_'
,.2

~.V!

:~~"''I

It doesn't hurt that Alexa is quite good at hearing and

It's the most used gadget in my
home

;\j··l·

responding to requests, either. There's no need for a

(http:/ /www.zdnet.com/article/amazon-

~
~

company to spend tons of R&D to develop its own

echo-its-the-most-used-gadget-in-my-

speech·recognition system that taps into the cloud

home/)

when Amazon provides a more than serviceable option.

How Echo is slowly, quietly
becoming your smarthome hub

And while we're hearing all about gesture controls

(http:/ /www.zdnet.com/ article/how-

' 'l
~

~
~,,s
~<~

~~

~~

}$

.?:1
~·~

amazon-echo-is-quietly-becoming-a-

;l~

(http:/ /www.zdnet.com/ article/ces-2016-is-this-the-ui-of-the-

~
~~

future/)

'_(1

~

~~~

as well as AR and VR as interfaces at CES,

speech - when done right - may be the best interface of

:1:1

~~
·5

~"_.,l_·
r~
-~,.

J)j

m
*~
~~

~~
.ill

r·

smarthome-hub/)

http:/lwww.zdnet.com/article/56-of-employers-check-applicants-facebook-linkedirrtwitter/

Amazon Echo beta SDK coming
(http:/ /www.zdnet.com/article/amazon-

,.,

 ~~~~;,.~~-X«-&<-:¢:;:~~~·~Mt:;::::::~~~>:~~~:,:):J9·~~~:0KVM"<;~<;~~~~r~·~>\:.t-v~&t;;~~·>~;.~i;;-:?~1W'~~e.J~~~;;r:;Y.~:t~i~~~,:yo:~.~~~~h0~~~:.~~~
h~
~§,]

~.te.l;

0

5t(

-Ill

®
By: Lisa Guerin (/lawauthors/lisaguerin. html), J.D.

~\{cr~J

(vlHfo

~
~:

~J~~,,

(,V,

~{/:

~~~

0~

~~:

t):j
fl~;-

Do you have a blog, Facebook

pa~e,

or other online presence? Most people

use social media to some extent, whether to post pictures, air opinions, stay in

ti~

;\! ~:~

~;!·_:-.

}~!~,

·,:;~(i

touch with family and friends, or get involved in communities of people with
similar interests. Of course, some people also use social media to air offensive
views, post pictures of themselves drunk or naked (or both), or show off their

~}~·;

~~;;

~~~~~

~

~»

~~~

~~~

~~

extensive weapons collections.

The opportunities the Internet offers for selfexpression can become a problem
once you embark on a job search. The news is full of reports of employers
turning down applicants based on online posts; some employers even ask

~~

t··}6

~.

~~

~~§~

applicants to supply their Facebook or other online passwords, to allow access

~~~j

~:~~;::

to information that they've tried to keep private.

~e)!~,

~~·>:

~t~
~~~~j

~i{

What Employers Are Doing

,,., ..

~~~::

According to surveys, about threequarters of recruiters check out applicants on
the Internet when hiring, and almost half of all employers do the same.
Employers report rejecting job applicants when they find references to drug
use, heavy drinking, sexually offensive materials, violent imagery, and so on.

In recent months, some employers have started asking applicants to provide
their passwords and login information for social media sites as part of the
interview process. Even if an employee has used a site's privacy settings to
protect certain information from public view, an employer with access to an
employee's password can bypass these protections and see material the
employee intended to make available only to chosen viewers.

Legal Constraints on Employers

Employers who check applicants out online run a number of legal risks. First
off, an employer who looks at an applicant's Facebook page or other social
media posts could well learn information that it isn't entitled to have - or to
consider during the hiring process. This can lead to discrimination claims
(http://www.nolo.com/legalencyclopediaL

suingharassmentdiscrimination.

.-

;~~=

 ~-&~a.o.~:-:~~'"~~;m*~·~~~-x~~..t5~~~s.rJ:~;:~s·~~~~.~~~~~m)~"5~~<~~t:=~.:~~?~~~~~c~~-~-~;.§~~-~~~;:~Y(~.:~~?S·:·~~>:~;;:;"~--~_·:.:·:~s~-;::;=

f;
-~·

!?5
html). For example, your posts or page might reveal your ethnicity, disclose
that you are pregnant, or espouse your political or religious views. This type
of information is off limits in the hiring process, and an erbployer who

~'•/:

}~.
~·~"\

~~

r,~

~~--

~
~·
~

~

discovers it online and uses it as a basis for hiring decisions could face a
discrimination lawsuit.

~

~~
~»

~

*I
~

~

Applicants

are

protected

by

privacy

laws

~

~

~

(http://www.nolo.com/legalencyclopedia[ employeeprivacy) as well. If you

!

have publicly posted information about yourself without bothering to restrict

i

~

n

«

who can view it, you will have a difficult time arguing that it was private. An
employer is free to view this information (although it may not be able to use it

~

I~.;

~

~

~

I
I
I

in the hiring process, as explained above).

~

~

*
~

If, however, you take steps to limit who can see your posts, the privacy
equation shifts. A couple of courts have found against employers that have

~

~

~

~
~

~

passwords; in both cases, employees had set up a restricted online space to

I

vent about the company.

~

accessed private websites or pages by misappropriating employee names and

~

I

I

~A

In response to publicity about employers pressuring job applicants to give up
their Facebook passwords, a number of states are considering legislation to
ban this practice. Maryland became the first to pass a law prohibiting

~

~
~~

I

employers from requesting or requiring passwords to social media sites; a
handful of other states (http://www.nolo.com/legal-

encyclopedia/canpotentialemployersaskfacebookpassword.

html)

have

followed suit. Facebook has weighed in to make soliciting passwords a
violation of the site's code of conduct. And, the federal government is
currently

investigating

whether practices

like

these

violate

federal

discrimination (assertingyourrightsagainstdiscrimination) and privacy laws.

What Can You Do?

·

-'

·;

 ~.x··

5£
If you are about to embark on a job search, consider whether you might need

@i

to clean up your online act. Of course, with cached sites and historical
searches, you really can't entirely undo your past posts. But take •a close look
at your publicly accessible information and make sure it's ready for prime
time.

Also, mind those privacy settings. If you have information or material you
want to leave up but don't want employers to see,at least put it behind a
privacy wall. But you should be aware that employers may still be able to
request your password, unless your state has prohibited this practice. You
should also untag yourself in any photos that you don't want potential
employers to stumble across.

If you've left an unfortunate digital trail, be ready with an explanation. Even if
you are able to take down your original indiscrete post, it may have been
reproduced or quoted elsewhere, others may have commented on it, or it may
simply live on forever in the digital wayback machine. In this situation, the
best you can do is try to minimize the chances an employer will find it and
have an explanation (of your youthful indiscretions and your changed ways,
for example) queued up if you need it.

Employers Admit Checking Facebook Before Hiring

·~ [B'nkJ- ~ 5J

Increasing numbers of employers are checking out potential staffs social
networking profiles, says Careerbuilder.com.

The job search website surveyed employers and found that 20 percent of
companies admitted to checking out candidate's profiles on social networking
sites such as Facebook and MySpace before deciding to employ them. A
further 9 percent said they planned to start reviewing potential employees
social networking pages in the future.

The research also revealed that while 24 percent of employers had hired a
member of staff based on their social networking profile, 33 percent had also
decided not to make a job offer after reviewing the content on a profile. Use of
drugs or drinking and the posting of photographs deemed 'inappropriate' or

 ""*"'*""""€f!C'%l"""'~"''Mi""*'*-~*""'"""*'"'"*""-"=-==>'''""'""''"'"="'"""""''""'""'w-=~;==·

'provocative' were identified as the most popular reasons why employers
eliminated a candidate after viewing their social networking profile.

Careerbuilder.com advises job hunters to either regularly edit their
socialvnetworking pages to ensure there is no negative content available or
I

make them 'private' to avoid wouldbe employers snooping at their personal
life.

Is it wrong to Google job candidates before interviewing them?

[ A"'t.'A-

vi

J

A reader writes:
'''{
::;.

•J,,

I recently was given the responsibility offinding interns for our company. In
the process of reviewing applications, I Googled one of them. The first search

~;.

fj,.~
[_ ~·:·.~

result was her Facebook page so I clicked on it, and saw that many of her
posts and pictures were set to ''public. " I did not see anything out of the

~:/

::r:·
..

~~

ordinary or really anything that would prevent her from getting a job, but

;:{:·

decided to mention it to my boss and co-worker anyway, just to see what they

).·r,;.

thought.

To my surprise, I was met by extreme resistance to what I had done. I was
told that it is not okay to look someone up before an interview because what I
find might "color my opinion of them" and that my own personal judgments
might get in the way. I was under the impression that it is one's personal
responsibility to curate their web presence as they see fit and that whatever is
found through a simple search is fair game. I was also under the impression
that this is pretty standard these days. Am I wrong? Is looking up a potential
intern or employee prior to an interview unethical?

No, you're not wrong. Your boss and coworker don't know how to hire. Small
company, I'm guessing, and your boss doesn't have significant experience
hiring? Because this is the kind of thing people say when they don't know
what they're doing.

r).~
J/~

-~~-~-

 ~z. gr,g:_x.x~~=~(~~~..s&~·~~w~~0'"~~~~%:::~~~{~;.~.-~,;:~;-s:~~&Ji&~~.:--:·tt:!S~·~·?d~::·:.,~:~sx;...~-:»':?~5{;,x~y;:;·~~~~~..:~"!"~::~-=:t1:Y.:·~··;~.·:;:~·,.._·v/,>:'·i:;,-;-:·
.
=·:.~-~.w~~~=l·;;r~-)--:~~-'\:-.~~/ . ''!'1'-"·:~-~-~~C::\;::i·::.>~~~(
1''-'·

5 u9
It's very normal to Google candidates. The vast majority of employers do it
e;~
""3$

·~~~~.t ~.
e!~

~~

t-v:.;C'~(~

before hiring someone (77%, according to the most recent study I saw on

~~1

[o'';=

~~~

this).

And yeah, you might indeed find something that would "color your opinion of
I

them." In fact, that's the point. For instance, you want to know if they have a
Twitter account full of racist rants or posts trashing their employer, or a blog
full of terrible writing that demonstrates low critical thinking skills. You want
to know if there's evidence that information in their resume is false. Or, on the
positive side, you'd also take note if you found a blog full of thoughtful,
well written posts, or a track record of contributing to discussions in their field,
or additional information about their experience that solidifies your
impression of them as a strong candidate.

Those are all legitimate things to take into consideration as you assess a
candidate.

When you're hiring, you want the most information possible about the people
who you're seriously considering. It's an amateur move on your boss's part to
believe that you're somehow supposed to be confined to only information the
candidate herself offers up -

it's a misunderstanding of what good hiring

means. You don't rely solely on what a candidate chooses to tell you about
herself.

Now, there are ways to misuse Internet searches when hiring, of course like allowing yourself to be influenced by information that you're not legally
allowed to take into consideration, such as that the candidate is pregnant, or
what her religion is. But it's ridiculous to say that you shouldn't do any
Googling because you might find those things out, just like you wouldn't
interview all candidates behind a screen so that you can't see their race, and
with a voice distorter so you can't tell if they're male or female.

Most employers Google candidates. Your boss is off-base.

[A~S)
What 80% OfEmployers Do Before Inviting You For An Interview

·<

 .

~~~:-m:~~~&,.~~,Y.)}~{~:«?_;~~.."~"&·:'\':;:;~~;..-t(-,:;:_..-:,;?~~·:V:;;~«·~~:<~:.~~~·~,;'{~~~~,.,..i:eXJii&"~·:V-"':.t,.".!'NX.x.<·fn::;':·,a• ~~!!Ul.~:.':..:'.!~~... ~ao".~-""S:~~~

3~
@$

~'{~

I

;c;~.~~;s
oey,.,,_,.

Many job seekers have described to me that submitting a resume in today's job

~!{~l

market is mostly a bangingtheirheadagainstawall, extremely frustrating waste

lt~

of time.

~:.r£!
~·~~~-:··

•

You want that resume to get you into an interview, but it doesn't. I think this
I

~,'~+:

~~ii~~

~
c; ·~··-'

·-->'(

could be why:
80% of employers
Google job seekers
before inviting them
into an interview!

If employers don't find something good and solid, that agrees with the resume

Linkedin Profile is perfect for this you aren't invited in for an interview.

Interviewing job candidates is very expensive for an employer to do (second
only to the cost of hiring the wrong candidate)! Consequently, employers use

~

:~~;t:

Google searches to try to avoid those expensive mistakes.
~ ~'

c
~c

The resume submission to interview invitation process typically runs through

1·:-·

these four steps:
o,-

•>:

f~;
i:;_:_

Step 1. Resumes are received and screened into two groups ("possibles" and

"no").
--~

Step 2. Someone opens up a browser, and begins Googling the "possibles"

which are then screened into three groups ("more likely" and "less likely" and
"no") based on what is discovered or NOT discovered.

Step 3. The "more likelys" are compared. Phone interviews (a.k.a. "phone

screens") may be conducted.

Step 4. Invitations to interview are extended, and the real dance begins.

When nothing, or nothing good, is found about you, you end up in the "less
likely" or "no" piles in step 2.

~f
.:}

 ;:~;;;~«;:::~;g_:;:«»;:J?;~'":'~::t.:~:::~::&%<,;;.-'::;;.:;;;:;:::::::~~~S'§~::u;;;;:~:::~~:;:'::'W::l:;«":>:-x~~;M~~&~~"W~c~x;;;:;::::;:,':·~:'<H;t:;;"J-~~~l':'0c~0W:n~·~'?;•;y:·:c:::)\i!:'f~l!'f}:Jim,~z.::;:~:~';<t'.a:c<.-_~}*

%,~

~'?'~
6'!(;

0-~

(~~

What Should Job Seekers Do in Response?

6c

r~
~~:.z~

v~

t,,

@i:j(

~}
~. ~

~~

~li

rY&.)

;:>x
<;:-'(
~~

In addition, your participation will not only help you survive the Googling, it

~

will also increase your "market value" and the size of your networks.

~~

The good news is that job seekers can influence what is found in this process.

tt:;;
~~

m
r.~·
~~<·

:75}'

1. Google yourself!

Look at the first three or four pages to see what is visible to an employer about
you.

I
~~

~~:n
,-Y~

;;"·k:

DO NOT be happy if they find nothing about you on Google! That means

\~

either of two things to most employers you don't know how the world works

~~i;

today (so you are out of date) or you are hiding something. Neither of those
two impressions will help you in your job search. Then, practice Defensive
Googling for the rest of your job search (and career).

c~~·:

~\-;

C:~-~

r~r

;_~

I
,,:t:-.:::)

~;Ji

11..--.::-.

~:1~~
_;::~

2. Google anyone wellknown and wellrespected in your field.

What does Google show on the first page of search results? Assuming it

~:;~:::

doesn't show things like TIME magazine cover stories, a feature in The New
York Times, a 60 MINUTES segment, and other similar high profile media

;''"

s::.;

mentions, carefully look at what you find. I bet you could also get visibility in
most, if not all, of those venues!

If you Google my name, you'll find:

t-·'"

F

t~=

•';,-,

~-~~

--:;:=.

~~~

~s-~

~~;
~;

My Linkedin Profile
My Twitter page
My Google+ Profile (naturally!)
My VisualCV
My Facebook Profile
My HuffingtonPost articles
My Amazon Profile
A Pinterest page
A YouTube page, Etc.

;

 6!

®

ALL of those pages are available for everyone at no cost. The Linkedln and
other social media pages are easy to set up and very popular with Google. The
I

best part is that all of these pages describe me in my own words, because I
wrote them! And because they are "public" for the world, including my

colleagues and friends, to see, the assumption is that they're probably true, at
least for the most part.

3. Read my Reputation Management (or Recovery) Post

You can manage this issue. It takes time to set up and develop, but once you
have, it will take only an hour or two a week to maintain (assuming minimal
participation). When you are in job search mode, you will be spending more
time on this issue because it is so important to your job search.

4. Get busy working on your public image.

It's not just for movie and TV stars and musicians any more. We're all famous,
at least a little, and the sooner you get started managing your public persona,
the better offyou will be. Ifyou prefer, think of it as "personal branding." The
greater your positive online visibility, the better your online reputation, and
the greater the likelihood that you will have a response to your resume the
next time you submit it to an appropriate opportunity.

Do review the steps in Defensive Googling to stay current with what Google
shows the world about you.

Not Optional Any Longer

This post is in reaction to a discussion I had with a job seeker who is desperate
for a job, but very reluctant to put herself "out there" online. Making matters
worse, she is looking for a job in marketing. Anyone in marketing or sales
today MUST demonstrate that they understand

 ~;;.:;:;x;::~x;~~~22::0r~.z;x:-~"~~0;~:::::·.~.:~~~~h~*:?.:~~~;::::::5~~:~:;:<rw.~~z<:r:::~::>::·~~:~~:~:~:~::~;·~:;~:~{:~~~=:~~w~:~:~~:~~~:~!;,~->s~~~~f.td~~~;fi~~~~fJ["§J&~~:r..:;;:.m~,;;?JJj"?r/?i~tf~Y:.~~~~;~~f.'~::~::~}~5:~·-~. ·"··-·r;~-

8F!J~
/

how the online marketplace works, so she is really hampering her job search. I

~

;:·~~~'

:v

Y'

~-~!·

?.:~.:

hope she reads this and overcomes her fear of online visibility.

(;.:~.:

if'
?~

Follow

me

on

G+

for

more

job

search

tips!

https://plus.google.com/+SusanPJoyce/

:~:

f:.

{~~-~~

r\;

; -~!-'

Susan P. Joyce is president of NETability, Inc. and the editor and chief
technology writer for JobHunt. org and Work CoachCafe.com. This piece first
appeared on WorkCoachCafe.com.

'\')

 0'l1YJ~Q.'f~ r e f'- 5
fl.

~~

J21 manupatra
JUDGMENT OF THE COURT (Grand Chamber)
13 May 2014 C:)

(Personal data- Protection of individuals with regard to the processing of such dataDirective 95/46/EC -Articles 2, 4, 12 and 14- Material and territorial scope- Internet
search engines - Processing of data contained on websites - Searching for, indexing and
storage of such data-· Responsibility of the operator of the search engine~
Establishment on the territory of a Member State- Extent of that operator's obligations
and of the data subject's rights- Charter of Fundamental Rights of the European
Union- Articles 7 and 8)

In Case C131112,
REQUEST for a preliminary ruling under Article 267 TFEU from the Audiencia Nacional
(Spain), made by decision of27 February 2012, received at the Court on 9 March 2012, in
the proceedings
Google Spain SL,
Google Inc.

v
Agencia Espanola de Proteccion de Datos (AEPD),
Mario Costeja Gonzalez,

THE COURT (Grand Chamber),
composed of V. Skouris, President, K. Lenaerts, Vice-President, M. I!esic (Rapporteur),
L. Bay Larsen, T. von Danwitz, M. Safjan, Presidents of Chambers, J. Malenovsky,
E. Levits, A. 6 Caoimh, A. Arabadjiev, M. Berger, A. Prechal and E. JarasiUnas Judges,

Advocate General: N. JlHiskinen,
Registrar: M. Ferreira, Principal Administrator,
having regard to the written procedure and further to the hearing on 26 February 2013,
after considering the observations

submitt~d on behalf of:

Google Spain SL and Google Inc., by F. Gonzalez Dfaz, J. Bafio Fos and B. Holies,
abogados,
Mr Costeja Gonzalez, by J. Munoz Rodriguez, abogado,

:.;:,:
,;·.j

n
('::!
~!.~

I
-~J

<S

 r-"~~""=-:=-=«_.,~~'*~~~

~
~

Glj

~
~~

a

~

~~i

.~

.

~
d

II

~~

~
'
~

,:9

-

~

~
~
~

\?..

~
~

~

~*i

~~~

j2i manupatra@

~~(w

g~.!

l''

I

the Spanish Government, by A. Rubio Gonzalez, acting as Agent,
the Greek Government, by E.-M. Mamouna and K. Boskovits, acting as Agents,

~J\j

ii~1

the Italian Government, by G. Palmieri, acting as Agent, and P. Gentili, avvocato
dello Stato,

"''i

~

the Austrian Government, by G. Kunnert and C. Pesendorfer, acting as Agents,

l~j

the Polish Government, by B. Majczyna and M. Szpunar, acting as Agents,

~

the European Commission, by I. Martinez del Peral and B. Martenczuk, acting as
Agents,

il

~~jj
i:~~~
~>!.-,

i>:"

after hearing the Opinion of the Advocate General at the sitting on 25 June 2013,

(/

,'.•1

~

~~

gives the following
~·:;:

lli
m
®

Judgment

~;,

This request for a preliminary ruling concerns the interpretation of Article 2(b) and (d),
Article 4(l)(a) and (c), Article 12(b) and subparagraph (a) of the first paragraph of
Article 14 of Directive 95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data (OJ 1995 L 281, p. 31) and of Article 8 of the
Charter ofFundamental Rights of the European Union ('the Charter').

I
61.
~

~
~
~

I

~

'
IM

2

~

u
%
0
~

~m
~

The request has been made in proceedings between, on the one hand, Google Spain SL
('Google Spain') and Google Inc. and, on the other, the Agencia Espanola de Protecci6n de
Datos (Spanish Data Protection Agency; 'the AEPD') and Mr Costeja Gonzalez concerning
a decision by the AEPD upholding the complaint lodged by Mr Costeja Gonzalez against
those two companies and ordering Google Inc. to adopt the measures necessary to
withdraw personal data relating to Mr Costeja Gonzalez from its index and to prevent
access to the data in the future.

,,
". :\~

Legal context

:~~~

~!

;~

-~:..;)

t1
':'"1

:'j

European Union law
3

Directive 95/46 which, according to Article l, has the object of protecting the fundamental
rights and freedoms of natural persons, and in particular their right to privacy with respect
to the processing of personal data, and of removing obstacles to the free flow of such data,
states in recitals 2, 10, 18 to 20 and 25 in its preamble:
'(2)

-"·.'·~· :"~

·,·,

_-;~-~
;
cj
;_-<1

.,,
'I

~>!
:!.:~;!:
'rd

:.d

't;l
.:.;,

... data-processing systems are designed to serve man; ... they must, whatever the
nationality or residence of natural persons, respect their fundamental rights and

 r";!_".'J:'c::::;::~'%9':0:•:,~s".ii·~©N:i:'f~~~-m:~:::~0:c&-.:{>;:(:;¥:<;««"~20~illn0:~~:";~"0~{;;.:;;;;;~0:'&~il1;;_t~~J:;.~J:i~>:';:;-;:;;:;·:::,.gc<tc;;\::;-:;·;l:c~t<;~xcz.:,;;;;r;~;,;.s;~'!'60::~%!:";/~~

~I
'§i·

-

I

.

'"''"'"'

(

~~·

~

9;,

~

~

~

1m
i.~..

~~~

~1

w~

Jlf manupatra

'

~~

~~~
!(!1~

!!W
~~

freedoms, notably the right to privacy, and contribute to . . . the well-being of
individuals;

~!~r

"'a

(10)

~~1
~

~~~

~w

~~tl

... the object of the national laws on t~e processing of personal data is to protect
fundamental rights and freedoms, notably the right to privacy, which is recognised
both in Article 8 of the European Convention for the Protection of Human Rights and
Fundamental Freedoms [, signed in Rome on 4 November 1950,] and in the general
principles of Community law; ... for that reason, the approximation of those laws
must not result in any lessening of the protection they afford but must, on the
contrary, seek to ensure a high level of protection in the Community;

(18)

... in order to ensure that individuals are not deprived of the protection to which
they are entitled under this Directive, any processing of personal data in the
Community must be carried out in accordance with the law of one of the Member
States; . . . in this connection, processing carried out under the responsibility of a
controller who is established in a Member State should be governed by the law of
that State;

(19)

... establishment on the territory of a Member State implies the effective and real
exercise of activity through stable arrangements; . . . the legal form of such an
establishment, whether simply [a] branch or a subsidiary with a legal personality, is
not the determining factor in this respect; ... when a single controller is established
on the territory of several Member States, particularly by means of subsidiaries, he
must ensure, in order to avoid any circumvention of national rules, that each of the
establishments fulfils the obligations imposed by the national law applicable to its
activities;
·

(20)

... the fact that the processing of data is carried out by a person established in a
third country must not stand in the way of the protection of individuals provided for
in this Directive; ... in these cases, the processing should be governed by the law of
the Member State in which the means used are located, and there should be
guarantees to ensure that the rights and obligations provided for in this Directive are
respected in practice;

(25)

. . . the principles of protection must be reflected, on the one hand, in the
obligations imposed on persons ... responsible for processing, in particular regarding
data quality, technical security, notification to the supervisory authority, and the
circumstances under which processing can be carried out, and, on the other hand, in
the right conferred on individuals, the data on whom are the subject of processing, to
be informed that processing is taking place, to consult the data, to request corrections
and even to object to processing in certain circumstances'.

ij~~

!~n

J~j
(:"?

;:~~

f ~ .1

!1
~~~
~~2

"':J
N~
~'g

i:~
1~111

:~1
:~
'!l
-~~'i

/~;l

:,-::J

~;~

.: -~~:
,'i·
~ )'
.. ;~)
•:-\

fij

~l

:5:~:
·;iii

m

?t;

~~-:~;

\~r

)~~

1~.(1

f~~
,' ~~

~l
(;·.
j!i~

~,,

~f

~~1

~Hl..
~.-~

[,?,~

~
l~:P,

I~~~

~

~i~

~X

,;:,-,'

~~~

-::.''-{

~

:),

..

1t~ll
,,:;.

~··):

:_;::~

·'-''"

~~

~

~~

.

~~

}ill
}.,l
~f·l'
;,!h·l:

<B

~~ ~

~~

~~

-

;~·

:~:._
'; ~~

 .x=-'>"~v.&"

~

~~!~~~.::~-®;~~m~~~m~

s
~

b
-~
~
~

:~

~:

<

~

I

'~
>

ll.

b~

~

~

~

!c

~

f.=

~

r. ~

00

~

~~

~~
;.:

~l

~u

Jl{ manupatra ®

-~

~­
~

~~

~

r~.

~
~

r~

~

1
~

4

Article 2 of Directive 95/46 states that '[f]or the purposes of this Directive:

~~

;.~,

I~·

(a)

~~~

~

I

"personal data" shall mean any information relating to an identified or identifiable
natural person ("data subject"); an identifiable person is one who can be identified,
directly or indirectly, in particular by reference to an identification number or to one
or more factors specific to his physical, physiological, mental, economic, cultural or
social identity;

~

,=,

{~
(~

'.'"

',_
;.::
··-.:. ~

~

(b)

~

r·~

"processing of personal data" ("processing") shall mean any operation or set of
operations which is performed upon personal data, whether or not by automatic
means, such as collection, recording, organisation, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, blocking, erasure or destruction;

~

~

~

K

~~

~
~

@

:·:<

(d)
·: ~
'·-:~

::::

"controller" shall mean the natural or legal person, public authority, agency or any
other body which alone or jointly with others determines the purposes and means of
the processing of personal data; where the purposes and means of processing are
determined by national or Community laws or regulations, the controller or the
specific criteria for his nomination may be designated by national or Community
law;

~

~

;
«

~

I

I
00

~

~
5
.:1

'This Directive shall apply to the processing of personal data wholly or partly by automatic
means, and to the processing otherwise than by automatic means of personal data which
form part of a filing system or are intended to form part of a filing system.'

'•.j

:in

. ~ :~

<·
-~,

~

~

Article 3 of Directive 95/46, entitled 'Scope', states in paragraph I:

Article 4 of Directive 95/46, entitled 'National law applicable', provides:
'1.
Each Member State shall apply the national provisions it adopts pursuant to this
Directive to the processing of personal data where:
(a)

h

''l

the processing is carried out in the context of the activities of an establishment of the
controller on the territory of the Member State; when the same controller is
established on the territory of several Member States, he must take the necessary
measures to ensure that each of these establishments complies with the obligations
laid down by the national law applicable;

~~

~

~

~

~)

·~·

~h

w

~

~-~
~

~

~\

~

~

~

i
~

~

~

(·i·
[-: ~-

L·:,:
~--

(;

:-)-

;-:.·.

§:i-

~~-~;

:/-~

~~

~
~

~~~-

:(>

6

~
8

~

(b)

the controller is not established on the Member State's territory, but in a place where
its national law applies by virtue of international public law;

(c)

the controller is not established on Community territory and, for purposes of
processing personal data makes use of equipment, automated or otherwise, situated

.' :~~-

?'•

 ===:c.•....,,.,,..·,···;·.···"'.·.

,,,,,,;·?:··:•_cx·.:·:·:,:~:=x.jc<·liJ"J:«4!~~"~M0~~'~~;::;;:;;;:.:'"·:cc;e.:~::::~.:?.':~t.:.:;w;;t<:~l0Z~:Z:'Jo.'&.~~~'!ft:.~tiil~8\;:J;!,:•z;::;:~~::8{(.?.'2~~~~;~;Y::~r;g~'§;j;t;:g;;~~f,.:{jf!£&YJJ~)j~
~;~

%$

~8

.

.

~
~

I
<·

}'
,;~

~~
~

D
~

{

~~
.~i'~;:

o

,

-::-c"\

~

J2i manupatra '
~

~

I
~
1

%

8

~
~
~
~

~
~
~
~·

on the territory ~f the said Mem~er State, unless sue~ equipment is used only for
purposes of transtt through the tern tory of the Commumty.

~

~j

2.

In the circumstances referred to in paragraph l(c), the controller must designate a
rep~esentat.ive establish~d. i.n the ter~itory of that Mem~er State, without prejudice to legal
actiOns whtch could be mttlated agamst the controller himself.'

~
t~;j

~

7

~

~

~
1
~l~
~~~

IS

Member States shall provide that personal data must be:

(a)

processed fairly and lawfully;

(b)

collected for specified, explicit and legitimate purposes and not further processed in
a way incompatible with those purposes. Further processing of data for historical,
statistical or scientific purposes shall not be considered as incompatible provided that
Member States provide appropriate safeguards;

~

(c)

~11
~

(d)

~:

~
•I

~

~

m

~

~
~

~

i

f~

~

adequate, relevant and not excessive in relation to the purposes for which they are
collected and/or further processed;
accurate and, where necessary, kept up to date; every reasonable step must be taken
to ensure that data which are inaccurate or incomplete, having regard to the purposes
for which they were collected or for which they are further processed, are erased or
rectified·

'

')

~

worded as follows:

'I.

~~~

~

~)

Sectio~ I (entitled 'Principles relating to dall! quality') of Chapter II of birecti ve 95146,

In
Article 6

lr~

m

~

~;\
~

I

~;~

~~

lli

~~

~

g~

~v.

(e)
~

••
t~

kept in a form which permits identification of data subjects for no longer than is
necessary for the purposes for which the data were collected or for which they are
further processed. Member States shall lay down appropriate safeguards for personal
data stored for longer periods for historical, statistical or scientific use .

lj~

It shall be for the eontroller to ensure that paragraph I is complied with.'

~~

~

fu

I
J~

2.

8

4

II

In Section II (entitled 'Criteria for making data processing legitimate') of Chapter II of
Directive 95/46, Article 7 provides:
'Member States shall provide that personal data may be processed only if:

~

~

~~
)~

(f)

1
L
~

~
~

~

{
?

bM

~
·~

[!~

~
~

1

i

I
~
~

~
~

~

~0
~

t~~;

~

8~

i

~>

;;~:

5.i

~~

;~

~

~.~

X;(

9

processing is necessary for the purposes of the legitimate interests pursued by the
controller or by the third party or parties to whom the data are disclosed, except
where such interests are overridden by the interests [or] fundamental rights and
freedoms ofthe data subject which require protection under Article 1(1).'

Article 9 of Directive 95/46, entitled 'Processing of personal data and freedom of
expression', provides:

(L

 ti""""""~~-=''"""''"._"~-""'l:11!WJ2!ill:1@i<~:f:~! ))'i'tiiffif&f@!Ri';):U;~~£~

~Vl

11W
%~y.

~~

{5

;:.,;;•

;1~1

.:·.-'>!

J2i manupatra

,,.~

:m:!

'Member States shall provide for exemptions or derogations from the provisions of this
Chapter, Chapter IV and Chapter VI for the processing of personal data carried out solely
for journalistic purposes or the purpose of artistic or literary expression only if they are
necessary to reconcile the right to privacy with the rules governing freedom of expression.'

:~ ·::;·
···:.:."•

10

Article 12 ofDirective 95/46, entitled 'Rights of access', provides:
'Member States shall guarantee every data subject the right to obtain from the controller:

(b)

11

as appropriate the rectification, erasure or blocking of data the processing of which
does not comply with the provisions of this Directive, in particular because of the
incomplete or inaccurate nature ofthe data;

Article 14 of Directive 95/46, entitled 'The data subject's right to object', provides:
'Member States shall grant the data subject the right:
(a)

at least in the cases referred to in Atiicle 7(e) and (f), to object at any time on
compelling legitimate grounds relating to his particular situation to the processing of
data relating to him, save where otherwise provided by national legislation. Where
there is a justified objection, the processing instigated by the controller may no
longer involve those data;

:~

~

12

Article 28 of Directive 95/46, entitled 'Supervisory authority', is worded as follows:

~

w

~
~

%

m

~

'1.
Each Member State shall provide that one or mote public authorities are responsible
for monitoring the application within its territory of the provisions adopted by the Memqer
States pursuant to this Directive.

~

~

~

D
~

I
0

Iij
I~

~
~

I

~

~
ml
~
~

I
!il~

;.i
~

f

'1.··

~~~c!i
~

[7,)

3.

Each authority shall in particular be endowed with:
investigative powers, such as powers of access to data forming the subject-matter of
processing operations and powers to collect all the information necessary for the
performance of its supervisory duties,
effective powers of intervention, such as, for example, that . . . of ordering the
blocking, erasure or destruction of data, of imposing a temporary or definitive ban on
processing ...

<B

 ~·~5:>~9'.\-x.=~>?;Y:=:-X~·X~W«~~""M-©WL~X:W}?~·Rr~~m-~;~;:~~S~:~{{.~~~r~:~~:.::~:;~5'2::;;?.~i·2~~·~:~y~.;~~~~z;~f!.~?::~~;{":,:~~;~:~:::··:·~~~::~~~~·?:~2~~~ii'i£:b~-8:~~~-~-&~;:~~;~~-~-(~i.~:~;.,. ·;-~.

j

~

~

~

~

I

S::i

~t~~

.~'

"

1(':,

~

~-!3

J;~i.

1o

~r~:7

t~
1~

~;

\·:>

~~-~

~J.

¥-1

'N~

:-:~5:

JZi manupatra<E

;~j~

:~_-\i

~M'

~
[i~
~~j~,,

Decisions by the supervisory authority which give rise to complaints may be appealed
against through the courts.

;r,•

'('

~ ~.::_

:;·

:c· ~:
-~--

''."",

:,_:,.

4. Each supervisory authority shall hear claims lodged ·by any person, or by an
association representing that person, concerning the protection of his rights and freedoms
in regard to the processing of personal data. The person concerned shall be informed of the
outcome of the claim.

>2[_

(';)

~~~ ·:
··.-.j

'\.<.
{" ~

:~~

~

6. Each supervisory authority is competent, whatever the national law applicable to the
processing in question, to exercise, on the territory of its own Member State, the powers
conferred on it in accordance with paragraph 3. Each authority may be requested to
exercise its powers by an authority of another Member State.

~l
~;~

{)~il

~-:-·:

~

~

The supervisory authorities shall cooperate with one another to the extent necessary for the
performance of their duties, in particular by exchanging all useful information.

'k<"
~~\~

~:~
l',I~···.·

I
~·m

Spanish law

~

h~;
"'~!

p·.::.
J~i

13

~l
>··~
-~'{

:.~:~-

Directive 95/46 was transposed into Spanish Law by Organic Law No 15/1999 of
13 December 1999 on the protection of personal data (BOE No 298 of 14 December 1999,
p. 43088).

~!:1

~~l\;))

The dispute in the main proceedings and the questions referred for a preliminary
ruling

~~

~~1
~:~
~~I

}~;
o"

14

On 5 March 2010, Mr Costeja Gonzalez, a Spanish national resident in Spain, lodged with
the AEPD a complaint against La Vanguardia Ediciones SL, which publishes a daily
newspaper with a large circulation, in particular in Catalonia (Spain) ('La Vanguardia:'),
and against Google Spain and Google Inc. The complaint was based on the fact that, when
an internet user entered Mr Costeja Gonzalez's name in the search engine of the Google
group ('Google Search'), he would obtain links to two pages of La Vanguardia's
newspaper, of 19 January and 9 March 1998 respectively, on which an announcement
mentioning Mr Costeja Gonzalez's name appeared for a real-estate auction connected with
attachment proceedings for the recovery of social security debts.

15

By that complaint, Mr Costeja Gonzalez requested, first, that La Vanguardia be required
either to remove or alter those pages so that the personal data relating to him no longer
appeared or to use certain tools made available by search engines in order to protect the
data. Second, he requested that Google Spain or Google Inc. be required to remove or
conceal the personal data relating to him so that they ceased to be included in the search
results and no longer appeared in the links to La Vanguardia. Mr Costeja Gonzalez stated in
this context that the attachment proceedings concerning him had been fully resolved for a
number of years and that reference to them was now entirely irrelevant.

s0
~~
~~

tl

t\

·H~:

li~

V!l

~{~

~;.:~

;;~
._:.,:\

~

~~~:~!

~11

I
~j

I
,.,\.

I

--·y.~.

 .~x~:~:;:;:<«;:::~..::~~::~~K:=:::::;:::::=::::::::::::.::}-;:~;;:~~::.*-w~~5.~:;::;::._~;i=.~=~~=::~;:::::;::~:~:::::::=:=;;::::::::~::=::: ==:;.::.:== -- · ~-:=:·;::::·:::~::~· .::~:~~:.: '-~·:·~-~--'

--== =-=- ;-;~;;.Rat:=;:,_;i:~:;;:~"=-:.:-::...:..:._:_

-:-~-

_·_:_ ~--~~-~:··.·

_\6)

£~~
'.r...-1

m

-~1

~'S
l);i

~~

i~;

~W'·

~~§]~}

~)~

~~::

1-!

~~~~

xs,

}~~

~l

~·~

~~t!

·~~~
~'\/~

I

JZi manupatra

~~*
~~~~

~"~~J
~~;
il~~~
{~{\~

~;,~1

~\~~

lX~I

\(·~·-\

~~

I

16

By decision of 30 July 2010, the AEPD rejected the complaint in so far as it related to La
Vanguardia, taking the view that the publication by it of the information in question was
legally justified as it took place upon order of the Ministry of Labour and Social Affairs
and was intended to give maximum publicity to the auction in order to secure as many
bidders as possible.

17

On the other hand, the complaint was upheld in so far as it was directed against Google
Spain and Google Inc. The AEPD considered in this regard that operators of search engines
are subject to data protection legislation given that they carry out data processing for which
they are responsible and act as intermediaries in the information society. The AEPD took
the view that it has the power to require the withdrawal of data and the prohibition of
access to certain data by the operators of search engines when it considers that the locating
and dissemination of the data are liable to compromise the fundamental right to data
protection and the dignity of persons in the broad sense, and this would also encompass the
mere wish of the person concerned that such data not be known to third parties, The AEPD
considered that that obligation may be owed directly by operators of search engines,
without it being necessary to erase the data or information from the website where they
appear, including when retention of the information on that site is justified by a statutory
provision.

18

Google Spain and Google Inc. brought separate actions against that decision before the
Audiencia Nacional (National High Court). The Audiencia Nacional joined the actions.

19

That court states in the order for reference that the actions raise the question of what
obligations are owed by operators of search engines to protect personal data of persons
concerned who do not wish that certain information, which is published on third parties'
websites and contains personal data relating to them that enable that information to be
linked to them, be located, indexed and made available to internet users indefinitely. The
answer to that question depends on the way in which Directive 95/46 must be interpreted in
the context of these technologies, which appeared after the directive's publication.

20

In those circumstances, the Audiencia Nacional decided to stay the proceedings and to
refer the following questions to the Court for a preliminary ruling:

~~:~

f.:~l1

lf~

l;\~

~t~~
~~i~l

:_{~11

··f\
,\)~

I
~~

r~J1

~~~

·~~
·5·;~

ll~:~~~

!:l:
···:~

;:~

l~~l
:~~3

:~?t

-~:~ti

~~ ~1
--~---!

~;~

:~.1)
''!~-

-}~

:T~

I
g}i

~~
-~

~q.
X;~

1.

With regard to the territorial application of Directive [95/46] and, consequently, of
the Spanish data protection legislation:
(a)

must it be considered that an "establishment", within the meaning of
Article 4(1)(a) of Directive 95/46, exists when any one or more of the
following circumstances arise: ·

:)::j
\f,:·;

when the undertaking providing the search engine sets up in a Member
State an office or subsidiary for the purpose of promoting and selling
advertising space on the search engine, which orientates its activity
towards the inhabitants of that State,

~

~t~

~~

t~

~::;::

);}

:-:~;

:f;;

;!,1!

:"(1

!tJ

m~

·tJ!"tl

1~11
~~I
~!:il
t~'~

1 ~.'1
N1
lf~
(~~~

p'l~

~-~~

or

<&

 f"'"'~~~~-"""-~""'""""""""""~IW~$,';<J;:l!Z-tilk~~

d$
J~
~

~

"1.~

,,

•7r-

I'

~~
~
~*

~

;®

I

~ manupatra ®

~:j\~

:~
~~

~hrj

I
~\"
g~

~

:~~~~
\)/l

when the parent company designates a subsidiary located in that Member
State as its representative and controller for two specific filing systems
which relate to the data of customers who have contracted for advertising
with that undertaking,

~~0
~~

~P.~~

~~(

t:!

'"'1

;r~d~

~

).~~

~,--:;

;;~::.:

~2~
~··

·:-:-

[/

or
when the office or subsidiary established in a Member State forwards to
the parent company, located outside the European Union, requests and
requirements addressed to it both by data subjects and by the authorities
with responsibility for ensuring observation of the right to data
protection, even where such collaboration is engaged in voluntarily?

~n·:~

!

(b)

1

t~'

ilii1'!.
It'
~

~li

;~:

i").(:t'

*~

or

~&~
')..·,

when it uses a domain name pertaining to a Member State and arranges
for searches and the results thereof to be based on the language of that
Member State?

m

l~

g!j

~~1

(c)

Is it possible to regard as a use of equipment, in the terms of Article 4(1)(c) of
Directive 95/46, the temporary storage of the information indexed by internet
search engines? If the answer to that question is affirmative, can it be
considered that that connecting factor is present when the undertaking refuses
to disclose the place where it stores those indexes, invoking reasons of
competition?

(d)

Regardless of the answers to the foregoing questions and particularly in the
event that the Court ... considers that the connecting factors referred to in
Article 4 of [Directive 95/46] are not present:

'.~ 1.·

~i
~{

~
<

1
,,.

~
m

f~

']I

~;i

{~
f~~~

must Directive 95/46 ... be applied, in the light of Article 8 of the [Charter], in
the Member State where the centre of gravity of the conflict is located and
more effective protection of the rights of ... Union citizens is possible?

~~.~

~

2.

As regards the activity of search engines as providers of content in relation to
Directive 95/46 ... :

·~r ~,1

·~;f

i;H

t1~

:~· ~~

··:::

',,.,

~·<:!!

t:·.

t:·.-

·~ -.'

when a search engine uses crawlers or robots to locate and index
information contained in web pages located on servers in that Member
State,

~-

~~·~il

;-.-.

Must Article 4(1 )(c) of Directive 95/46 be interpreted as meaning that there is
"use of equipment ... situated on the territory of the said Member State":

~j~

·.?~~

."(

.~:::

iW

t:~
;~~

!••

:·, ~

(a)

in relation to the activity of [Google Search], as a provider of content,
consisting in locating information published or included on the net by thir9
parties, indexing it automatically, storing it temporarily and finally making it
available to internet users according to a particular order of preference, 1when

 ~;'-"'·c<\"11Y.C"i?10~"'$'»?'lY'f~:V.'S!%f!0"i~!&.~'Z!lsi1¥.Y;w;&;.::::;:~~~KW'::'>!~i&~~,~~~~~l$:ib.~1:i'cW

::

!1

,.

~~-~

~},--.
~Q

~
~%
~

~·<~

9]

~r··

~

f!O!

U·

~~

,'~

;.'~·
-;~

~~

;1:3

'.;j

\~

;;.:;;

~;f;

;&

""''~

f~

·i~~

JZi manupatra

~\~

)t~3~

*
~~l
it~

that information contains personal data ofthird parties: must an activity like the
one described be interpreted as falling within the concept of "processing of ...
data" used in Article 2(b) of Directive 95/46?

I

I~

If the answer to the foregoing question is affirmative, and once again in
relation to an activity like the one de~cribed:

~l;ii

t~

~'*

~§~

(c)

In the event that the answer to the foregoing question is affirmative:

::::J

;:~
;~

~K~

jj'l

,,I.'

(d)

l'{:.:l

~~~4
../}

h

f:1

i:N,
;';-~·

~

3.

~

~~:

~

~

In the event that the answer to the foregoing question is affirmative:

Regarding the scope of the right of erasure and/or the right to object, in relation to the
"derecho al olvido" (the "right to be forgotten"), the following question is asked:
rnust it be considered that the rights to erasure and blocking of data, provided for in
Article 12(b), and the right to object, provided for by [subparagraph (a) of the first
paragraph of Article 14] of Directive 95/46, extend to enabling the data subject to
address himself to search engines in order to prevent indexing of the information
relating to him personally, published on third parties' web pages, invoking his wish
that such information should not be known to internet users when he considers that it
might be prejudicial to him or he. wishes it to be consigned to oblivion, even though
the information in question has been lawfully published by third parties?'

~

I

I
~
~
~

~

0

)\"

~
~

Consideration of the questions referred

~~~i

:1~

Question 2(a) and (b), concerning the material scope of Directive 95146

:;:-:.j

\ i'~

.. ,-.,.,
~·\,

:~;1
S;·1

I~~
~

I
~~

8~~-5

!11

~;s~,

2.~;~

ib;;

•:.'r•

-~-:Y

~~~
~5~

~~

~;~>

would the obligation of search engines to protect those rights be excluded when
the information that contains the personal data has been lawfully published by
third parties and is kept on the web page from which it originates?

'_{j.j1

ti~~

G-"

C~.'O

may the [AEPD], protecting the rights embodied in [Article] 12(b) and
[subparagraph (a) of the first paragraph of Article 14] of Directive 95/46,
directly impose on [Google Search] a requirement that it withdraw from. its
indexes an item of information published by third parties, without addressing
itself in advance or simultaneously to the owner of the web page on which that
information is located?

~tj;j

lt;;l

ft

'/c'

'~

'•''\L

2~:

~-" ~
.,._.,"_

must Article 2(d) of Directive 95/46 be interpreted as meaning that the
undertaking managing [Google Search] is to be regarded as the "controller" of
the personal data contained in the web pages that it indexes?

%1j

~

'i;'Y

;(~~

(b)

:1~
@l

w~

~~
):~:-)

10·

:--\1

®

21

By Question 2(a) and (b), which it is appropriate to examine first, the referring comt asks,
in essence, whether Article 2(b) of Directive 95/46 is to be interpreted as meaning that the
activity of a search engine as a provider of content which consists in finding information
published or placed on the internet by third parties, indexing it automatically, storing it
temporarily and, finally, making it available to internet users according to a particular .order
I

-,~ _;

,'--~-:

;:·

,.·

 @@.

~1~

J21 manupatra
of preference must be classified as 'processing of personal data' within the meaning of that
provision when that information contains personal data. Ifthe answer is in the affirmative,
the referring court seeks to ascertain furthermore whether Article 2(d) of Directive 95/46 is
to be interpreted as meaning that the operator of a search engine must be regarded as the
'controller' in respect of that processing of the personal data, within the meaning of that
provision.
22

According to Google Spain and Google Inc., the activity of search engines cannot be
regarded as processing of the data which appear on third parties' web pages displayed in
the list of search results, given that search engines process all the information available on
the internet without effecting a selection between personal data and other information.
Furthermore, even if that activity must be classified as 'data processing', the operator of a
search engine cannot be regarded as a 'controller' in respect of that processing since it has
no knowledge of those data and does not exercise control over the data.

23

On the other hand, Mr Costeja Gonzalez, the Spanish, Italian, Austrian and Polish
Governments and the European Commission consider that that activity quite clearly
involves 'data processing' within the meaning of Directive 95/46, which is distinct from
the data processing by the publishers of websites and pursues different objectives from
such processing. The operator of a search engine is the 'controller' in respect of the data
processing carried out by it since it is the operator that determines the purposes and means
of that processing.

24

In the Greek Government's submission, the activity in question constitutes such
'processing', but inasmuch as search engines serve merely as intermediaries, the
undertakings which operate them cannot be regarded as 'controllers', except wlwre they
store data in an 'intermediate memory' or 'cache memory' for a period which exceeds that
which is technically necessary.

25

Article 2(b) of Directive 95/46 defines 'processing of personal data' as 'any operation or
set of operations which is performed upon personal data, whether or not by automatic
means, such as collection, recording, organisation, storage, adaptation or alteratiQn,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure or destruction'.

26

As regards in particular the internet, the Court has already had occasion to state that the
operation of loading personal data on an internet page must be considered to be such
'processing' within the meaning of Article 2(b) of Directive 95/46 (see Case
C101/01 Lindqvist EU :C:2003 :596, paragraph 25).

27

So far as concerns the activity at issue in the main proceedings, it is not contested that the
data found, indexed and stored by search engines and made available to their users include
information relating to identified or identifiable natural persons and thus 'personal data'
within the meaning of Article 2(a) of that directive.

28

Therefore, it must be found that, in exploring the internet automatically, constantly and
systematically in search of the information which is published there, the operator of a

·.:,,

;il

r~
l(\!1
}I:J

;:<Jl
!t·~·j

~~~

~lf
?l

~
~

~

lli

I

I
~
~

~
~~JI
~

~

~
~
~R

®

 ~ro;;,;;·,; .•..,,.:··~j>"·}·.;g.•..~·=·:•:!'ci~"'l·"S''~:,;.:c:o;=M2Ylii:/5§!?H&~~§J;l},.,~i«~~~:=~:~;'::?J:t:t:::')l,:;?:~···??~~~?:::i:~.;;~:~i~~;xm~lifE?I:f;xl!'si:n;:~~~~J&r~;;;;rg~1!lm<~:~r{:~3:~z:;sz1i:;

(.

.

I

~~

~

m~
:~~

Q

I
~

~

'

1. c;

~ti~~:
~,,

:~
~

• fj/

l~il

z

~~
·:•:'~

·~.~

!jjl

~

,

:gfl
. ~.
•~~

~
lI

manupatra ® ~~
~~.
"'

~~

search engine 'collects' such data which it subsequently 'retrieves', 'records' and
.
d
'organises' within the framework of its indexing programm'es, 'stores' on its servers an , as
the case may be, 'discloses' and 'makes available' to its users in the form of lists of search
results. As those operations are referred to expressly and unconditionally in Article 2(b) of
Directive 95/46, they must be classified as 'processing' within the meaning of that
provision, regardless of the fact that the operator of the search engine also carries out the
same operations in respect of other types of information and does not distinguish between
the latter and the personal data.

~

: ?:l\

~

~~

~~
~
~

~

~

~

\~

~

~
~
~

~
N

~!

~~

29

l~

~

~

~~
~l

30

~l

\:~
~

~l
~.~
1
::~~

~

:~
U)

31

~

~

Nor is the foregoing finding affected by the fact that those data have already been
published on the internet and are not altered by the search engine.
.

The Court has already held that the operations referred to in Article 2(b) of Directive
95/46 must also be classified as such processing where they exclusively concern material
that has already been published in unaltered form in the media. It has indeed observed in
that regard that a general derogation from the application of Directive 95/46 in such a case
would largely deprive the directive of its effect (see, to this effect, Case
C73/07 Satakunnan M~rkkinaporssi and Satamedia EU:C:2008:727, paragraphs 48 and
49) .
.

Furthermore, it follows from the definition contained in Article 2(b) of Directive 95/46
that, whilst the alteration of personal data indeed constitutes processing within the meaning
of the directive, the other operations which are mentioned there do not, on the other hand,
in any way require that the personal data be altered.

~

~~
~~

~~
~~

i

33

~
~1

~lJ

I

t!J

34

ta

~
~~

~·

ij
~~

~~

0~
...

.~ ~

l{:~
r:~

;1~

<v•1

II
~~
·I

,.

~(-..;

:1•. ,.:

~

0
~

8l

~l

~1

t
R.'

.~

I~;
~

~

~.

t~
~·

~
0

32

~l

.

~

~

~

l~~

I

~

35

As to the question whether the operator of a search engine must be regarded as the
'controller' in respect of the processing of personal data that is carried out by that engine in
the context of an activity such as that at issue in the main proceedings, it should be recalled
that .Article 2~d) of Directive .95/46 defines ·~ontroller' as. '~he nat~ral or legal per~on,
public authonty, agency or any other body wh1ch alone or JOintly With others determmes
the purposes and means of the processing of personal data:'.
It is the searchengine.operator which determi~e~ the purp.oses and.m~ans o~that activity.·
and thu~ ?f the proc~ssmg of personal data that 1t Itself carnes out w1thm t?e framework of
that activity and which must, consequently, be regarded as the 'controller' m respect of that
processing pursuant to Article 2( d).
Furthermore, it would be contrary not only to the clear wording of that provision but also
to its objective - which is to ensure, through a broad definition of the concept of
'controller'' effective and complete protection of data subjects - to exclude the operator
of a search engine from that definition on the ground that it does not exercise control over
the personal data published on the web pages of third parties.
In this connection, it should be pointed out that the processing of personal data carried out
in the context of the activity of a search engine can be distinguished from and is additional
to that carried out by publishers of websites, consisting in loading those data ,on an internet
p~e

.

f~

~~

~1
~.'.·~

~t~
%'~

~
~~

~~
~~2

~9i

~

~~
l~!;

m~

~~\;

~~j

m

~i1

~;:;

~

~

 fiif:.;;..

''<tl>"·

~

JZi manupatra
36

Moreover, it is undisputed that that activity of search engines plays a decisive role in the
overall dissemination of those data in that it renders the latter accessible to any internet
user making a search on the basis of the data subject's name, including to internet users
who otherwise would not have found the web page on which those data are published.

37

Also, the organisation and aggregation of information published on the internet that are
effected by search engines with the aim of facilitating their users' access to that
information may, when users carry out their search on the basis of an individual's name,
result in them obtaining through the list of results a structured overview of the information
relating to that individual that can be found on the internet enabling them to establish a
more or less detailed profile of the data subject.

38

Inasmuch as the activity of a search engine is therefore liable to affect significantly, and
additionally compared with that of the publishers of websites, the fundamental rights to
privacy and to the protection of personal data, the operator of the search engine as the
person determining the purposes and means of that activity must ensure, within the
framework of its responsibilities, powers and capabilities, that the activity meets the
requirements of Directive 95/46 in order that the guarantees laid down by the directive may
have full effect and that effective and complete protection of data subjects, in particular of
their right to privacy, may actually be achieved.

39

Finally, the fact that publishers of websites have the option of indicating to operators of
search engines, by means in particular of exclusion protocols such as 'robot.txt' or codes
such as 'noindex' or 'noarchive', that they wish specific information published on their site
to be wholly or partially excluded from the search engines' automatic indexes does not
mean that, if publishers of websites do not so indicate, the operator of a search engine is
released from its responsibility for the processing of personal data that it carries out in the
context ofthe engine's activity.

40

That fact does not alter the position that the purposes and means of that processing are
determined by the operator of the search engine. Furthermore, even if that option for
publishers of websites were to mean that they determine the means of that processing
jointly with that operator, this finding would not remove any of the latter's responsibility as
Article 2(d) of Directive 95/46 expressly provides that that determination may be made
'alone or jointly with others'.

41

It follows from all the foregoing considerations that the answer to Question 2(a) and (b) is
that Article 2(b) and (d) of Directive 95/46 are to be interpreted as meaning that, first, the
activity of a search engine consisting in finding information published or placed on the
internet by third parties, indexing it automatically, storing it temporarily and, finally,
making it available to internet users according to a particular order of preference must be
classified as 'processing of personal data' within the meaning of Article 2(b) when that
information contains personal data and, second, the operator of the search engine must be
regarded as the 'controller' in respect of that processing, within the meaning of
Article 2(d).

;:~.i

~.-;!

~

)i\

~

8
·~

m

~
ffl

m

8
~

~

0

N

~0

0

~

~:~

·~

~
~

~~
~

•~
~

~

1W

~

~

w
l')j

~

~

0

~

I
0

@
~
I
=
~

w
f
w·

r;pl.
~

~·
~
~

1~
~

Question I (a) to (d), concerning the territorial scope of Directive 95146

®

 ii;~:o;§~O:@;;cg;i',;;"ffi{:Z'-?~«;;;~...;;z~~z.x:&:;;'i%~~~;~,;:;:~~zw~~>:f:::>-::~~;~;~;:::~?:'!:;:-:,i.{::(lj;:ill;~~,;l:;~~;s;,:&~~5;;~~;z::,;:?:{0~t::r?;;~~·-~~~·&:; .';,.;._:;,;_;~... ;~,:,,.,

h~l
~-~
lt~

\?:--1
en
>dl

I
~~

({/;{f}x

1-r

?!@f!

'!&:

~~

'~·l
~ .

I

JZi manupatra@

r~~.·

l
i"'!"

~..

(~?,·
: ~~:.

{?

ill!:

~~

>g;

h'i

'

42

By Question 1(a) to (d), the referring court seeks to establish whether it is possible to
apply the national legislation transposing Directive 95/46 i'n circumstances such as those at
issue in the main proceedings.

43

In this respect, the referring court has established the following facts:

~
~

i~·

Google Search is offered worldwide through the website 'www.google.com'. In
numerous States, a local version adapted to the national language exists. The version
of Google Search in Spanish is offered through the website 'www.google.es', which
has been registered since 16 September 2003. Google Search is one of the most used
search engines in Spain.

I

Google Search is operated by Google Inc., which is the parent company of the
Google Group and has its seat in the United States.

,~,
,

~~··~-

Google Search indexes websites throughout the world, including websites located in
Spain. The information indexed by its 'web crawlers' or robots, that is to say,
computer programmes used to locate and sweep up the content of web pages
methodically and automatically, is stored temporarily on servers whose State of
location is unknown, that being kept secret for reasons of competition.

X,

~

~~

%~

li~

;~~.~~

~~

Google Search does not merely give access to content hosted on the indexed
websites, but takes advantage of that activity and includes, in return for payment,
advertising associated with the internet users' search terms, for undertakings which
wish to use that tool in order to offer their goods or services to the internet users.

~:~ '

i1,

f)fj

~~~
~'21

~?,;]
:~~

The Google group has recourse to its subsidiary Google Spain for promoting the sale
of advertising space generated on the website 'www.google.com'. Google Spain,
which was established on 3 September 2003 and possesses separate legal personality,
has its seat in Madrid (Spain). Its activities are targeted essentially at undertakings
based in Spain, acting as a commercial agent for the Google group in that Member
State. Its objects are to promote, facilitate and effect the sale of on-line advertising
products and services to third parties and the marketing of that advertising.

'!•,~

~ii~

{1~~
~~

/·~j
;~.;~

~~
~9\

0;j

g.:-.l

~
1~

Google Inc. designated Google Spain as the controller, in Spain, in respect of two
filing systems registered by Google Inc. with the AEPD; those filing systems were
intended to contain the personal data of the customers who had concluded contracts
for advertising services with Google Inc.

tti~

:~H

44

~-11·:
~:?1

fiil

~(11
~::~

Specifically, the main issues raised by the referring court concern the notion of
'establishment', within the meaning of Article 4(l)(a) of Directive 95/46, and of 'use of
equipment situated on the territory Qf the said Member State', within the meaning of
Article 4(1)(c).

~x~

\;11

Question l(a)

~'!J
t:ll
:li)
~·:;-:;

:;:,:ji

:rti
\).

~

rr;l

}~1

'f~O'·'
!;ll

}il~

<~~~.

'· ~!§~

;;~l
);.N

-,'/
:---~~

;>
~~')

·::.··

~..

m

;.-·

·'i,

~~\1

~~

.· -~:

45

By Question l(a), the referring court asks, in essence, whether Article 4(l)(a) of Directive
95/46 is to be interpreted as meaning that processing of personal data is carried out in the

~;.,~.:

 ~

I~
~~

t~

:;:.::!

..

I

~

:H

I
~~~

~(

~

i:}J

I

,JZi manupatra ®

·N
~r"~

gt
,o;~)

context of the activities of an establishment of the controller on the territory of a Member
State, within the meaning of that provision, when one or more of the following three
conditions are met:

~l,l't

~~....'t
·~

~

the operator of a search engine sets up in a Member State a branch or subsidiary
which is intended to promote and sell advertising space offered by that engine and
which orientates its activity towards the inhabitants of that Member State, or

't{l

~i1
£~

~1
:~;~~

~;,

~~~~·cHI

the parent company designates a subsidiary located in that Member State as its
representative and controller for two specific filing systems which relate to the data
of customers who have contracted for advertising with that undertaking, or

\]~

''i
:(\\

';~;

the branch or subsidiary established in a Member State forwards to the parent
company, located outside the European Union, requests and requirements addressed
to it both by data subjects and by the authorities with responsibility for ensuring
observation of the right to protection of personal data, even where such collaboration
is engaged in voluntarily.

\\'.

R~

~

•::!

:(:~ 1

::~i
. ~'

46

So far as concerns the first of those three conditions, the referring court states that Google
Search is operated and managed by Google Inc. and that it has not been established that
Google Spain carries out in Spain an activity directly linked to the indexing or storage of
information or data contained on third parties' websites. Nevertheless, according to the
referring comt, the promotion and sale of advertising space, which Google Spain attends to
in respect of Spain, constitutes the bulk of the Google group's commercial activity and may
be regarded as closely linked to Google Search.

47

Mr Costeja Gonzalez, the Spanish, Italian, Austrian and Polish Governments and the
Commission submit that, in the light of the inextricable link between the activity of the
search engine operated by Google Inc. and the activity of Google Spain, the latter must be
regarded as an establishment of the former and the processing of personal data is carried
out in context of the activities of that establishment. On the other hand, according to
Google Spain, Google Inc. and the Greek Government, Article 4(1)(a) of Directive 95/46 is
not applicable in the case of the first of the three conditions· listed by the referring court. ·

48

In this regard, it is to be noted first of all that recital 19 in the preamble to Directive 95/46
states that 'establishment on the territory of a Member State implies the effective and real
exercise of activity through stable arrangements' and that 'the legal form of such an
establishment, whether simply [a] branch or a subsidiary with a legal personality, is not the
determining factor'.

49

It is not disputed that Google Spain engages in the effective and real exercise of activity

'

:··:<

~:~
~~~

!fj:;1

i
~~I

kfi
·f<~

~·w~

!tl~.~
'1~

rm

~8~

~~~

!}il
'1",\")

I
~
~

through stable arrangements in Spain. As it moreover has separate legal personality, it
constitutes a subsidiary of Google Inc. on Spanish territory and, therefore, an
'establishment' within the meaning of Article 4(1 )(a) of Directive 95/46.

~~-~
~-"

~.t'
~

~~
~j~

~(l'

~

-~.~~

itt~

:~~~

:)1',1

~~
$Jh

:~1
t~

~~

50

In order to satisfy the criterion laid down in that provision, it is also necessary that the
processing of personal data by the controller be 'carried out in the context of the activities'
of an establishment of the controller on the territory of a Member State.

[~~
;:_:.:

 .~~~~·?»-s"S"~~:~;;;~~::z~22~~;-x-»X«v-z;;:~~s?:&1m:or::?:;r~({f.1X~.r:Zr~~~~;~~~i~~::~~f:{:~~;~~::;~~~l~~~~~~~~;r~x0~~~;~~~£JJ0~~~};;J~~

m

.~
.,v

'I

·~·~

I~

1

~

~j

'

~

~

,21 manupatra <E i
~
~

Ir~

51

~

I
~

~

52

I)

~

~~B

[~~

53

~~j
~~
~~
Ji:t~ l

~1

ml
~Hl

54

~-j~

I('~(\
ill
;}~~;

~~.~

·•B··

M

Google Spain and Google Inc. dispute that this is the case since the processing of personal
data at issue in the main proceedings is carried out exclusively by Google Inc., which
operates Google Search without any intervention on the part of Google Spain; the latter's
activity is limited to providing support to the Google group's advertising activity which is
separate from its search engine service.

Neve~eless,

as the Spanish Government and the Commission in particular have pointed
out, Article 4(l)(a) of Directive 95/46 does not reqUire the processmg of personal data m
ques~ion to be carried out 'b(.t~e establishmen: concerned itself, but only that it be carried
out 'm the context of the actlVltles' of the establishment.

Further111ore, in the light of the objective of Directive 95/46 of ensuring effective and
complete protection of the fundamental rights and freedoms of natural persons, and in
particular their right to privacy, with respect to the processing of personal data, those words
cannot be interpreted restrictively (see, by analogy, Case C324/09 L'Oreal and
Others EU:C:2011 :474, paragraphs 62 and 63).
It is to be noted in this context that it is clear in particular fl·om recitals 18 to 20 in the
preamble to Directive 95/46 and Article 4 thereof that the European Union legislature
sought to prevent individuals from being deprived of the protection guaranteed by the
directive and that protection from being circumvented, by prescribing a particularly broad
territorial scope.

;;I~

·.~;i?i

~;~

55

In the light of that objective of Directive 95/46 and of the wording of Article 4(1 )(a), it
must be held that the processing of personal data for the purposes of the service of a search
engine such as Google Search, which is operated by an undertaking that has its seat in a
third State but has an establishment in a Member State, is carried out 'in the context of the
activities' of that establishment if the latter is intended to promote and sell, in that Member
State, advertising space offered by the search engine which serves to make the service
offered by that engine profitable.

56

In such circumstances, the activities of the operator of the search engine and those of its
establishment situated in the Member State concerned are inextricably linked since the
activities relating to the advertising space constitute the means of rendering the search
engine at issue economically profitable and that engine is, at the same time, the means
enabling those activities to be performed.

57

As has been stated in paragraphs 26 to 28 of the present judgment, the very display of
personal data on a search results page constitutes processing of such data. Since that
display of results is accompanied, on the same page, by the display of advertising linked to
the search terms, it is clear that the processing of personal data in question is carried out in
the context of the commercial and advertising activity of the controller's establishment on
the territory of a Member State, in this instance Spanish territory.

58

That being so, it cannot be accepted that the processing of personal data carried out for the
purposes of the operation ofthe search engine should escape the obligations and guarantees
laid down by Directive 95/46, which would compromise the directive's effectiveness and

5~!

hi'":.l

I
~j1

~~
m
.'
~
.;;)l
¥o{~

~f~
~~·~

r:?

~~
f:i.,.

f.*~
t~·

~~x

~

f~

I
·:i

_:;, ~~1

~iJ'

:\~i

\·.1·
•'•I

~~:i,,.···!
;:·;.1
~·\

.:·-·1
,.:v;
~

:.··:
i/:

~

tf~

::,~;
?~~

~.~.·.~.i

:@

~

~1

~~
~~~~

l~ ~
,__,-

G?
i~;~:

,-..,.

~~;~
(:·;·.

 . __ Jf the fundamental rights and freedoms of natural
: to ensure (see, by analogy, L'Oreal and
v•"c.'., Lu ·'-'·"'v . . . "T, "T' l-''ua0 1al-'1"' v ... and 63), in particular their right to privacy, with
respect to the processing of personal data, a right to which the directive accords special
importance as is confirmed in particular by Article 1(1) thereof and recitals 2 and 10 in its
preamble (see, to this effect, Joined Cases C465/00, C138/01 and
Cl39/01 Osterreichischer Rundfunk and Others EU:C:2003:294, paragraph 70; Case
C553/07 RijkeboerEU:C:2009:293, paragraph 47; and Case C473/12 JPJEU:C:2013:715,
paragraph 28 and the case-law cited).

·:.<:t
::~?

~~~
~~}

~:!:
_·· ~:~:

~~
6~.

h~":
ur.

~-<\"

~~;:}
'···~::~-

59

Since the first of the three conditions listed by the referring court suffices by itself for it to
be concluded that an establishment such as Google Spain satisfies the criterion laid down
in Article 4(1 )(a) of Directive 95/46, it is unnecessary to examine the other two conditions.

I
k~·;_·-

60

It follows from the foregoing that the answer to Question l(a) is that Article 4(1)(a) of
Directive 95/46 is to be interpreted as meaning that processing of personal data is carried
out in the context of the activities of an establishment of the controller on the territory of a
Member State, within the meaning of that provision, when the operator of a search engine
sets. up in a Member State a branch or subsidiary which is intended to promote and sell
advertising space offered by that engine and which orientates its activity towards the
inhabitants of that Member State.
Question 1(b) to (d)

61
....

In view of the answer given to Question 1(a), there is no need to answer Question 1(b) to

~
:.::'~'~

~~;·
:(x~~

~~:;
~~§

~5-;\

~H
!i~
£~i~.:

~'~·

t:~--

~-?

(d) .

_,._

;. ~-:,.

·.-:;·.·\,

Question 2(c) and (d), concerning the extent of the responsibility of the operator of a
search engine under Directive 95/46

;H....
.·

;

:;;]
·.,)
-~~--;

62

By Question 2(c) and (d), the referring court asks, in essence, whether Article 12(b) and
subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted
as meaning that, in order to comply with the rights laid down in those provisions, the
operator of a search engine is obliged to remove from the list of results displayed following
a search made on the basis of a person's name links to web pages, published by third
parties and containing information relating to that person, also in a case where that name or
information is not erased beforehand or simultaneously from those web pages, and even, as
the case may be, when its publication in itself on those pages is lawful.

63

Google Spain and Google Inc. submit that, by virtue of the principle of proportionality,
any request seeking the removal of information must be addressed to the publisher of the
website concerned because it is he who takes the responsibility for making the information
public, who is in a position to appraise the lawfulness of that publication and who has
available to him the most effective and least restrictive means of making the information
inaccessible. Furthermore, to require the operator of a search engine to withdraw
information published on the internet from its indexes would take insufficient account of

·.·-·,
{';

<:1;~

~-;;·,~

t;]
•"'.1.

~~~~

"''
·~\

i,~
~jj
:\i
IJ,

~
'"1~
~'k~

~\o~
l!1'

k~~

~~

~

l.f\~1~
0~

l~

ii'tj
t1~

;. ~

~~

~~..:~='

~~j

 ..

f;W·.~r~.c,;,;.-~w""~\ll.'lO: ~~::;~));w).':.'~~":::;;;;~""~c:::,::;:;w~~;;:;.::x~~:S;r,._~~~"t~~~;::~~m:-~~::;WJf~~~8::~2®

~

~

I

I

I

$1

~

•

,2i
manupatra
~

t~"~

•I

I

?.\n

the fundamental rights of publishers of websites, of other internet users and of that operator
•
If
1tse .

K~~~:l
;~~.J
~

l}~j

64

~l

~
~

~
~

65

:1§

~~

~.
~{\

~~
~~
!~~j
:;·~l

·~1

~

~;.;)
;:.~~

66

i~~
:;~1

i?1
\~·~

:·;::/:
-: \~.-

69

Article 7 of the Charter guarantees the right to respect for private life, whilst Article 8 of
the Charter expressly proclaims the right to the protection of personal data. A1ticle 8(2) and
(3) specify that such data must be processed fairly for specified purposes and on the basis
of the consent of the person concerned or some other legitimate basis laid down by law,
that everyone has the right of access to data which have been collected concerning him or
her and the right to have the data rectified, and that compliance with these rules is to be

':!
:

:.~
:'•!

.•{'

..' ·~:

~ ~.

:3~
i':..>i

j

>I

: .~

>,.-1

1
l~~i

,~
§
1
"J

··~

i

I
~

~

~

f:l

~~
~}
~

~

~\i

~~
~~

f~

f~;!
~;

The Court has already held that the provisions of Directive 95/46, in so far as they govern
the processing of personal data liable to infringe fundamental freedoms, in particular the
right to privacy, must necessarily be interpreted in the light of fundamental rights, which,
according to settled case-law, form an integral part of the general principles of law whose
observance the Court ensures and which are now set out in the Charter (see, in particular,
Case
C274/99 P Connolly v Commission EU:C:2001 :127,
paragraph 37,
andOsterreichischer Rundfunk and Others EU:C:2003:294, paragraph 68).
·

I

~

First of all, it should be remembered that, as is apparent from Article 1 and recital 10 in the
· preamble, Directive 95/46 seeks to ensure a high level of protection of the fundamental
rights and freedoms of natural persons, in particular their right to privacy, with respect to
the processing of personal data (see, to this effect, /P/EU:C:2013:715, paragraph 28).

68

;.:/

;~~.

fJ

According to recital 25 in the preamble to Directive 95/46, the principles of protection laid
down by the directive are reflected, on the one hand, in the obligations imposed on persons
responsible for processing, in particular regarding data quality, technical security,
notification to the supervisory authority and the circumstances under which processing can
be carried out, and, on the other hand, in the rights conferred on individuals whose data are
the subject of processing to be informed that processing is taking place, to consult the data,
to request corrections and even to object to processing in certain circumstances.

::;l};

'

Mr ~osteja Gonza~ez, the Spa~ish, Italia? and Polish Governments and the Comm.ission
submit that the natiOnal authonty may directly order the operator of a search engme to
withdraw from its indexes and intermediate memory information containing personal data
t~at has been published. by third parties, without havi~g to app~oach b~forehand or
simultaneously the publisher of the web page on which that mformatwn appears.
Furthermore, according to Mr Costeja Gonz{llez, the Spanish and Italian Governments and
the Commission, the fact that the information has been published lawfully and that it still
a~pear.s on the original web page has no ~ffect on the .obligations of that opera~or under
Directive 95/46. On the other hand, accordmg to the Pohsh Government that fact IS such as
to release the operator from its obligations.

67
\

~1

According to the Austrian Government, a national supervisory authority may order such
an operator to erase information published by third parties from its filing systems only if
the .data in question have been fou?d ~reviously to be. unlawful or incor.rect or if :he data
~Ubject ~as made a ~uccessful obJeCtiOn to the publisher of the website on which that
InformatiOn was published.

I

:)~

~];

~J
·;~~

~~
~~:

l~;
;~~

~~

~

[~~

~";~;

,-,

 .

-

.,')-

••

-Y·.

_...._.

""""'

.F.J'.._~~_;:-.~~---•';:O'J,!'.(f'./'.J'"(.)o..r"•t~=..:'~ff.M"'"f.f\,_Xc.1:?o\~><;·~?)t•;>f'&..;-"'~"-'~.;:'~-;?';~:..-1",~'$"'X. .,'l':'"-":'[&");r,w . . --(--5----=~"r-~'_"r •--2 ......"""------ -~ ~~

~~-----...-. ~·-·~~f~::X<~-Y...~o:~~~~~-.;.0:·~~~.;; . . ~~%5.%~~~:--"')~-~-(;.x?"~~~m~W,...c:~®-'~~.W~?t.:5.::,.r~~;,r.XXl9&'k&.Jl.Q~i'-l'Wit~..t . ~,..,,_,..

;'''

.

i,

.

.

~

~l

£'

I

:

m'ji.·l

"il

fr;__

~
'2:;9$1

~~~~:
u~:~

I~

~ manupatra@

~~u
!I~~~.'
~~t

l'~.

\8:1

{til
subject to control by an independent authority. Those requirements are implemented inter
alia by Articles 6, 7, 12, 14 and 28 of Directive 95/46.

t1
:;.;,~·

l''

;j;l.;
~~·
·f?t'

70

Article 12(b) of Directive 95/46 provides that Member States are to guarantee every data
subject the right to obtain from the controller, as appropriate, the rectification, erasure or
blocking of data the processing of which does not comply with the provisions of Directive
95/46, in particular because of the incomplete or inaccurate nature of the data. As this final
point relating to the case where certain requirements referred to in Article 6(1 )(d) of
Directive 95/46 are not observed is stated by way of example and is not exhaustive, it
follows that non-compliant nature of the processing, which is capable of conferring upon
the data subject the right guaranteed in Article 12(b) of the directive, may also arise from
non-observance of the other conditions of lawfulness that are imposed by the directive
upon the processing of personal data.

71

In this connection, it should be noted that, subject to the exceptions permitted under
Article 13 of Directive 95/46, all processing of personal data must comply, first, with the
principles relating to data quality set out in Article 6 of the directive and, secondly, with
one of the criteria for making data processing legitimate listed in Article 7 of the directive
(see Osterreichischer Rundfimk and Others EU:C:2003:294, paragraph 65; Joined Cases
C468/l 0 and C469/l 0 ASNEF and FECEMD EU:C:20 11 :777, paragraph 26; and Case
C342/12 Worten EU:C:2013:355, paragraph 33).

72

Under Article 6 of Directive 95/46 and without prejudice to specific provisions that the
Member States may lay down in respect of processing for historical, statistical or scientific
purposes, the controller has the task of ensuring that personal data are processed 'fairly and
lawfully', that they are 'collected for specified, explicit and legitimate purposes and not
further processed in a way incompatible with those purposes', that they are 'adequate,
relevant and not excessive in relation to the purposes for which they are collected and/or
further processed', that they are 'accurate and, where necessary, kept up to date' and,
fi11ally, that they are 'kept in a form whiefh permits identification of data subjects for no
longer than is necessary for the purposes for which the data were collected or for which
they are further processed'. In this context, the controller must take every reasonable step
to ensure that data which do not meet the requirements of that provision are erased or
rectified.

73

As regards legitimation, under Article 7 of Directive 95/46, of processing such as that at
issue in the main proceedings carried out by the operator of a search engine, that
processing is capable of being covered by the ground in Article 7(f).

74

This provision permits the processing of personal data where it is necessary for the
purposes of the legitimate interests pursued by the controller or by the third party or parties
to whom the data are disclosed, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject ........ in particular his right to privacy
with respect to the processing of personal data - which require protection under
Article 1(1) of the directive. Application of Article 7(f) thus necessitates a balancing of the
opposing rights and interests concerned, in the context of which account must be taken of

f•,,

{1~

-~t:l
~ .. i

l

gij

~1

I
iffi
f>i1

~\i

~~

~
l~l~

~J!
~91
~~;
"):1·

~

~

~
~.~1~

~

~~·
~

~

"i\,
~

~

~ ~)

·...~
,._,

0
~

~
~

w
~
J

~

~.m

m

g

2.·1·
d

~
~

I

'm
~
~

&
~
~

~

~

ffi

~
0
~

~
w
~

I

~

~

'~
.

•~
!

~
'

~

~

•~
~

~
M

~~
I•~
ill

I

 ®)

•

!>

,0 manupatra<i
the significance of the data subject's rights arising from Articles 7 and 8 of the Charter
(see ASNEF and FECEMD, EU:C:2011 :777, paragraphs 38 and 40).
75

Whilst the question whether the processing complies with Articles 6 and 7(f) of Directive
95/46 may be determined in the context of a request as provided for in Article 12(b) of the
directive, the data subject may, in addition, rely in certain conditions on the right to object
laid down in subparagraph (a) of the first paragraph of Arttcle 14 of the directive.

16

Under subparagraph (a) of the first paragraph of Article 14 of Directive 95/46, Member
States are to grant the data subject the right, at least in the cases referred to in Article 7(e)
and (f) of the directive, to object at any titne on compelling legitimate grounds relating' to
his particular situation to the processing of data relating to hitn, save where otherwise
provided by national legislation. The balancing to be carried out under subparagraph (a) 0f
the first paragraph of Article 14 thus enables account to be taken in a more specific manner
of all the circumstances surrounding the data subject's particular situation. Where there is a
justified objection, the processing instigated by the controller may no longer involve those
data.

77

Requests under Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of
Directive 95/46 tnay be addressed by the data subject directly to the controller who tnust
then duly examine their merits and, as the case may be, end processing of the data in
question. Where the controller does not grant the request, the data subject may bring the
matter before the supervisory authority or the judicial authority so that it carries out the
necessary checks and orders the controller to take specific measures accordingly.

78

In this connection, it is to be noted that it is clear from Article 28(3) and (4) of Directive
95/46 that each supervisory authority is to hear claims lodged by any person concerning
the protection of his rights and freedoms in regard to the processing of personal data and
that it has investigative powers and effective powers of intervention enabling it to order in
particular the blocking, erasure or destruction of data or to impose a temporary or
definitive ban on such processing.

79

It is in the light of those considerations that it is necessary to interpret and apply the
provisions of Directive 95/46 governing the data subject's rights when he lodges with the
supervisory authority or judicial authority a request such as that at issue in the main
proceedings.

80

It must be pointed out at the outset that, as has been found in paragraphs 36 to 38 of the
present judgment, processing of personal data, such as that at issue in the main
proceedings, carried Qut by the operator of a search engine is liable to affect significantly
the fundamental rights to privacy and to the protection of personal data when the search by
means of that engine is carried out on the basis of an individual's name, since that
processing enables any internet user to obtain through the list of results a structured
overview of the information relating to that individual that can be found on the internetinformation which potentially concerns a vast number of aspects of his private life and
which, without the search engine, could not have been interconnected or could have been
only with great difficulty- and thereby to establish a more or less detailed profile of him.

);-,.~~:~
_:. -~ ' ..

:-;(1

fu~

;:,dl

I
"J
-~~~

~~~.:
·'r,.{;
{c•l.

~~~l

i~~.~
(\'*''

~~(<)

~;~

~~~

~l~~~

~l
~-Y~~

1111

~~~~l
i'i2
~~i-ll

I
tt~
,J~

\11!
'11.1

h~

\fjj
~~-~

lJ!

~~~

~
;il

...... ;
~~

.".'1
~

r,

.·_/•

n~

t~

,;jl
$~.;(
(~~

J~~

ll~

~~J

1}~

--~
?~~

i

"-

'~~

 ~.·.

~;~.
~,.

~"£

~~:~

.

[!0

'i~:
}*-·i

~

;;' .· .
.
~:::

'>:.1~)

~m

J2i manupatra@
Furthermore, the effect of the interference with those rights of the data subject is
heightened on account of the important role played by the internet and search engines in
modern society, which render the information contained in such a list of results ubiquitous
(see, to this effect, Joined Cases C509/09 and C161/10 eDate Advertising and
Others EU:C:2011 :685, paragraph 45).

··~·

~~

~~·

·~··'

!;_

,J

~

~~~

m
ffl,l:

'

~-:'

/.-·

r.;•.

~1.~
:·~::,

t~;;

81

~.1
·»~

~

I

I
~~
~

~

•m
~

82

Following the appraisal of the conditions for the application of Article 12(b) and
subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 which is to be
carried out when a request such as that at issue in the main proceedings is lodged with it,
the supervisory authority or judicial authority may order the operator of the search engine
to remove from the list of results displayed following a search made on the basis of a
person's name links to web pages published by third parties containing information relating
to that person, without an order to that effect presupposing the previous or simultaneous
removal of that name and information ~ of the publisher's own accord or following an
order of one of those authorities-·· from the web page on which they were published.

83

As has been established in paragraphs 35 to 38 of the present judgment, inasmuch as the
data processing carried out in the context of the activity of a search engine can be
distinguished from. and is additional to that carried out by publishers of websites and
affects the data subject's fundamental rights additionally, the operator of the search engine
as the controller in respect of that processing must ensure, within the framework of its
responsibilities, powers and capabilities, that that processing meets the requirements of
Directive 95/46, in order that the guarantees laid down by the directive may have full
effect.
·

84

Given the ease with which information published on a website can be replicated on other
sites and the fact that the persons responsible for its publication are not always subject to
European Union legislation, effective and complete protection of data users could not be
achieved if the latter had to obtain first or in parallel the erasure of the information relating
to them fromthe publishers ofwebsites.

85

Furthermore, the processing by the publisher of a web page consisting in the publication
of information relating to an individual may, in some circumstances, be carried out 'solely
for journalistic purposes' and thus benefit, by virtue of Article 9 of Directive 95/46, ,from

•
~
h.~.~
ill·

~~

I
~
~

~~,
~

~
•.q
~

ru~
~

I

II
0·

I

I
~ ·-~

~

D
~

~

~

~
~

~~~~.

i~
..
~

In the light of the potential seriousness of that interference, it is clear that it cannot be
justified by merely the economic interest which the operator of such an engine has in that
processing. However, inasmuch as the removal of links from the list of results could,
depending on the information at issue, have effects upon the legitimate interest of internet
users potentially interested in having access to that information, in situations such as that at
issue in the main proceedings a fair balance should be sought in particular between that
interest and the data subject's fundamental rights under Articles 7 and 8 of the Charter.
Whilst it is true that the data subject's rights protected by those atticles also override, as a
general rule, that interest of internet users, that balance may however depend, in specific
cases, on the nature of the information in question and its sensitivity for the data subject's
private life and on the interest of the public in having that information, an interest which
may vary, in pa1ticular, according to the role played by the data subject in public life.

{}~

'.:·t._,

~/

 ~~m~"'"""'"'"""""""0G""_,'"""'"";u:n;ar"····:;c,:7't'.'i\'C::Oi~11ii:I

~

m;

~t~~

.~

£'_)&,

&«XC-')

~~v

.. :'i

;t~~

ft~

ifh

·.·::..'i

~~)

!I

~~~:

··:--:-s

-;'~~

JZi manupatra

~~lk~:l

I

<!
';}

derogations from the requirements laid down by the directive, whereas that does not appear
to be so in the case of the processing carried out by the operator of a search engine. It
cannot therefore be ruled out that in certain circumstances the data subject is capable of
exercising the rights referred to in Article 12(b) and subparagraph (a) of the first paragraph
of Article 14 of Directive 95/46 against that operator but not against the publisher of the
web page.

iiW
.,':•,l

~t~
~i(~

l't~

;::s

/.

~~~:~
~~·~

11\'

~::~~

"'!ll

~~i·
-~-)~.

86

·r:!i.

:;,:•A•

):,:!:·'

~1

li
f:[11

~~~
~ ij

~~q

Finally, it must be stated that not only does the ground, under Article 7 of Directive 95/46,
justifying the publication of a piece of personal data on a website not necessarily coincide
with that which is applicable to the activity of search engines, but also, even where that is
the case, the outcome of the weighing of the interests at issue to be carried out under
Article 7(t) and subparagraph (a) of the first paragraph of Article 14 of the directive may
differ according to whether the processing carried out by the operator of a search engine or
that carried out by the publisher of the web page is at issue, given that, first, the legitimate
interests justifying the processing may be different and, second, the consequences of the
processing for the data subject, and in particular for his private life, are not necessarily the
same.

87

Indeed, since the inclusion in the list of results, displayed following a search made on the
basis of a person's name, of a web page and of the information contained on it relating to
that person makes access to that information appreciably easier for any internet user
making a search in respect of the person concerned and may play a decisive role in the
dissemination of that information, it is liable to constitute a more significant interference
with the data subject's fundamental right to privacy than the publication on the web page.

88

rB~•r·

In the light of all the foregoing considerations, the answer to Question 2(c) and (d) is that
Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46
are to be interpreted as meaning that, in ordet· to comply with the rights laid down in those
provisions and in so far as the conditions laid down by those provisions are in fact
satisfied, the operator of a search engine is obliged to remove from the list of results
displayed following a search made on the basis of a person's name links to web pages,
published by third parties and containing information relating to that person, also in a case
where that name or information is not erased beforehand or simultaneously from those web
pages, and even, as the case may be, when its publication in itself on those pages is lawful.

t

95146

I
p~

~;~-~
~
~

'~
.:·~

.

'•
~

~
~

~
'~

~

Question 3, concerning the scope of the data subjects rights guaranteed by Directive

~

~
~-,

t~,,
~,,~:
{?~
~~.

~:~

;-~j
;~c·

t}j
~I

~~~·

r.~

~

~

~

~;

'
~J

~
~~·
M

9

~

~
~
.),

,,

·~

~~!

89

By Question 3, the referring court asks, in essence, whether Article 12(b) and
subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 are to be interpreted
as enabling the data subject to require the operator of a search engine to remove from the
list of results displayed following a search made on the basis of his name links to web
pages published lawfully by third parties and containing true information relating to him,
on the ground that that information may be prejudicial to him or that he wishes it to be
'forgotten' after a certain time.

.,

;:>
~ ~­

·:::-.
::~:~:

~)

~~I~
t:,~
:-:.-;-·

,,·;'

r-:·

 ~~
·
......
·
·
·
·
· ·
')<.A.·.~ ·- ..·~]._._..
..·.·.
....:...:'M ..... .
• •
.a'::. ·>.XA:if'...w .......;.._.fz_,·J·.·.~v.·
tot~ .
· · i"... _ ~ . 9."-.;.~y,~..,-~ . .li:0
1&3&.&M&3!2.9ZiWS~t?:i!&.'Z§§§&i:$\"~~~W?Ztf'0~'&?&X%:t!XIZ&'-"'"mq:§~~·;~'~'''·~·m.m<Y';'Zt:!J!»:rl.'·'"i7~·i§k~~jt~'''·':\zw".'.'

r
~.

.

.

.

I

I
~~

~~

.....-,

~.-

~:i~~

• g~

{I·

~-·~

JZi manupatra ~

'e''·'
··>::

:.::::~

90

'r~.·~
-~~
~.~

~.

I~

~

••

91

According to Mr Costeja Gonzalez and the Spanish and Italian Governments, the data
subject may oppose the indexing by a search engine of personal data relating to him where
their dissemination through the search engine is prejudicial to him and his fundamental
rights to the protection of those data and to privacy- which encompass the 'right to be
forgotten'- override the legitimate interests of the operator of the search engine and the
general interest in freedom of information.

92

As regards Article 12(b) of Directive 95/46, the application of which is subject to the
condition that the processing of personal data be incompatible with the directive, it should
be recalled that, as has been noted in paragraph 72 of the present judgment, such
incompatibility may result not only from the fact that such data are inaccurate but, in
particular, also from the fact that they are inadequate, irrelevant or excessive in relation to
the purposes of the processing, that they are not kept up to date, or that they are kept for
longer than is necessary unless they are required to be kept for historical, statistical or
scientific purposes.

~

~

•I
~
4

~~~

··~J'
.m
~~

I
~

~~

~
~

Th,,.

Iw
A
~

93

Therefore, if it is found, following a request by the data subject pursuant to Article l2(b)
of Directive 95/46, that the inclusion in the list of results displayed following a search
made on the basis of his name of the links to web pages published lawfully by third parties
and containing true information relating to him personally is, at this point in time,
incompatible with Article 6(1)(c) to (e) of the directive because that information appears,
having regard to all the circumstances of the case, to be inadequate, irrelevant or no longer
relevant, or excessive in relation to the purposes of the processing at issue carried out by
the operator of the search engine, the information and links concerned in the list of results
must be erased.

95

So far as concerns requests as provided for by Article 12(b) of Directive 95/46 founded on
alleged non-compliance with the conditions laid down in Article 7(f) of the directive and
requests under subparagraph (a) of the first paragraph of Article 14 of the directive, it must

~

~
~
~

4
i
~

~

fl

~

u
~

It follows from those requirements, laid down in Article 6(l)(c) to (e) of Directive 95/46,
that even initially lawful processing of accurate data may, in the course of time, become
incompatible with the directive where those data are no longer necessary in the light of the
purposes· for which they were collected or processed. That is so in particular where they
appear to be inadequate, irrelevant or no longer relevant, or excessive in relation to those
purposes and in the light of the time that has elapsed.

94

~

~~

·,~;

b;

~:~~~
~\~

~~?.

~i]

f~:

rt:

~I;~
~~:;~

~:~~-

::,(.("

~
~

I

Google Spain, Google Inc., the Greek, Austrian and Polish Governments and the
Commission consider that this question should be answered in the negative. Google Spain,
Google Inc., the Polish Government and the Commission submit in this regard that
Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46
confer rights upon data subjects only if the processing in question is incompatible with the
directive or on compelling legitimate grounds relating to their particular situation, and not
merely because they consider that that proce~sing may be prejudicial to them or they wish
that the data being processed sink into oblivion. The Greek and Austrian Governments
submit that the data subject must approach the publisher of the website concerned.

h:

)\}"

~·c ~

(:.:
~·.: ::
.'

 ~~'"'""'"""""'""~_,.,,..,....,._~"""'~""''"'"'''~'~""-'Emti~J~

.

~
~

~

I
~
~

~

I

~

4

I1:~;

~

:r

®1.

I

~

-~

&

~

I

t\~

,

~

,,,.,,1

.

,2{ manupatra
.

~~

I

I
~~

I''·

~

~lWi

be pointed out that in each case the processing of personal data must be authorised under
Article 7 for the entire period during which it is carried out.

~~~li

~
~

!'.;.fu~.l

96

[J?~

Th~l

~tJ
f!g!'i

~'

Xil~
.~l',;:~

~m
r•''\5

In the .light of the foregoin~, wh~n appraisi?g such re~uests. made in ?rder t? oppose
process111g such as that at Issue 111 the ma111 proceed111gs, It should m particular be
examined whether the data subject has a right that the information relating to him
p~rsonally shoul~, at this point in time, no lo~ger be. linked to his .name by~ list.of results
displayed followmg a search made on the basts of hts name. In thts connectton, 1t must be
~ointed ?ut ~hat it i~ no.t. nece~sary in order to find s~c~ a right that the ~nclusion of the
mformatwn 111 question m the hst of results causes prejudtce to the data subject.

~

iI

~

~~
~

~:

f~

~
§l
~::.

:::1·

~~;
~··=

97

~~

I
··:·~~

:~·~1
~}~

~f.~
~\?~

I
I
,::;:')

·:""
.:-:;:.).

98

~~
;~

{~:~

~~1
~'~J
;~:

~~ft~
1\:~
~

M
M

~·-,

~

lli

ffi
H
ill

i~

~

1

~

~

~
~

r§
~

tJ
~

0
~
~

0

~

~

'?1

~

)~)

;'j

~;~

}1
·:~

·.·\
":'1

~

j::

~·
J1'
~~

99

As the data subject may, in the light of his fundamental rights under Articles 7 and 8 of the
Chatter, request that the information in question no longer be made available to the general
public by its inclusion in such a list of results, it should be held, as follows in particular
from paragraph 81 of the present judgment, that those rights override, as a rule, not only
the economic interest of the operator of the search engine but also the interest of the
general public in finding that information upon a search relating to the data subject's name.
However, that would not be the case if it appeared, for particular reasons, such as the role
played by the data subject in public life, that the interference with his fundamental rights is
justified by the preponderant interest of the general public in having, on account of
inclusion in the list of results, access to the information in question.
As regards a situation such as that at issue in the main proceedings, which concerns the
display, in the list of results that the internet user obtains by making a search by means of
Google Search on the basis of the data subject's name, of links to pages of the on-line
archives of a daily newspaper that contain announcements mentioning the data subject's
name and relating to a real-estate auction connected with attachment proceedings for the
recovery of social security debts, it should be held that, having regard to the sensitivity for
the data subject's private life of the information contained in those announcements and to
the fact that its initial publication had taken place 16 years earlier, the data subject
establishes a right that that information should no longer be linked to his name by means of
such a list. Accordingly, since in the case in point there do not appear to be particular
reasons substantiating a preponderant interest of the public in having, in the context of such
a search, access to that information, a matter which is, however, for the referring court to
establish, the data subject may, by virtue of Article 12(b) and subparagraph (a) of the first
paragraph of Article 14 of Directive 95/46, require those links to be removed from the list
of results.
It follows from the foregoing considerations that the answer to Question 3 is that
Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46
are.to be interpreted as meaning that, when appraising the conditions for the application of
those provisions, it should inter alia be examined whether the data subject has a right that
the information in question relating to him personally should, at this point in time, no
longer be linked to his name by a list of results displayed following a search made on the
basis of his name, without it being necessary in order to find such a right that the inclusion
of the information in question in that list causes prejudice to the data subject. As the data
subject may, in the light of his fundamental rights under Articles 7 and 8 of the Ch~rter,

~~~

:_~.-:;.

<~
~;:~;

·~!
_·:r

f,~

~'~

{;;

'{,'"
!'·f

~~··

~~~

0~:

():

f~

;§

~~~
~
~:;::..

~~;

;s.::
~~

fl
'!-..

5(

~:~

~·>~

0'

~1

~~

(.1;

[.

~}

~2

r: ~

~'~-.

 - ~";_?_(:~:'j_';J_\~,~~,:~I;~:~~(_'i!.!J"·N"

·fl·

•

~~

JZi manupatra ~
request that the information in question no longer be made available to the general public
on account of its inclusion in such a list of results, those rights override, as a rule, not only
the economic interest of the operator of the search engine but also the interest of the
general public in having access to that information upon a search relating to the data
subject's name. However, that would not be the case if it appeared, for particular reasons,
such as the role played by the data subject in public life, that the interference with his
fundamental rights is justified by the preponderant interest of the general public in having,
on account of its inclusion in the list of results, access to the information in question.

Costs
100

Since these proceedings are, for the parties to the main proceedings, a step in the action
pending before the referring court, the decision on costs is a matter for that court. Costs
incurred in submitting observations to the Court, other than the costs of those parties, are
not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:

'1

:).

;.i
1

~ .]

:·:~'
'.':1

~;1

'!

·'

1.

Article 2(b) and (d) of Directive 95/46/EC of the European Parliament and of the
Council of 24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data are to be
interpreted as meaning that, first, the activity of a search engine consisting in
finding information published or placed on the internet by third parties,
indexing it automatically, storing it temporarily and, finally, making it available
to internet users according to a particular order of preference must be classified
as 'processing of personal data' within the meaning of Article 2(b) when that
information contains personal data and, second, the operator of the search
engine must be regarded as the 'controller' in respect of that processing, within
the meaning of Article 2(d).

2.

Article 4(1)(a) of Directive 95/46 is to be interpreted as meaning that processing
of personal data is carried out in the context of the activities of an establishment
of the controllet on the territory of a Member State, within the meaning of that
provision, when the operator of a search engine sets up in a Member State a
branch or subsidiary which is intended to promote and sell advertising space
offered by that engine and which orientates its activity towards the inhabitants
of that MemberState.

3.

Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of
Directive 95/46 are to be interpreted as meaning that, in order to comply with
the rights laid down in those provisions and in so far as the conditions laid down
by those provisions are in fact satisfied, the operator of a search engine is
obliged to remove from the list of results displayed following a search made on
the basis of a person's name links to web pages, published by third parties and
·containing information relating to that person, also in a case where that name or
information is not erased beforehand or simultaneously from those web p~ges,

 ~l ~;::m.&~v;.;~i.fl«#:i~:z;:;::::=~·~;;;,..;;;;{>~;:;;~..a:-.m-;N;u:;·::::~,z·;.§§§Zi/.?:.<.?,<..''Z'Xb:~.;:{&;>;;~~;;::&;x..:&m<¥~;:Ui;.~'i'g';~';s::z~:;ox~·7:::~:;~':':Zii:t-:?£u;<»-;.sfw~xo))~::;:'%<t~i

8~~<:·:

w

~;;:.
1:::,
.--~·

·:)

I

~3

t)

li-~.

•

:,,

J2i manu.patra

~

~

I
~

1_:11
~
~~
"~

Im
~

I

~

®
G

I
8

r~~~

~

fu

~
(·.,·

~
'(1

:'t
• j

~

1
~

B
~

*
~

~

'N
~

I
~

~

I

:~;;·

·;

~

I
I

~(-

,;; ..

'~

·.::-;.

<!

:,:

and even, as the case may be, when its publication in itself on those pages is
lawful.

~?
...,
.-(~

4.

Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of
Directive 95/46 are to be interpreted as meaning that, when appraising the
conditions for the application of those provisions, it should inter alia be
examined whether the data subject has a right that the information in question
relating to him personally should, at this point in time, no longer be linked to his
name by a list of results displayed following a search made on the basis of his
name, without it being necessary in order to find such a right that the inclusion
of the information in question in that list causes prejudice to the data subject. As
the data subject may, in the light of his fundamental rights under Articles 7 and
8 of the Charter, request that the information in question no longer be made
available to the general public on account of its inclusion in such a list of results,
those rights override, as a rule, not only the economic interest of the operator of
the search engine but also the interest of the general public in having access to
that information upon a search relating to the data subject's name. However,
that would not be the case if it appeared, for particular reasons, such as the role
played by the data subject in public life, that the interference with his
fundamental rights is justified by the preponderant interest of the general
public in having, on account of its inclusion in the list of results, access to the
information in question.

";;·~

~
\._)''"'

;~;

~

~

~~

:.u

~;
~~

c<
&'<
x;-d

"!!

7.~

:<!

;~

'I
~

'
,,,

,.:}

"1

~­
~>(

~

~
.:~

[Signatures]

«
~

:r';

~-

~~

~

~
~

~~·

§~.

~~0'

~

I

;)
~
ii

~?

J
~
~

~

~

~

~

~
(

"

[6

w

I

'"

f;

·~

~~

~
~

~

~

:

~,

',C
t

c

:

 :.1~~Q2~'?f:?%*t8'~"i~-~~~~~:;:)-~~;~~J3'~'%Y~::s-t~?~512&~t~AA.=f~~~~~g~v2.i;tv;,,~).~-~~~~~~r~:·:;·::~~:~ "-'~~=. ~~~~·?:·.~~;s{X\:~&;&~~,;;.rr.~;,~t..-c~:;.}~·9!f~~t~f;.:i&~~;::0~~~~~:~-~··.:··~:_.

'J!]

~1/~~L\H. p~

.

,:~_(('!

8'\)

?tl:!
.·.c'.;l

e

li

EUR-Lex- 31995L0046- EN

13/01/2016

(<

I

·.~

.,:.~

·~m
;~~t

31995L0046
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on
the protection of individuals with regard to the processing of personal data and on the free
movement of such data
·

I
,-;·,Jl'

tm~'''~.

Official Journal L281, 23/11/1995 P. 0031 - 0050

~:iN

i'!fl
~.(lfJ

Ui~:.,

l~

DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

~~w

of 24 October 1995

8~~

on the protection of individuals with regard to the processing of personal data and on the free movement
of such data

J~·!
l'N

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

;;Ul

~~)

R~

Having regard to the Treaty establishing the European Community, and In particular Article lOOa thereof,

l(l~

Having regard to the proposal from the Commission (1),

~?.~
:};1

~~?~

Having regard to the opinion of the Economic and Social Committee (2),

~1

Acting in accordance with the procedure referred to in Article 189b of the Treaty (3),

@!

~~~

(1) Whereas the objectives of the Community, as laid down in the Treaty, as amended by the Treaty on
European UniOn, include creating an ever closer union among the peoples of Europe, fostering closer
relations between the States belonging to the Community, ensuring economic and social progress by
comi'llon action to eliminate the barriers which divide Europe, encouraging the constant improvement of
the living conditions of its peoples, preserving and strengthening peace and liberty and promoting
democri!l(.'y on the basis of the fundamental rights recognized in the constitution and laws of the Member
States and in the European Coiwention for the Protection of Human Rights and Fundamental Freedoms;

~i:t&

~i~
::..:
:.,M
~'}

1~}

~i1

~~

(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the
nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the
right to privacy, and contribute to economic and social progress, trade expansion and the well-being of
Individuals;

ijl1

lil
·;{
6>

(3) Whereas the establishment and functioning of an internal market in which, in accordance with Article
7a of the Treaty, the free movement of goods, persons, services and capital is ensured require not only
that personal data should be able to flow freely from one Member State to another, but also that the
fundamental rights of individuals should be safeguarded;

~ ~;]

~l

~~~

.:{1

(4) Whereas increasingly frequent recourse is being had in the Community to the processing of personal
data in the various spheres of economic and social activity; whereas the progress made in information
technology is making the processing and exchange of such data considerably easier;

t:)

:9!

:~\

~
~

~
'~

J

~

~

n

N

€

i
~~

~

~
~
~:

f

?
~;

~

(5) Whereas the economic and social integration resulting from the establishment and functioning of the
internal market within the meaning of Article 7a of the Treaty will necessarily lead to a substantial
increase in cross-border flows of personal data between all those involved in a private or public capacity in
economic and social activity in the Member States; whereas the exchange of personal data between
undertakings in different Member States is set to increase; whereas the national authorities in the various
Member States are being called upon by virtue of Community law to collaborate and exchange personal
data so as to be able to perform their duties or carry out tasks on behalf of an authority in another
Member State within the context of the area without internal frontiers as constituted by the internal
market;
(6) Whereas, furthermore, the increase in scientific and technical cooperation and the coordinated
introduction of new telecommunications networks in the Community necessitate and facilitate cross-border
flOws of personal data;
(7) Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the
right to privaey, with regard to the processing of personal data afforded in the Member States may prevent
the transmission of such data from the territory of one Member State to that of another Member State;
whereas this difference may therefore constitute an obstacle to the pursuit of a number of economic

:~

~

?
~ :";

,,

)

~

~·:.·
-~

1,,
~

~

http://eur-iex.europa.eu/LexUriServ/LexUriServ.da?uri=CELEX:31995L0046:en:HTML

•./''.(
~'

.·

~·

 ~{~·;·~~Z·5C?X®~~~""<-..~~~?e;.'>(~....:·Qv";:tY'Jf-'5i9\J\,''XI~?'r!..,X...:.t-~>¥-N.>'..:<:HYr·;t.~;:<:«•J<"..j?'lJ'~.>rot3t.?:.'i.."'.li"XP>:Y)(';r;.~.t!.f'.·i'_,{J.''.'\.~:"":.Y..t:,~·?9\.\:",•~-l"~'«"N'~«¥'M"'I~.f.)!'7N~"'i.··~~~N~c.u-.~H-_,_,.-

,~-~·

•••. X•Yh, •• X<~•"•·--~~WNWV(o)U~,Wo>C~~.·N-X/QOOo.,",i., •,,,•:.~--,,\',',il •.".c~

.M:NC'Xr.l>0t::Mi>i'&-~:Si

~

~

'~~"'
""'~

I

~

~

~

(\
c."l \

~

T

..

~

~

''"""""

~

I

activltles at Community levcl,

di~ort <Ill11petition~::;:::;:,

~

I

~*!

M
~iii

~U
$.~

~~ .
ij~
\'i~

i~
~~

y,~
f.?~
~~

~

~il

i~,~

flj

&~
~·-·1

~
'

'
~~r;

¢.A.~

I
~;iJ

.,,.!

...,:<· .. ,
~,

H(:
··.;,
''.i
... ,!

:u1
.,.,1

(~,

In the disdlarye of their

responsibilities under Community law; whereas this difference in levels of protection is due to the
existence of a wide variety of national laws, regulations and administrative provisions;
(8) Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the
rights and freedoms of individ. uals with regard to the processing of such data must be equivalent In all
Member States; whereas this objective is vital to the internal market but cannot be achieved by the
Member States alone, especially in view of the scale of the divergences which currently exist between the
relevant laws in the Member States and the need to coordinate the laws of the Member States so as to
ensure that the cross-border flow of personal data is regulated In a consistent manner that is In keeping
with the objective of the internal market as provided for in Article 7a of the Treaty; whereas Community
action to approximate those laws is therefore needed;
(9) Whereas, given the equivalent protection resulting from the approximation of national laws, the
Member States will no longer be able to inhibit the free movement between them of personal data on
grounds relating to protection of the rights and freedoms of individuals, and in particular the right to
privacy; whereas Member States will be left a margin for manoeuvre, which may, in the context of
implementation of the Directive, also be exercised by the business and social partners; whereas Member
States will therefore be able to specify in their national law the general conditions governing the
lawfulness of data processing; whereas in doing so the Member States shall strive to improve the
protection currently provided by their legislation; whereas, within the limits of this margin for manoeuvre
and in accordance with Community law, disparities could arise in the implementation of the Directive, and
this could have an effect on the movement of data within a Member State as well as within the
Community;
(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental
rights and freedoms, notably the right to privacy, which Is recognized both in Article 8 of the European
Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of
· Community law; whereas, for that reason, the approximation of those laws must not result in any
lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection
in the Community;
(11) Whereas the principles of the protection of the rights and freedoms of individuals, notably the right to
privacy, which are contained in this Directive, give substance to and amplify those contained in the Council
of Europe Convention of 28 January 1981 for the Protectiot1 of Individuals with regard to Automatic
Processing of Personal Data;
(12} Whereas the protection principles rnust apply to all processing of personal data by any person whose
activities are governed by Community law; whereas there should be excluded the processing of data
carried out by a natural person in the exercise of activities which are exclusively personal or domestic,
such as correspondence and the holding of records of addresses;

-:~

:!u
;.iJ

'i{~

~j

'~j

~:i
d
.~F
;~:;:

,_\:·,

I
J}!j

~ij

I
.'\~

~
~~~;~

111

~~

~·1

i~l

Ml

~1~.1

1

;

~

I

~~

l,o. <

(13) Whereas the ac::itivities referred to in Titles V and VI of the Treaty on European Union regarding public
safety, defence, State security or the acitivities of the State in the area ofcriminal laws fall outside the
scope of Community law, without prejudice to the obligations incumbent upon Member States under Article.
56 (2), Article 57 or Article 100a of the Treaty establishing the European Community; whereas the
processing of personal data that is necessary to safeguard the economic well-being of the State does not
fall within the scope of this Directive where such processing relates to State security matters;
(14) Whereas, given the importance of the developments under way, in the framework of the information
society, of the techniques used to capture, transmit, manipulate, record, store or communicate sound and
image data relating to natural persons, this Directive should be applicable to processing involving such
data;
(15) Whereas the processing of such data is covered by this Directive only if it is automated or if the data
processed are contained 6r are intended to be contained in a filing system structured according to specific
criteria relating to individuals, so as to permit easy access to the personal data in question;
(16) Whereas the processing of sound and image data, such as in cases of video surveillance, does not
come within the scope of this Directive if it is carried out for the purposes of public security, defence,
national security or in the course of State activities relating to the area of criminal law or of other
activities which do not tome within the scope of Commut'lity law;
(17) Whereas, as far as the processing of sound and image data carried out for purposes of journalism or ,
the purposes of literary or artistic expression is concerned, in particular in the audiovisual field, the
principles of the Directive are to apply in a restricted manner according to the provisions laid down in
Article 9;
http://eur·lex.europa.euJLexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

~~

m

''.

;
~ :·.·.·
.
,
~·
~~

ru
t$:"

·,,

 ~~~~~*~~J'~~\C

~

.. -

Y'

-x·~;x-:~w=:~}~zs;~~=~:;~:~j~~~-~~n~!Z!~~-m~~~3rt&:~S»..{~;2~~~(~§J.~J&~g;{Ct:«.~;~i~~JI~?;::.-~~·?::~:ss:~;~;-s~~5.~~%

~

~~
~5~5

.
-I
~x-x,-:s; .

~:ill
~--~)

1310112016

EUR-Lex- 31995L0046- EN

.

0'---

~

(18) Whereas, in order to ensure that individuals are not deprived of the protection to which they are
entitled under this Directive, any processing of personal data in the Community must be carried out in
accordance with the law of one of the Member States; whereas, in this connection, processing carried out
under the responsibility of a controller who is establisned in a Member State should be governed by the
law of that State·I

;-W

~!i]

r;;

):!_;
J))

(19) Whereas establishment on the territory of a Member State implies the effective and real exercise of
activity through stable arrangements; whereas the legal form of such an establishment, whether simply
branch or a subsidiary with a legal personality, is not the determining factor in this respect; whereas, when
a single controller is established on the territory of several Member States, particularly by means of
subsidiaries, he must ensure, in order to avoid any circumvention of national rules, that each of the
establishments fulfils the obligations imposed by the national law applicable to its activities;

!m
~'!~

~

~~

~~

(20) Whereas the fact that the processing of data is carried out by a person established in a third country
must not stand In the way of the protection of individuals provided for in this Directive; whereas iri these
cases, the processing should be governed by the law of the Member State in which the means used are
located, ar'ld there should be guarantees to ensure that the rights and obligations provided for in this
Directive are respected in practice;

~}l
t~<;

~~,·

~·~\

~
·;~\

··:·!:

l%~

:jE;,

:";~
~,~

i[;
~

12i
~;.

~;

;g;

8
··'>
<~'

c-_

~~··,

3!'(.:

;t;:.

TI~l

(21) Whereas this Directive is without prejudice to the rules of territoriality applicable in criminal matters;

~~

(22) Whereas Member States shall more preCisely define in the laws they enact or when bringing into force
the measures taken under this Directive the general circumstances in which processing is lawful; whereas
in patticular Article 5, in conjunction with Articles 7 and 8, allows Member States, independently of general
rules, to provide for special processing conditions for speCific sectors and for the various categories of data
covered by Article 8;

1~1
~~- ,'·

~)~

·~~\-:
{-~

~~

~::

I:,

(23) Whereas Member States are empowered to ensure the implementation of the protection of individuals
bOth by means of a general law on the protection of individuals as regards the processing Of personal data
and by sectorial· laws such as those relating, for example, to statistical institutes;

:!;.·

(25) Whereas tha principles of protection must be reflected, on the one hand, in the obligations imposed on
persons, public authorities, enterprises, agencies or other oodles responsible for processing, in particular
regarding data quality, technical security, notification to the supervisory authority, and the circumstances
under which processing can be carried out, and, on the other hand, in the right conferred on individuals, the
data on whom are the subject of processing, to be informed that processing is taking place, to consult the
data, t6 request corrections and even to object to processing in certain circumstances;

~~

1
~­

~~~

(t!

h:''-1
(-pi

if~

~y

~~~
~'~

:}:%

&§
.,~

~
{{~

r'tj
~1

~K~
.')..~

~
---~·
;:. ~

iii:,1

;;j
..:~")

t;3
~f~
;;;I

;i~

!i]

:;~
Ji1
{~
->i

fii
h'JJ .
i}
~

~11
~- ~ ~~

i~l

~

s.-;-J

~
w
~

i~

~>i

~:~

(24) Whereas the legislation concerning the protection of legal persons with regard to the processing data
which concerns them is not affected by this Directive;

(26) Whereas the principles of protection must apply to any information concerning an identified or
identifiable person; whereas, to determine whether a person is identifiable, account should be taken of all
the means likely reasonably to be used either by the controller or by any other person to identify the said
person; whereas the principles of protection shall not apply to data rendered anonymous in such a way
that the data subject is no longer identifiable; whereas cOdes of conduct within the meaning of Article 27
may be a useful instrufnent for providing guidance as to the ways in which data may be rendered
anonymous and retained in a form in which identification of the data subject is no longer possible;
(27) Whereas the protection of individuals must apply as much to autornatic processing of data as to
manual processing; whereas the scope of this protection must not in effect depend on the techniques used,
otherwise this would create a serious risk of circumvention; whereas, .nonetheless, as regards manual
processing, this Directive covers only filing systems, not unstructured files; whereas, in particular, the
content of a filing system must be structured according to specific criteria relating to individuals allowing
easy access to the personal data; whereas, in line with the definition in Article 2 (c), the different criteria
for determining the constituents of a structured set of personal data, and the different criteria governing
access to such a set, may be laid down by eath Member State; whereas files or sets of files as well as
their cover pages, which are not structured according to specific criteria, shall under no circumstances fall
within the scope of this Directive;
(28) Whereas any processing of personal data must be lawful and fair to the individuals concerned;
whereas, in particular, the data must be adequate, relevant and not excessive in relation to the purposes
for which they are processed; whereas such purposes must be explicit and legitimate and must be
determined at the time of collection of the data; whereas the purposes of processing further to collection ,
shall not be incompatible with the purposes as they were originally specified;
(29) Whereas the further processing of personal data for historical, statistical or scientific purposes is not
generally to be considered incompatible with the purposes for which the data have previously been
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

··=-

;"~;

 -r~~'""""""""''-"'"$"'"'"''~""'"""""":.~'~

1

'

..

~

I
~~~;~:1i;

·33

~

~
M

I~~

~

~

~

~

i
0

~

0

~/',f

..

13/01/2016

"~1

~(l!

collected provided that Member States furnishl suitable safeguards; whereas these safeguards must in
particular rule out the use of the data in support of measures or decisions regarding any particular
individual;

l(~

~!j

mj

(30) Whereas, in order to be lawful, the processing of personal data must in addition be carried out with
the consent of the data subject or be necessary for the conclusion or performance of a contract binding on
the data subject, or as a legal requirement, or for the performance of a task carried out in the public
interest or in the exercise of official authority, or in the legitimate interests of a natural or legal person,
provided that the interests or the rights and freedoms of the data subject are not overriding; whereas, in
particular, in order to maintain a balance between the interests involved while guaranteeing effective
competition, Member States may determine the circum~ances in which personal data may be used or
disclosed to a third party in the context of the legitimate ordinary business activities of companies and
other bodies; whereas Member States may similarly specify the conditions under which personal data may
be disclosed to a third party for the purposes of marketing whether carried out commercially or by a
charitable organization or by any other association or foundation, of a political nature for example, subject
to the provisions allowing a data subject to object to the processing of data regarding him, at no cost and
without having to state his reasons;

ar

(,itl

~.'.'.li'

\[

:w

k1

f.~:

JH

m:
j!§

~B
:}~

~

i$)

(31) Whereas the processing of personal data must equally be regarded as lawful where it is carried out in
order to protect an interest which is essential for the data subject's life;

•,I'.,!

;~5

~i)

I
~~}i

~~

~~~

5-~

~
%
~~
~il
01

:w

~~
~~

~~

!q
>1;\:_\

~::

:,~,'

-\:-,

~

:'

I

'~·'

~
~~~

~~·

~~

:~;:

~;;;

s_;.:·
~~<o
:{~

~
:;:~

~f

~:

~-,

{
;

~:

"'
;~~~~~J'

(32) Whereas It is for national legislation to determine whether the controller performing a task carried out
In the public interest or in the exercise of official authority should be a public administration or another
natural or legal person governed by public law, or by private law such as a professional association;
(33) Whereas data which are capable by their nature of infringing fundamental freedoms or privaCy should
not be processed unless the data subject gives his explicit consent; whereas, however, derogations from
this prohibition must be explicitly provided for in respect of specific needs, in particular where the
processing 6f these data is carried out for certain health-related purposes by persons subject to a legal
obligation of professional secrecy or in the course of legitimate activities by certain associations or
foundations the purpose Of which is to permit the exercise of fundamental freedoms;
(34) Whereas Member States must also be authorized, when justified by grounds of important public
interest, to derogate from the prohibition on processing sensitive categories of data where important
reasons of public interest so justify in areas such as public health and social protection - especially in order
to ensure the ClUality and cost-effectiveness of the procedures used for settling claims for benefits and
services in the health insurance system - scientific research and government statistics; whereas it is
· incumbent on them, however, to provide specific and suitable safeguards so as to protect the fundamental
rights and the privacy of individuals;
(35) Whereas, moreover, the processing of personal data by official authorities for achieving aims, laid
down In constitutional law or international public law, of officially recognized religious associations is
carried out 9n Important grounds of public inter~st;
I

(36) Whereas where, in the course of el.ectoral activities, the operation of the democratic system requires
in certain Member States that political parties compile data on people's political opinion, the processing of
such data may be permitted for reasons of important public interest, provided that appropriate safeguards
are established;
,: .·~

&

EUR-Lex- 31995L0046- EN

I
~~~

;~,}
:.--?

'~"•'

;~,:::

I
, "ij

I
~
~

·':·>

i~ ~I
"--·
~-~:~

(37) Whereas the processing of personal data for purposes of journalism or for purposes of literary of
artistic expression, in particular in the audiovisual field, should qualify for exemption from the
requirements of certain prbvisions of this Directive in so far as this is necessary to reconcile the
fundamental rights Of individuals with freedom of information and notably the right to receive and impart
information, as guaranteed in particular in Article 10 of the European Convention for the Protection of
Human Rights and Fundamental Freedoms; whereas Member States should therefore lay down exemptions
and derogations necessary for the purpose of balance between fundamental rights as regards general
measures on the legitimacy of data processing, measures on the transfer of data to third countries and the
power of the supervisory authority; whereas this should not, however, lead Member States to lay down
exemptions from the measures to ensure security of processing; whereas at least the supervisory authority
responsible for this sector should also be provided with certain ex-post powers, e.g. to publish a regular
report or to refer matters to the judicial authorities;
(38) Whereas, if the processing of data is to be fair, the data subject must be in a position to learn of the
existence of a processing operation and, where data are collected from him, must be given accurate and ;
full information, bearing in mind the circumstances of the collection;

(39) Whereas certain processing operations involve data which the controller has not collected directly from
the data subject; whereas, furthermore, data can be legitimately disclosed to a third party, even if the
http://eur-fex.europa,eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

&~.;.

1!.
~-,4
~<.;,

v~::

 '"""~~'-='''''~i.:;;;..~~lf!..$~;;;:::~~~£§~~Qw~«~::0t:;.~~"::~5t&~:;,~:X:i:},!;':,:,R@?..@l:~"'~;.~-r:~-2~:~::'£~J:::~=::::~tj0~~~1;';·r<ll:'~~;::mj

:

l~

):J

-~~~

I~

~
~
~
('?,[::</>

I~

~
~·

~
~

~~

. 3~

~.~~~~
(*i1.·

•

\!~~

~~~-

'

~

I

I

~~
~

~~

0•

ik;~

13/01/2016

m
~~

~

EUR-Lex- 31995L0046- EN

<?.

~
~
f'i
1t

disclosure was not anticipated at the time the data were collected from the data subject; whereas, In all
I
I
these cases, the data subject should be informed when the data are recorded or at the latest when the
data are first disclosed to a third party;

X>~.

;:}~

;>~
0~

[f,

~
~

(40) Whereas, however, it is not necessary to impose this .obli~ati?n of the da~a subje_ct already has the
information; whereas, moreover, there Will be no such obligation 1f the reGordmg or disclosure are
expressly provided for by law or if the provision of information to the data subject proves impossible or
would Involve disproportionate efforts, which could be the case where processing is for historical, statistical
or scientific purposes; whereas, in this regard, the number of data subjects, the age of the data, and any
compensatory measures adopted may be taken into consideration;

~~

~~
~ft!

~~

~

I

f~:

~

(<$

~
~:

~

~
~

®

(41) Whereas any person must be able to exercise the right of access to data relating to him which are
being processed, in order to verify in particular the accuracy of the data and the lawfulness of the
processing; whereas, for the same reasons, every data subject must also have the right to know the logic
involved in the automatic processing of data concerning him, at least in the case of the automated
decisions referred to in Article 15 (1); whereas this right must not adversely affect trade secrets or
intellectual property and in particular the copyright protecting the software; whereas these considerations
must not, however, result iii the data subject being refused all information;

?0

~j

;;l$

\~

~·~

Hj

~~~

!S

~

:8!

~~
~

~

(42) Whereas Member States may, in the interest of the data subject or so as to protect the rights and
freedoms of others, restrict rights of access and information; whereas they may, for example, specify that
access to medical data may be obtait1ed only through a health professional;

)iil
i;J!

~

[~:

~~~l

(43) Whereas restrictions on the rights of access and information and on certain obligations of the
controller may similarly be imposed by Member States in so far as they are necessary to safeguard, for
example, national security, defence, public safety, or impottant economic or financial interests of a
Member State or the Urllon, as well as criminal Investigations and prosecutions and action in respect of
breaches of ethics In the regulated professions; whereas the list of exceptions and limitations should
Include the tasks of monitoring, Inspection or regulation necessary in the three last-mentioned areas
concerning public security, economic or financial interests and crime prevention; whereas the listing of
tasks In these three areas does not affect the legitimacy of exceptioi1s or restrictions for reasons of State
security or defence;

t:d

(44) Whereas Member States rnay also be led, by virtue of the provisions of Community law, to derogate
from the pro~isiohs of t~is Directive concerning.the right of access, the obligation to inform individuals,
and the quality of data, 1n order to secure certam of the purposes referred to abOve;

Ji~
{~
4~

~~

j~l

\t~

!irl

ili
;]
}.1
~

~~
~

~
k~;

1>
ft

~

~

1~
i~

r~
~~

~
~';1

1}l

)(j
i1j
f~

~~
!i1i

~~~~

~i

~
f~_1

i
~
~~

1

~·
~.·,
~-

~
:ill

w

~

I

~

%
~

~

t~
~

~
~

~

~~

~?

~

I~~
*l
;_'s

~

(45) Whereas, in cases where data rni~ht lawfully be processed on grounds of public interest, official
aut~ority or th~ ~egitimate interest: of a natural or ~ega! pe~son, ~ny dat~ su~ject shou~d nevertheless be
entttled, on leg1t1mate and compelling grounds relatmg to hts parttcular sttuatton, to ObJect to the
processing of any data relating to himself; whereas Member States may nevertheless lay down national
provisions to the contrary;

f:~
~~

;:.'
)~'
~~

~

~~

(46) Whereas the protection of the rights and freedoms of data subjects with regard to the processing of
personal data requires that appropriate technical and organizational measures be taken, both at the time of
the design of the processing system and at the time of the processing Itself, particularly In order to
maintain security and thereby to prevent any unauthorized processing; whereas It Is incumbent on the
Member States to ensure that controllers comply with these measures; whereas these measures must
ensure an appropriate level of security, taking into account the state of the art and the costs of their
implementation in relation to the risks inherent in the processing and the nature of the data to be
protected;
(47) Whereas where a message containing personal data is transmitted by means of a telecommunications
or electronic mail service, the sole purpose of which is the transmission of such messages, the controller in
respect of the personal data contained in the message will normally be considered to be the person from
whom the message originates, rather than the person offering the transmission services; whereas,
nevertheless, those offering such ser'vices will normally be considered controllers in respect of the
processing of the additional personal data necessary for the operation of the service;

~~

f!
~:
if

!~\

f,b

~~~

I

[~

\(;

Q;

:,::;

t~'
f

(48) Whereas the procedures for notifying the supervisory authority are designed to ensure disclosure of
the purposes and main features of any processing operation for the purpose of verification that the
operation is in accordance with the national measures taken under this Directive;
(.49) Wherea.s, i_n. ord~r to avoid un:~ita~le admi~istrative formali~ies, exemptions from the ~bligation to 1
notify and stmplificatton of the nottftcatton requtred may be provtded for by Member States m cases where
processing is unlikely adversely to affect the rights and freedoms of data subjects, provided that it is in
accordance with a measure taken by a Member State specifying its limits; whereas exemption or
simplification may similarly be provided for by Member States where a person appointed by the controller
http://eur-fex.europa.eu/LexUriServ/LexUriServ.dc?uri=CELEX:31995L0046:en:HTML

~-

 •
13/01/2016

(~

EUR-Lex • 31995L0046 ·EN

not 11ikely

ensures that the processing carried out is
adversely to affect the rights and freedoms of data
subjects; whereas such a data protection official, whether or not an employee of the controller, must be _in
a position to exercise his functions in complete independence;
·
(50) Whereas exemption or simplification could be provided for in cases of processing operations whose
sole purpose is the keeping of a register intended, according to national law, to provide information to the
public and open to consultation by the public or by any person demonstrating a legitimate interest;
(51) Whereas, nevertheless, simplification or exemption from the obligation to notify shall not release the
controller from any of the other obligations resulting from this Directive;

(52) Whereas, in this context, ex post facto verification 'by the competent authorities must In general be
considered a sufficient measure;
(53) Whereas, however, certain processing operation are likely to pose specific risks to the rights and
freedoms of data subjects by virtue of their nature, their scope or their purposes, such as that of excluding
Individuals from a right, benefit or a contract, or by virtue of the specific use of new technologies; whereas
it is for Member States, if they so wish, to specify such risks in their legislation;
(54) Whereas with regard to all the processing undertaken in society, the amount posing such specific risks
should be very limited; whereas Member States must provide that the supervisory authority, or the data
protection official in cooperation with the authority, check such processing prior to it being carried out;
whereas following this prior check, the supervisory authority may, according to its national law, give an
opinion or an authorization regarding the processing; whereas such checking may equally take place in the
course of the preparation either of a measure of the national parliament or of a measure based on such a
legislative measure, which defines the nature of the processing and lays down appropriate safeguards;
(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide
for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing
must be compensated for by the controller, who may be exempted from liability if he proves that he is not
responsible for the damage, in particular in cases where he establishes fault on the part of the data subject
or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by
private of public law, who fails to comply with the national measures taken under this Directive;
(56) Whereas cross-border flows of personal data are necessary to the expansion of international trade;
whereas the protection of individuals guaranteed in the Community by this Directive does not stand in the
way of transfers of personal data to third countries which ensure an adequate level of protection; whereas
the adequacy of the level of protection afforded by a third country must be assessed in the light of all the
circumstances surrounding the transfer operation or set of transfer operations;
(57) Whereas, on the other hand, the transfer of personal data to a third country which does not ensure an
adequate level of protection must be prohibited;
(58) Whereas provisions should be made for exemptions from this prohibition in certain circumstances
where the data subject has given his consent, where the transfer is necessary in relation to a contract or a
legal claim, where protection of an important public interest so requires, for example in cases of
. international transfers of data between tax or customs administrations or between services competent for
social security matters, or where the transfer is made from a register established by law and intended for
consultation by the public or persons having a legitimate interest; whereas in this case such a transfer
should not involve the entirety of the data or entire categories of the data contained in the register and,
when the register is intended for consultation by persons having a legitimate interest, the transfer should
be made only at the request of those persons or if they are to be the recipients;
(59) Whereas particular measures may be taken to compensate for the lack of protection In a third country
in cases where the controller offers appropriate safeguards; whereas, moreover, provision must be made
for procedures for negotiations between the Community and such third countries;
(60) Whereas, in any event, transfers to third countries may be effected only in full compliance with the
provisions adopted by the Member States pursuant to this Directive; and in particular Article 8 thereof;

(61) Whereas Member States and the Commission, in their respective spheres of competence, must
encourage the trade assoCiations and other representative organizations concerned to draw up codes of
conduct so as to facilitate the application of this Directive, taking account of the specific characteristics of
the processing carried out in certain sectors, and respecting the national provisions adopted for its
implementation;
(62) Whereas the establishment in Member States of supervisory authorities, exercising their functions with
complete Independence, is an essential component of the protection of individuals with regard to the
protessing ofpersonal data;
http://eur-lex.europa.eullexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

;,

 ~~"""'~~F-"'""-"""H%W""""-i1Wirf:<;r""""'"'-'""'""""'";'·[
·n'••:l

I

'

~%:1
~

;

•

~;~

I
~~

~~
~~~j
~~
t\~

~~-

0\)

EUR-Lex- 31995L0046- EN

13/01/2016

~·~~

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of
Investigation and Intervention, particularly in cases of complaints from individuals, and powers to engage
in legal proceedings; whereas such authorities must help to ensure transparency of processing in the
Member States within whose jurisdiction they fall;

~~

I
~;,

0

,y,

~

:\
',:

;''.

t\\.\

~~~

(64) Whereas the authorities in the different Member States will need to assist one another in performing
their duties so as to ensure that the rules of protection are properly respected throughout the European
Union;

(;!>:

~~

~~~

z:.~
\.~i;
>::{\

(65) Where~s, at Community level, a Working Rarty on the Protection of Individuals with regard to the
Processing of Personal Data must be set up and be completely independent in the performance of its
functions; whereas, having regard to its specific nature,'it must advise the Commission and, in particular,
contribute to the uniform application of the national rules adopted pursuant to this Directive;

I

(66) Whereas, with regard to the transfer of data to third countries, the application of this Directive calls
for the conferment of powers of implementation on the Commission and the establishment of a procedure
as laid down in Council Decision 87/373/EEC (1);

~F:

.f.::~

~1~

i;=~

(67) Whereas an agreement on a modus vivendi between the European Parliament, the Council and the
Commission concerning the implementing measures for acts adopted in accordance with the procedure laid
down in Article 189b of the EC Treaty was reached on 20 December 1994;

XCI

(68) Whereas the principles set out in this Directive regarding the protection of the rights and freedoms of
individuals, notably their right to privacy, with regard to the processing of personal data may be
supplemented or clarified, in particular as far as certain sectors are concerned, by specific rules based on
those principles;

,,~

) ~:1

I
~~
X~'-'

~

~:~

(69) Whereas Member States should be allowed a period of not more than three years from the entry into
force of the national measures transposing this Directive in which to apply such new national rules
progressively to all processing operations already under way; whereas, in order to facilitate their costeffective implementation, a further period expiring 12 years after the date on which this Directive is
adopted will be allowed to Member States to ensure the conformity of existing manual filing systems with
certain of the Directive's provisions; whereas, where data contained in such filing systems are manually
processed during this extended transition period, those systems must be brought into conformity with
these provisions at the time of such processing;

t~

''I~

~~

~w.
t~l

~ .:
<·

:iJ')..

~

(70) Whereas it is not necessary for the data subject to give his consent again so as to allow the controller
to continue to process, after the national provisions taken pursuant to this Directive enter into force, any
sensitive data necessary for the performance of a contract concluded on the basis of free and informed
consent before the entry into force of these provisions;

I

I

(71) Whereas this Directive does not stand In the way of a Member State's regulating marketing activities
aimed at consumers residing In territory In so far as such regulation does not concern the protection of
individuals with regard to the processing of personal data;

~@

Jb,

;;ll.,

(72) Whereas this Directive allows the principle of public access to official documents to be taken into
account when implementing the principles set out in this Directive,
HAVE ADOPiED THIS DIRECTIVE:

~

~
il'l
~
h·~

CHAPTER I GENERAL PROVISIONS

m

Object ofthe Directive

!%1

1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of
natural persons, and in particular their right to privacy with respect to the processing of personal data.

Article 1

~~

~Ji

~~

~

2. Member States shall neither restrict nor prohibit the free flow of personal data between Member States
for reasons connected with the protection afforded under paragraph 1.

m

~

~it:§

Article 2

~!

~

I

Definitions
For the purposes of this Directive:

.·'··~

f~i
*)!

.~\1~
.-,.-.!

(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data
subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by

('\j

*~

~1
.,,j

~

m

I

http://eur -lex.europa.eu/LexU riServ/LexU ri Serv .do?uri= CELEX:31995L0046:en:HTM L

-·:·~:

~-~~
;..:-

;~ :~
'{·:~

··::.
;;:·.

lY."

:;,.
:_·,:

(.;:

 ~~~"'.~i?:~..<~~.~?;~~~~~~~,~Q~:;~y...o&;J~~~~«~,~\.0-/i~-;~;:~;:;:":.":':·: :~ ~-~· ~~~::;~·;._···.~~<:"~x;~~1-:~~£t~~s-~.~;;;~~~~~f.~~·~,;;;:~~j.~(~~ 'i3.:"_·'..

:;-·,,! ..~.'-''f.: .~··T·{t3l·:~:.·.~_,;~::!~26;i~:;1:~~R~~;~-~.f{~\X

31•
13/01/2016

EUR-Lex- 31995L0046- EN

reference to an identification number or to one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity;
(b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is
performed upon personal data, whether or not by automatic means, such as collection, recording,
organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c) 'personal data filing system' ('filing system') shall mean any structured set of personal data which are
accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or
geographical basis;
(d) 'controller' shall mean the natural or legal person, public authority, agency or any other body which
alone or jointly with others determines the purposes and means of the processing of personal data; where
the purposes and means of processing are determined by national or Community laws or regulations, the
controller or the specific criteria for his nomination may be designated by national or Community law;
(e) 'processor' shall mean a natural or legal person, public authority, agency or any other body which
processes personal data on behalf of the controller;
(f) 'third party' shall mean any ilatural or legal person, public authority, agenCy or any other body other
than the data subject, the controller, the processor and the persons who, under the direct authority of the
controller or the processor, are authorized to process the data;
(g) 'recipient' shall mean a natural or legal person, public authority, agenCy or any other body to whom
data are disclosed, whether a third party or not; however, authorities which may receive data in the
framework of a particular inquiry shall not be regarded as recipients;
(h) 'the data subject's consent' shall mean any freely given specific and informed indication of his wishes
by which the data subject signifies his agreement to personal data relating to him being processed.
Article 3
Scope

·~

1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and
to the processing otherwise than by automatic means of personal data which form part of a filing system
or are intended to form part of a filing system.
2. lhis Directive shall not apply to the processing of personal data:
- in the course of an activity which falls outside the scope of Community law, such as those provided for
by iitles V and VI of the Treaty on European Union and in any case to processing operations concerning
public security, defence, State security (il'lcluding the economic well-being of the State when the processing
operation relates to State security matters) and the activities of the State In areas of criminal law,
- by a natural person In the course of a purely personal or household activity.
Article 4
National law applicable

.,
,::.·1

\.:!
\\i
·..-:~
~~·

1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the
processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller on the
territory of the Member State; when the same controller is established on the territory of several Member
·States, he must take the necessary measures to ensure that each of these establishments complies with
the obligations laid down by the national law applicable;

~

ill

I
I
~

~

~

(b) the controller is not established on the Member State's territory, but in a place where its national law
applies by virtue of international public law;
(c) the controller is not established on Community territory and, for purposes of processing personal data
makes use of equipment, autol'liated or Otherwise, situated on the territory of the said Member State,
unless such equipment is used only for purposes of transit through the territory of the Community.
2. In the circumstances referred to in paragraph 1 (c), the controller must designate a representative
established in the territory of that Member State, without prejudice to legal actions which could be
initiated against the controller himself.

h

ill

I
~
~

~N
rifi

~

~

i~~f
~

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

:::-:

 ~~«,~=·~"'~.!'.!&:S~A»»z-Xf~-'w;»~~~~:;;:;:::"{~~~~~~0)~\.Y~ffi"~~~~~~~·;~~,~::l~~~~~~~~i,~~~%:~~~(").[~,~·

~

I
~

~

.

.IZ;

.

3g

\

'

b
I~

~

,

~~k-

•

.

.

~-.

l-,

/
JV

"

tt).;

t;_·._._·

t~

w
~~';
~

:~

13101/2016

EUR-Lex- 31995L0046- EN

~·

CHAPTER II GENERAL RULES ON THE LAWF~LNESS OF THE PROCESSING OF PERSONAL DATA

~

Article 5

·~\!\

~

Member States shall, within the limits of the provisions of this Chapter, determine more precisely the
conditions under which the processing of personal data is lawful.

~i
~

~

~i
~~

!'-'-

t~
r~

~

~

SECTION I

~

I

PRINCIPLES RELATING TO DATA QUALITY

~~6

~

~
I
=

.

1. Member States shall provide that personal data must be:

~

[~

(a) processed fairly and lawfully;

:U

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible
with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be
considered ~s incompatible provided that Member States provide appropriate safeguards;

:--

~11

~~l

lil}l

t.

,..,r1

y)'J

()i

(c) adequate, relevant and not excessive in relation to the purposes for which they are collected arldfor
further processed;

'\';·l

WJ
r~

ii:)
~)
~
r~
~$1

ii.d

i!JI
~-:1

~~
~~~
i~~
J·.,

1i!

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the
purposes for which the data were collected or for which they are further processed. Member States shall
lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or
scientific use.

SECTION II

{~

<~

~~

(b) processing is necessary for the performance of a contract to which the data subject is party or in order
to take Steps at the request of the data subject prior to entering into a contract; or

~~

1it,~~:
~l

~
.,~1~-

ir.
m
~~~
~'1i

:~t.;l

i
;,,,'{

(c) processing is necessary fOr compliance with a legal obligation to which the contrOller is subject; or

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by the
third party or parties to whotn the data are disclosed, except where such Interests are overridden by the
Interests for fundamental rights and freedoms of the data subject which require protection under Article 1
(1).

SECTION III
SPECIAL CATEGORIES OF PROCESSING
Article 8

1. Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning
health or sex life.

2. Paragraph 1 shall not apply where:

t)~

%~

il'j

II
~

!j

(·:. ~

;r/

(e) processing is necessary for the performance of a task carried out in the public interest or in the
exercise of official authority vested In the controller or in a third party to whom the data are disclosed; or

J~:~
;~i

·~~· ~

:::--··

The processing of special categories of data

·~

I~:r,

(d) processing is necessary in order to protect the vital interests of the data subject; or

;('I'

~-"-'
~\':l

'..-

~~~·

!11
j_

~~
!0:0"

',1""

Member States shall provide that personal data may be processed only if:
(a) the data subject has unambiguously given his consent; or

!:.~

~: .
:·,·

•i:~·

~~

(1-;J

;~-

··;;.:·-

Article 7

~~-~

('

2. It shall be for the controller to ensure that paragraph 1 is c6tnplied with.

CRITERIA FOR MAKING DATA PROCESSING LEGITIMATE

7~

"l

';i"

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that
data which are inaccurate or incomplete, having regard to the purposes for which they were collected or
for which they are further processed, are erased or rectified;

~1
~{~

,,;

hftp://eur-lex.europa.euiLexUriServ/LexUriServ.do?uri=CELEX:31995LOb46:en:HTML

WJ

r;~~
~~~

(::;.;

~:;:

 ~~~~x~·--~:M~~···--···

, .. :: :~.·~~~~~;r~~J~2~~~~~

~

~

I

I

~

•

~~

$

-~
I~

~
~

~~~

'
~-

1

~

EUR-Lex • 31995L0046 ·EN

13/01/2016

~~

~
1~
~

~
~

m.
·~

~

w
~

~

~

~
~­
~

~1

~
~

~

~

~

~~
II
~
~

~

~

~
~

~.:
-~
~

y

~

~

~
M

*~~

•~
~.~

~

h.l

~~

~

I

(d) processing is carried out in the course of its legitimate activities with appropriate guarantees by a
foundation, association or any other non-profit-seeking body with a political, philosophical, religious or
trade-union aim and on condition that the. processing relates solely to the members of the body or to
persons who have regular contact with it in connection with its purposes and that the data are not
disclosed to a third party without the consent of the data subjects; or
(e) the processing relates to data which are manifestly made public by the data subject or is necessary for
the establishment, exercise or defence of legal claims.

4. Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public
interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by
decision of the supervisory authority.
5. Processing of data relating to offences, criminal convictions or security measures may be carried out
only under the control of official authority, or if suitable specific safeguards are provided under national
law, subject to derogations which may be granted by the Member State under national provisions providing
suitable specific safeguards. However, a complete register of criminal convictions may be kept only under
the control of official authority.
Member States may provide that data relating to administrative sanctions or judgements in civil cases
shall also be processed under the control of official authority.
6. Derogations from paragraph 1 provided for in paragraphs 4 and 5 shall be notified to the Commission.
7. Member States shall determine the conditions under which a national identification number or any other
Identifier of general application may be processed.
Article 9
Processing of personal data and freedom of expression
Member States shall provide for exemptions or derogations from the provisions of this Chapter, Chapter IV
and Chapter VI for the processing of personal data carried out solely for journalistic purposes or the
purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with
the rules governing freedom of expression.

SECTION IV
INFORMATION TO BE GIVEN TO THE DATA SUBJECT
Article 10
Information in cases of collection of data from the data subject

~

Member States shall provide that the col1troller or his representative must provide a data subject from
whom data relating to himself are collected with at least the following information, except where he
already has it:

r.,.,.,

(a) the identity of the controller and of his representative, if any;

:t~i

(b) the purposes of the processing for which the data are intended;

~

~

;·,i

·;::l

(c) any further information such as

~ i.~

l.)
.: ~ ~

·,\~~

~~~

I
ii1•i

i.~rl

~
~

s

~~

~:~

;:}
~.::

;~'~

§

:t
~:~

~~·:

.:-:

f:;(;··

•, .•

::~~

z~~

v:
\:-,::

~g

~!
~(;

;:;~

~;:
X:"

3. Paragraph 1 shall not apply where processing of the data is required for the purposes of preventive
medicine, medical diagnosis, the provision of care or treatment or the management of health·care services,
and where those data are processed by a health professional subject under national law or rules
established by national competent bodies to the obligation of professional secrecy or by another person
also subject to an equivalent obligation of secrecy.

@
~

w
~

~

<•

.'<";

(c) processing is necessary to protect the vital interests of the data subject or of another person where the
data subject is physically or legally incapable of giving his consent; or

~

~

(,''
'\:~

(a) the data subject has given his explicit consent to the processing of those data, except where the laws
of the Member State provide that the prohibition referred to In paragraph 1 may not be lifted by the data
subject's giving his consent; or

~

~
0

~

"'

(b) processing is necessary for the purposes of carrying out the obligations and specific rights of the
controller in the field of employment law in so far as it is authorized by national law providing for
adequate safeguards; or

~

~

http://eur-lex .europa.eu/LexU ri Serv/LexU ri Serv.do?uri =CELEX:31995L0046:en: HTM L

E;
?~·

~:~
~-6

tt

~~

 ~~
_" " ; <»Y<\)i!<'&*'-'1:~0~~,;:_~:;:§;0?J::};\";.;;;~·:~~~~;{:'::f&;;"~i~~'.{.::.,.::;s;::_~~~~·::,.;:::(~lf«-'i::'~'X~~i':"liird~;~~>l1§:i::Br#'-,:c',;~'jt£
~~"~•--~>~<~ """"
:u;,;_, ~ • ;()a _0:}, 'J:J!X-.,'::'J~,-,- ~r

.

:~.

'

.._. . , .

•

w-

I

)\

I"'~55
~
~

lf

~
~

~~

~

~

t~
;'~:

1

.

I

'.~IJ
~~
~

13101/2016

1tJa

EUR-Lex • 31995L0046 ·EN

·the recipients or categories of recipients of the data,

m

.~hether replies to the questions are obligatory or voluntary, as well as the possible consequences of

~j

fa1lure to reply,

[~

~~

~

~;;~

~i

1
<;s

~-

!il ,

in so far as such further Information is necessary, having regard to the specific circumstances In which the
data are collected, to guarantee fair processing In respect of the data subject.

iM
~;

€'~

Article 11

~~j

Information where the data have not been obtained from the data subject

~

1
~~~

~

~~.

~

~~

~

~§

\~j
l~ii

1. Where the data have not been obtained from the data subject, Member States shall provide that the
controller or his representative must at the time of undertaking the recording of personal data or if a
disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide
the data subject with at least the following information, except where he already has it:

g

jf~

(a) the identity of the controller and of his representative, if any;

~!A

\~

~

~
fi·!

~

.

(b) the purposes of the processing;

~g:
t~
~

~
~
[
~.~:

:~~

(c) any further information such as

~

- the categories of data concerned,

\~~~

-the recipients or categories of recipients,

~j~

·the existence of the right of access to and thJ right to rectify the data concerning him

5··

In so far as such further Information is necessary, having regard to the specific circumstances in which the
data are processed, to guarantee fair processing in respect of the data subject.

f'.i

~
i·:·l

ti
Jt]
i~•~

:j~

·. ~.:l

~~tl
·~?l

~
~~

fil

2. Paragraph 1 shall not apply where, in particular for processing for statistical purposes or for the purposes
of historical or Scientific research, the provision of such information proves impossible or would involve a
disproportionate effort or if recording or disClosure is expressly laid down by law. In these cases Member
States shall provide appropriate safeguards.
SECfiON V
THE DATA SUBJtCT'S RIGHT OF ACCESS TO DATA

Article 12

~

Right of access

I~

Member States shall guarantee every data subject the right to obtain from the controller:

~~

·confirmation as to whether or not data relating to him are being processed and information at least as to
the purposes of the processing, the categories of data concerned, and the recipients or categories of
recipients to whom the data are disclosed,

~}

• communication to hini in an intelligible form of the data undergoing processing and of any available
information as to their source,

~

~

;>:··

f~~

~

i:-:;J

.-...-.

~. ·
~

..li

~

0

(a) without constraint at reasonable intervals and without excessive delay or expense:

-knowledge of the logic involved in any automatic processing of data concerning him at least in the case
of the automated decisions referred to in Article 15 (1);
(b) as appropriate the rectification, erasure or blocking of d;;~ta the processing of which does not comply
with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the
data;
(c) notification to third parties to whom the data have been disclosed of any rectificatiOI\ erasure or
blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate
effort.

m

~

SECTION VI

~

EXEMPTIONS AND RESTRICTIONS

l

~

'H

r~

{
:-,~~~
)<~,
h

~

'

{-.~.

~;,i

:;:,;'~

~{t

I
~;
~%'

~~J
/'(.

iNl
m
~

~

.. -.

:•..=:

i

I

cc;,;-;
.:,:

w

fi

::::-s
o-.:=

[~

~~~~
..
~

:·,
~-; ':

<~~
):.''

r,:-~.
~ ·:· ,_:

(!-(

!:~~~~
\--~!:

http://eur-lex.europa.eu'LexUriServ/LexUriServ .do?uri=CELEX:31995L0046:en:H TM L

~

~::::-i

0

{,-:.

~

;
~

I
r~m··
--~··.
8,1.
·. - :.~
--~
?,:":
"
,..v, •"..j'
'\

I
~~

1~~

r

~

@

-the existence of the right of access to and the right to rectify the data concerning him

~

J!@.

~

 -.'

~

~~

·~:

•

Ji~

~

EUR-Lex • 31995L0046 ·EN

13/01/2016

~·~

){)\

Article 13

;.~i~
.,,~

~1
:(~
't-'l

Exemptions and restrictions

~~~

~rJ

~J

-~,?,:;
··l

.;.;~

~

I
~
I

1. Member States may adopt legislative measures to restrict the scope of the obligations and rights
provided for in Articles 6 (1), 10, 11 (1), 12 and 21 when such a restriction· constitutes a necessary
measures to safeguard:
(a) national security;
(b) defence;
(c) public security;

~

(d) the prevention, Investigation, detection and prosecution of criminal offences, or of breathes of ethics
for regulated professions;

~~'"'

(e) an important economic or financial interest of a Member State or of the European Union, including
monetary, budgetary and taxation matters;

~l
~(i

~~1

~~

(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official
authority in cases referred to in (C) 1 (d) and (e);

,,·,

~

~~0

~

~

~

m
~
'·~l' '

~~

I

rj

(g) the protection of the data subject or of the rights and freedoms Of others.
2. Subject to adequate legal safeguards, in particular that the data are not used for taking measures or
decisions regarding any particular individual 1 Member States may/ where there is clearly no risk of
breaching the privacy of the data subject, restrict by a legislative measure the rights provided for in Article
12 when data are processed solely for purposes of scientific research or are kept in personal form for a
periOd which does not exceed the period necessary for the sole purpose of creating statistics.

SECiiON VII
THE DATA SUBJEct'S RIGHT TO OBJECT
Article 14

~
~

The data subject's right to object

~

Member States shall grant the data subject the right:

.~~
~

~

rn
M
.!~

I~

I
~

~
~

~

~
~~

~

~~
~

~

~m
~

~

~

~~

I
~

~

~

;
\.
~

~

~
~~
~
~-

~

11

~ ·I·

M
~M

~'
~

(a) at least in the cases referred to in Article 7 (e) and (f), to object at any time on compelling legitimate
grounds relating to his particular situation to the processing of data relating to hiin, save where otherwise
provided by national legislation. Where there is a justified objection, the processing instigated by the
contrOller may no longer involve those data;
(b) to object, on requeSt and free of charge 1 to the processing of personal data relating to him which the
cbntroller anticipates being processed for the purposes of direct marketing, or to be informed before
personal data are disclosed for the first time to third parties or used on their behalf for the purposes of
direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses.
Member States shall take the necessary measures to ensure that data subjects are aware of the existence
of the right referred to in the first subparagraph of (b).
Article 15
Automated individual decisions

1. Member States shall grant the right to every person not to be subject to a decision which produces legal
effects concerning him or significantly affects him and which is based solely on automated processing of
data intended to evaluate certain personal aspects relating to him, such as his performance at work,
creditworthiness, reliability, conduct, etc.
2. Subject to the other Articles of this Directive, Member States shall provide that a person may be
subjected to a decision of the kind referred to in paragraph 1 if that decision:
(a) is taken in the course of the entering into or performance of a contract, provided the request for the
entering into or the performance of the contract, lodged by the data subject, has been satisfied or that
there are suitable measures to safeguard his legitimate interests, such as arrangements allowing him to
put his point of view; or
(b) is authorized by a law which also lays down measures to safeguard the data subject's legitimate
http:/leur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995LOD46:en:HTML

(I"

 \JJ)-EUR-Lex- 31995L0046- EN

13/01/2016

~~--------------------------~----------~

Interests.

SECTION VIII
CONFIDENTIALITY AND SECURITY OF PROCESSING
Article 16
Confidentiality of processing
Any person acting under the authority of the controller or of the processor, including the processor himself,
who has access to personal data must not process them. except on instructions from the controller, unless
he is required to do so by law.
Article 17
Security of processing
1. Member States shall provide that the controller must implement appropriate technical and organizational
measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration,
unauthorized disclosure or access, in particular where the processing Involves the transmission of data over
a network, and against all other unlawful forms of processing.

Having regard to the state of the art and the cost of their implementation, such measures shall ensure a
level of security appropriate to the risks represented by the processing and the nature of the data to be
protected.
2. The Member States shall provide that the controller must, where processing is carried out on his behalf,
choose a processor providing sufficient guarantees in respect of the technical security measures and
organizational measures governing the processing to be carried out, and must ensure compliance with
those measures.
3. The carrying out of processit'lg by way of a processor must be governed by a Contract or legal act
bitlding the processor t6 the Cbntroller aM stipulating in particular that:

:-.~·1
~-·~

- the processor shall act only on instructions from the controller,

,_:;

- the obligations set out ir\ paragraph 1, as defined by the law of the Member State in which the processor
Is established, shall also be incumbent on the processor.

.::·~·:i

:.':':i
.': -~

4. For the purposes of keeping proof, the parts of the contract or the legal act relating to data protection
and the requirements relating to the measures referred to in paragraph 1 shall be in writing or in another
equivalent form.

?:·:

:. !

::)
:·\;
:';

SECriON IX

i

:~i
··:.!
:;... )

NOTIF:ICATION
Article 18

·:·.:

Obligation to notify the supervisory authority

1. Member States shall provide that the controller or his representative, if any, must notify the supervisory
authority referred to in Article 28 before carrying out any wholly or partly automatic processing operation
or set of such operations intended to serve a single purpose or several related purposes.

}j
(( ~·
·:~.

:~·~

2. Member States may provide for the simplification of or exemption from notification only in the
following tases aM under the following conditions:

~\S

<.11 ~

;!~

- where, for categories of processing operations which are unlikely, taking ·account .of the data to be
processed, to affect adversely the rights and freedoms of data subjects, they specify the purposes of the
processing, the data or categories of data undergoing processing, the category or categories of data
subject, the recipients or categories of recipient to whom the data are to be disclosed and the length of
time the data are to be stored, and/or

tlj
t.;,.l

Jf
:1i)

:~li
i~{J

--:~~

- where the controller, in compliance with the national law which governs him, appoints a personal data
protection official, respbrisible in particular:

~-~1

l~
~!

- for ensuring in an independent manner the internal application of the national provisions taken pursuant
to this Directive

iil

-for keeping the register of processing operations carried out by the controller, containing the items of

~

,';•;

;~

http://eur -lex.europa.eu/LexU riServ/LexU ri Serv .do?uri= CELEX:31995L0046:en: HTM L

~1

~

~)~

~~

tRi

l
I

'

l

 ~~"""""'"''*"'"""''"'~"""""==}l@'C'i'''''"%;;o%K'i4"'>0%l!'-£Ci'1l"''""Nt~~\S'J>JY:~:c;;%;;c;~

i;H

t··

.~:·~:~

f.

:'?:_ .•

c:.:;'

f~·:~

~
-~~~

I
\~g~

P.~~

\?)
EU R-Lex • 31995L0046 • EN

13101/2016

--~--------------~~----~----------------------------------,

information referred to in Article 21 (2),

'

~;r

thereby ensuring that the rights and freedoms of the data subjects are unlikely to be adversely affected by
the processing operations.

~,

3. Member States may provide that paragraph 1 does not apply to processing whose sole purpose is the
keeping of a register which according to laws or regulations is intended to provide information to the
public and which is open to consultation either by the public in general or by any person demonstrating a
legitimate Interest.
'

i~

~1~

&~

·'li'''

'~~

~

~
~

.

{~

t~

~~

I
~~~

4. Member States may provide for an exemption from the obligation to notify or a simplification of the
notification in the case of processing operations referred to in Article 8 (2) (d).

Contents of notification

~~~

~~

,,@~~
i'·

[j
·~

~~
~~

(c) a description of the category or categories of data subject and of the data or categories of data relating
to them;
(d) the recipients or categories of recipient to whom the data might be disclosed;
(e) proposed transfers of data to third countries;
(f) a gerteral description allowing a preliminary assessment to be made of the appropriateness of the
measures taken pursuant to Article 17 to ensure security of processing.
2. Mernber States shall specify the procedures under which any change affecting the information referred
to in paragraph 1 must be notified to the supervisory authority.
Article 20

iii

Prior checking

m
~

I

I
)}~

it'

~~
~~~

~),

1. Member States shall determine the processing operations likely to present specific risks to the rights and
freedoms of data subjects and shall check that these processing operations are examined prior to the start
thereof.
2. Such prior checks shall be carried out by the supervisory authority following receipt of a notification
from the c6ntr61ler or by the data protection official, who, in cases of doubt, must consult the supervisory
authority.
3. Member States may also carry out such checks in the context of preparation either of a measure of the
national parliament or of a measure based on such a legislative measure, which define the nature of the
processing and lay down appropriate safeguards.

:~j

Article 21

Ki

Publicizing of processing operations

~l
~

1. Member States shall take measures to ensure that processing operations are publicized.

~~
P"
~~~

2. Member States shall provide that a register of processing operations notified In accordance with Article
18 shall be kept by the supervisory authority.

~J

;.~

-~~

~~~

~~
~~
~~

·~~.... J
I&,
~l
lXi

%~

-~J

f;)

~]
~-~

r,g

~~

®1
r''
fi$

I!/'

·~

I
,1},

'····.
~ ·:~
_;.

&·j
~{!\

;"-.

1. Member States shall specify the information to be given in the notification. It shall include at least:

(b) the purpose or purposes of the processing;

~~:~

.

Article 19

?.~

~.

~:~.=,

~~--

(a) the name and address of the controller and of his represer\tative, if any;

;;l'ii

(,.,

5. Member States may stipulate that certain or all non-automatic processing operations involving personal
data shall be notified, or provide for these processing operations to be subject to simplified notification.

~~
'H,Ji

t~

(:

c;~~
:;.;';:·
~::~

The register shall contain at least the information listed in Article 19 (1) (a) to (e).
The register may be inspected by any person.
3. Member States shall provide, in relation to processing operations not subject to notification, that
controllers or another body appointed by the Member States rnake available at least the information
referred to in Article 19 (1) (a) to (e) In an appropriate form to any person on request.
Member States may provide that this provision does not apply to processing whose sole purpose is the
http://eur-I ex.europa.eu/LexU ri Serv/Lexu rl Serv .do?uri::; CELEX:31995L0046:en:H TM L

'5..··~

~>
~.:·

i,, ~

 1

A

j

'~
~

<~'J

I.
"·.

~

~

EUR-Lex- 31995L0046- EN

13/01/2016

I

keeping of a register which according to laws or regulations is intended to provide information to the
public and which is open to consultation either by the public in general or by any person who can provide
proof of a legitimate interest.

~ll
:,1.

m

I

CHAPTER III JUDICIAL REMEDIES, LIABILITY AND SANC110NS
Article 22
Remedies

~
~

Without prejudice to any administrative remedy for which provision may be made, inter alia before the
supervisal'( authority referred to in Article 28, prior to referral to the judicial authority, Member States
shall provide for the right of eveiY person to a judicial remedy for any breach of the rights guaranteed him
by the national law applicable to the processing in question.

~
%

~

~~

~

~

Article 23

I

Liability

~

1. Member States shall provide that any person who has suffered damage as a result of an unlawful
processing operation or of any act incompatible with the national provisions adopted pursuant to this
Directive is entitled to receive compensation from the controller for the damage suffered.

~
.•.

, ~.~

;,:~~

2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not
responsible for the event giving rise to the damage.

-:-:.
:-:::·~

~

Article 24
Sanctions

~~1

The Member States shall adopt suitable measures to ensure the full implementation of the provisions of
this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the
provisions adopted pursuant to this Directive.

i*1
·~~~

CHAPTER IV TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

,.,~

~~~

Article 25

,t (~

.,,:~~l

Principles

{:;~

/···'

1. The Member States shall provide that the transfer to a third country of personal data which are
· undergoing processing or are intended for processing after transfer may take place only if, without
prejudice to compliance with the national provisions adopted pursuant to the other provisions of this
Directive, the third country in question ensures an adequate level of protection.

0

j
~

~

~

~

w
~
8

w
~i ~ ~

~

~

v
,·,.·

~

;:1

~
~

~
~

2. The adequacy of the level of protection afforded by a third counttY shall be assessed in the light of all
the circumstances surrounding a data transfer operation or set of data transfer operations; particular
consideration shall be given to the nature of the data, the purpose and duration of the proposed processing·
operation or operations, the country of origin and country of final destination, the rules of law, both
general and sectoral, in force in the third country in question and the professional rules and security
measures which are complied with in that country.
3. The Member States and the Commission shall inform each other of cases where they consider that a
third country does not ensure an adequate level of protection within the meaning of paragraph 2.
4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country
does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member
States shall take the measures necessary to prevent any transfer of data of the same type to the third
country in question.

::::

~<~

/i

~

.,:i
t~!

.~:.=;

;~
;~

5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the
situation resulting from the finding made pursuant to paragraph 4.
6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third
country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by
reason of its domestic law or of the international commitments it has entered into, particularly upon
conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic ;
freedoms and rights of individuals.
Member States shall take the measures necessal'( to comply with the Commission's decision.

,,

~
)
)

•'>

il~

k~
~.
Ill.

(/~

~

~~

~~

ffl
~-s~

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

~--·
;.~-

 m:~~~~mi&.ll~*-·;;;;v:<&.-*"~~~===·-

)?b
#
~-

•-

. --.- ·

.,. . ~

-~-w&~.&~~~~:m:~~!:~~~>;x~"~?:«::=~-il~~~t~till)~l:?~~:~~~'):~~?x::~a~~1%-t~ZX~:~«~s~

'

~:
~

~

f

~J

I
~

•
I

I

~

t:

~

itl

•

:1:

J,,-1

k\

1""1/2016

~~.:l
C'l'1

I.

~~

~

EU R-"" - 31995lll046 - EN

Article 26

'

I

i:
'

Derogations

~~
!itj
~\

1. By way of derogation from Article 25 and save where otherwise provided by domestic law governing
particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a
third country which does not ensure an adequate level of protection within the meaning of Article 25 (2)
may take place on condition that:

l;\)~.

#~:

~~
~v·

·~~:."il.·,j
~~

(a) the data subject has given his consent unambiguously to the proposed transfer; or

~~

~'m

~

(b) the transfer is necessary for the performance of a contract between the data subject and the controller
or the implementation of precontractual measures taken in response to the data subject's request; or

~'~

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the
data subject between the controller and a third party; or

~}~1
~~~~ .....

}'n
'J«
~~

~

I

(d) the transfer is necessary or legally required on important public interest grounds, or for the
establishment, exercise or defence of legal claims; or
(e) the transfer is necessl:lry in otder to protect the vital interests of the data subject; or

~

(f) the transfer is made from a register which according to laws or regulations is intended to provide

r.~

information to the public and which is open to consultation either by the public in general or by any person
who tan demonstrate legitimate interest, to the extent that the conditions laid down in law for
consultation are fulfilled in the particular case.

tm
~r~

~~

~1~
~~~~

2. Without prejudice to paragraph 1, a Mernber State may authorize a transfer or a set of transfers of

~~lo•"

personal data to a third country which does not ensure an adequate level of protection within the meaning
of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the
privacy and fundamental rights and freedoms of individuals and as regards the exercise of the
corresponding rights; such safeguards rnay in particular result from appropriate contractual clauses.

~~~~~

r.Pil

fu
~;~1

3. The Member State shall inform the Commission and the other Member States Of the authorizations it

f.?J

grants pursuant to pCiragraph 2.

~"'1

$'-

~
~i~

~ :,t;

If a Member State or the Commission objects on justified grounds involving the protection of the privacy
and fundamental rights and freedoms of individuals, the Commission shall take appropriate measures in
accordance with the procedure laid down in Article 31 (2).

,,~

Member States shall take the necessarY measures to comply with the Commission's decision.

·,'

>:;_

:~~~~
~

~

~

~

~
g
~

l'

~

I
~

~
i

~
~

~

~·

~
;-.,
,.
,_-,-

',

(

4. Where the Commission decides, In accordance with the procedure referred to in Article 31 (2), that
certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States

h

shall take the necessary measures to comply with the Commission's decision.

i
~

~

CHAPTER V CODES OF CONDUCT

~~

Article 27

b
~

1. The Member States and the Commission shall encourage the drawing up of codes of conduct intended to
contribute to the proper implementation of the national provisions adopted by the Mernber States pursuant
to this Directive, taking account of the specific features of the various sectors.

~

2. Member States shall make provision for trade associations and other bodies representing other
categories of controllers which have drawn up draft national codes or which have the intention of
amending or extending existing national codes to be able to submit them to the opinion of the national
authority.

~

I
~~

~

l

Member States shall make provision for this authority to ascertain, among other things, whether the drafts
submitted to It are In accordance with the national provisions adopted pursuant to this Directive. If It sees
fit, the authority shall seek the views of data subjects or their representatives.

I

3. Draft Cornmunity codes, and amendments or extensions to existing Community codes, may be
submitted to the Working Party referred to in Article 29. This Working Party shall determine, among other

~
~

things, whether the drafts submitted to it are in accordance with the national provisions adopted pursuant
to this Directive. If it sees fit, the authority shall seek the views of data subjects or their representatives.'
The Commission may ensure appropriate publicity for the codes which have been approved by the Working
Party.

:.·:;;'

~·c:~

T1

.-1

q~~

CHAPTER VI SUPEiMSORY AUTHORITY AND WORKING PARTY ON THE PROTECTION OF INDIVIDUALS

!~j

~~~

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML

i>)l

~~

t~

)~

]f,

l
"

.

.'..·

f~:
/"'

(,,

 ®

~~~~-'/.;~;_;~)t~?f~¥~~-V<X•»-_"-<M~~;o;",."'~~~@_-«W•~•",A•)!•><:":•::.'"'·~~-9~'-

,·I

:~t.w':u.'LkYi~~"X~'v~;.~M~~:Nir.,'iJl

•

-

5". -..-.~_,:.t.~~-~·"Z""""-"•~•

~;J"~j-~~;{.;:-,:-:~:t.~;;..:v~%~X>:''i.'O\{\'J.b..':~\:"?,!!.~Y.•"ffC,.~'<?,.~_...(,>~(."00';;~~"'N,-:".'~r-'\M~~V.VJGr•.t~ •N'.!-<(;(~

./\."..'\....<...>...•·-~' ~-·"• -~'"--''-· ···"-"Xx,..,u\1'.."- Y,f,.v..'V.X)('o.~{l'3.~1'/h:UI~,h•-•'··'~:.r~-'-'

,>r;:",.."" ,)=;'-•.<,.".•:•.••.C~t..,.=.•f,.'~X"W~'¢-/-J;-;\R•~~

~

~

~

p"{

Y.H

~

~
·1·;1

~

.

X;

·~

I

~

N

~

~

~

~

A.~

:~if
"'""' '

~

. \~
cb

[1

w
«·
..

.

i

'

~
~;..;;:.

,..;;

~
-'c
~
A

A
~

~

13/01/2016

~

~

EUR-Lex- 31995L0046- EN

~

wtTH REGARD TO THE PROCESSING OF PER'SONAL DATA

Iij1

Article 28

~

~~
~'

w

til~

Supervisory authority

~·

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the
application within its territory of the provisions adopted by the Member States pursuant to this Directive.

$

~t

These authorities shall act with complete Independence in exercising the functions entrusted to them.

W

Uf:!

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up

~

~~:

administrative measures or regulations relating to the protection of individuals' rights and freedoms with
regard to the processing of personal data.

·~~

3. Each authority shall in particular be endowed with:

I~~
~

;;~;:

~

~

~
ffi
~

1

~~

;t
~

~
~

*~
~

~~j
~~1
~
~'.;,,

- investigative powers, such as powers of access to data forming the subject-matter of processing

gj

-effective powers of intetvention, such as, for example, that of delivering opinions before processing
operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such
opinions, of. ordering t~e blocking, e~as.ure or destruction of data, of im~sing a temporary or ?efinitive ban
on processing, of warning or admoniShing the controller, or that of refernng the matter to nat1onal
parliaments or other political institutions,

tN

-the power to engage in legal proceedings where the natiorial provisions adopted pursuant to this
Directive have been violated or to bring these violations to the attention of the judicial authorities.

t'w_

~

f%

~J!
l~

~~

lei

81·

((;:

~D
~

;*~~

~

il~
(~

~~

~Ji .

operations and powers to collect all the inforr·nation necessary for the perforrnance of its supetvisory
dt'
u 1es,

Decisions by the supervisory authority which give rise to complairits may be appealed against through the

~

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that
petsOn, concerning the protection of his rights and freedoms in regard to the processing of personal data.
The person concerned shall be informed of the outcome of the claim.

~ear

th~

~ata

~~;

~~

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall
l)e made public.

m
~;~

~l

~t
ll.~

~

~~

i11
~

~~1n,,.

6. Each supei'VIsory authoritY is competent, whatever the national law applicable to the processing in
q~estlon, to exercise, on the territory of its own Member State, the powers conferred o~ it in accordance
w1th paragraph 3. Each authority may be requested to exercise Its powers by an authdnty of another
Member State.
· The supervisory authorities shall cooperate with one another to the extent necessary for the performance
of their duties, in particular by exchanging all useful information.

~

~

Article 29

~~

Working Party on the Protection of Individuals with regard to the Processing of Personal Data

·':.

1. A Working Party on the Protection of Individuals with regard to the Processing of Personal Data,
hereinafter referred to as 'the Working Party', is hereby set up.

~t.'l

..._.,

/~:::(
\)

It shall have advisory status and act independently.

;')
1f~
:-:;1

i{J

2. the Working Party shall be composed of a representative of the supervisory authority or authorities
designated by each Member State and of a representative of the authority or authorities established for
the Community Institutions and bodies, and of a representative of the Commission.

~J~~

'}~

.:~f.~l
~:;::

f:j
i~J

m
~t!il
~rn

I

~~

)j

~&;

~'(

;~~:

~~
~

~

ii'!

(0
~~·

~~~

~~-

slE
~
:~~

i~

()~
f<:

r~:
9:~
r,·,:
~~ ·:·

?J~
~~~:
~=:.{
~~-

;.9

y~

~

:::::

7. Member States shall provide that the members and staff of the supervisory authority, everi after their
employment has ended, are to be subject to a duty of professional secrecy with regard to confidential
information to which they have access.

'~~~

~
·:-::;

;~;~

I

Each supervisory authority shall, in particular,.
claims for checks on
lawfulness .of
processing
lodged by any person when the nat1onal prOVISIOns adopted pursuant to ArtiCle 13 of th1s Dm'!Ctlve apply.
The person shall at any rate be informed that a check has taken place.

it~

'i~

}/r

Each member of the Working Party shall be designated by the institution, authority or authorities which he
represents. Where a Member State has designated more than one supervisory authority, they shall
http://eur-lex.europa.eu/LexU riServ/LexU ri Serv .do?uri= CELEX:31995L0046:en:H TM L

}:?,
~~i'

 •.a·
~ii··

.

,.,i

.

~~.~.!'\
··~

~

I

i

~

I

I

~

~

~

~

A

T~·~

i~
~

~

~~
~~]

\~

•
13101/2016

EUR-Lex- 31995L0046- EN

~. ~.

;~.,~.·
~
*~
~

nominate a joint representative. The same shall apply to the authorities established for Community
institutions and bodies.

!~

~.t.'.·

.

3. The Working Party shall take decisions by a simple majority of the representatives of the supervisory
't'
auth on~~

r,;;,
~

4. The Working Party shall elect its chairman. The chairman's term of office shall be two years. His

~

m
~~

appointment shall be renewable.

;;;s

5. The Working Party's secretariat shall be provided by the Commission.

~
lf=:

6. The Wo~king Party shall adopt Its own rules bf procedure.

::.~·

7. The Working Party shall consider items placed on its agenda by its chairman, either on his own initiative
or at the request of a representative of the supetvlsory authorities or at the Commission's request.

~:;:

~~

~

t*
~~

mJ
zyf~

~

1

~1\!:
~

~ru

:iit!

w
k•
J\~!

~

j:;j
<
~

§.~

Nj~

.

Art1cle 30

.

.

.

(b) give the Commission an opinion on the level of protection in the Community and in third countries;

(d) give an opinion on codes of conduct drawn up at Community level.

il~
!{~

~1

!J~]

~

J~l

~

.
I

2. If the Working Party finds that divergences likely to affect the equivalence of protection for persons
with regard to the protessi.ng of personal data !n the Co~munlty are arising between the laws or practices
of Member States, It shall mform the Commlss1on accordmgly.

3. ihe Working Party may, on its own Initiative, make recommendations on all matters relating to the
protection of persons with regard to the processing of personal data in the Community.
4. The Working Party's opinions and recommendations shall be forwarded to the Commission and to the
committee referred to in Article 31.

~

5. The Commission shall inform the Working Party of the action it has taken in response to its opinions
and recommendations. It shall do so in a report which shall also be forwarded to the European Parliament
and the Council. The report shall be made public.

·

6. The Working Party shall draw up an annual report on the situation regarding the protection of natural

~

persons with regard to the processing of personal data in the Community and in third countries, which it
shall. transmit to the Commission, the European Parliament and the Council. lhe report shall be rnade
public.

~

l.\'1

R

~
"'v)
f:1

*~
~~

1;!:
(\'.!

·;··;:
··~

·'}'I

<;

:;.)

W!
:'1

t~

,c~:..

<·~

.~
;!j
··<:

.-:)

:~1

~~
~iJ\

;~-~
:·:·:i

;1~1·
·:::!

:~!1

~~

:,]

~
~:

~

8~

~
i~
~~
~~~

t?0

~*;

~~.

~f

~f

~;

:fJ
!¥.

l~

;(::
;;·;:'

~-~
~,:

~;.·:

(.~'(

~

Article 31

:(,:

··~·.::·

The Committee
1. The Commission shall be assisted by a committee composed of the representatives of the Member
States and chaired by the representative of the Commission.
2. The representative of the Commission shall submit to the committee a draft of the measures to be
taken. The committee shall deliver its opinion on the draft within a time limit which the chairman may lay
down according to the urgency of the matter.
·
The opinion shall be delivered by the.majority laid down in Article 148 (2) of the Treaty. The votes of the
representatives of the Member States within the committee shall be weighted in the manner set out in
that Article. The chairman shall not vote.

I
g,;

i
~j

I
V¥'

~\·
ill'~
($;~

The Commission shall adopt measures which shall apply immediately. However, if these measures are not
in accordance with the opinion of the committee, they shall be communicated by the Commission to the
Council forthwith. It that event:

~~ ~

)1

!,.;,

{:~-

!,;j
:'.·.!

~6

CHAP"l"ER VII COMMUNrt"Y IMPLEMeNTING MEASURES

;-:~;

:;~:

«

~

(a) examine any question covering the application of the national measures adopted under this Directive in
order to contribute to the uniform application of such measures;

:ij~

~~

~

~

1. The Working Party shall:

!&1
~

~~

i

(t) advise the Commission on any proposed amendment of this Directive, on any additional or specific
measures to safeguard the rights and freedoms of natural persons with regard to the processing of
personal data artd on any other proposed Community measures affecting such rights and freedoms;

:m

r{.f'

• the Commission shall defer application of the measures which it has deCided for a period of three months
http://eur-lex.europa.eu/LexUriServ/LexUriServ.da?uri=CELEX:31995L0046:en:HTML

6~~

'I'

I
f.;;:~
t~~~

~~~~~
~­

~.:::~:

 =y!:-~.i&!Wim!W#.2.m«~Al0%0~'i<--.\'~,~"""\~$1JlllO?'C('f'7P<
.o>,ij;

~{a;

??~\

;§l~i

*f~
~'\'),'!),i

Iyl·,-.·~

\~J

k·l

!1;1'

"

~,,:·.~

EUR-Lex- 31995L0046 ·EN

13101/2016

.~

~

from the date of communication,

~~

- the Council, acting by a qualified majority, may take a different decision within the time limit referred to
in the first indent. ·

)
!~}~,~

~~~

FINAL PROVISIONS
Article 32

~~l

l~
;~~··

1. Member States shall bring into force the laws, regulations and administrative provisions necessary to
comply with this Directive at the latest at the end of a period of three years from the date of its adoption.

~

~··
~

•••B

When Member States adopt these measures, they shall contain a reference to this Directive or be
accompanied by such reference on the occasion of their official publication. The methods of making such
reference shall be laid down by the Member States.

I

2. Member States shall ensure that processing already under way on the date the national provisions
adopted pursuant to this Directive enter into force, is brought into conformity with these provisions within
three years of this date.

~

By way of derogation from the preceding subparagraph, Member States may provide that the processing of
data already held In manual filing systems on the date of entry into force of the national provisions
adopted In Implementation of this Directive shall be brought into conformity with Articles 6, 7 and 8 of this
Directive within 12 years of the date on which it is adopted. Member States shall, however, grant the data
subject the right to obtain, at his request and in particular at the time of exercising his right of access, the
rectification, erasure or blocking of data which are incomplete, inaccurate or stored in a way incompatible
with the legitimate purposes pursued by the controller.
·

~~
~

~
~

~

I
~

~
iru

~

~

3. ey way of derogation from paragraph 2, Member States may provide, subject to suitable safeguards,
that data kept for the sole purpose of historical research need not be brought into conformity with Articles
o, 7 and 8 of this Directive.
4. Member States shall communicate to the Commission the text of the provisions of domestic law which

they adopt in the field covered by this Directive.

~

Article 33

~

The Con'1mlssion shall report to the Council and the European Parliament at regular intervals, starting not
later than three years aftet the date referred to in Article 32 (1), on the implementation of this Directive,
attaching to its report, if necessary, suitable proposals for amendments. The report shall be made public.

~

I
~

The Commission shall examine, in particular, the application of this Directive to the data processing of
sound and image data relating to natural persons and shall submit any appropriate proposals which prove
to be necessary, taking account of developments in information technology and in the light of the state of
progress in the information society.

~

Article 34

~
~

'i
~

This Directive is addressed to the Member States.

I

Done at Luxembourg, 24 October 1995.

8

For the European Parliament

I
1

The President

~

K.HAENSCH

n
u

The President

~

L. ATIENZA SERNA

~
:-.:)

~

k
::',

[(
i;i:

For the Council

(1) OJ No C 277, 5. 11. 1990, p. 3 and OJ No C 311, 27. 11. 1992, p. 30.
(2) OJ No C 159t17. 6. 1991, p 38.

·-~
~~)
,-,

~~~
~,1

~j
·.~

-~~

"
H

~-

/')

~:
"

'"

(3) Opinion of the European Parliament of 11 March 1992 (OJ No C 94, 13. 4. 1992, p. 198), confirmed on 2
December 1993 (OJ No C 342, 20. 12. 1993, p. 30); Council common position of 20 February 1995 (OJ No
C 93, 13. 4. 1995, p. 1) and Decision of the European Parliament of 15 June 1995 (OJ No C 166, 3. 7.
1995).
http://eur-lex.europa.eu!LexU riServ/LexU riServ .do?uri =CELEX:31995L0046:en:H TM L

 firm el{?u'r-e

P- ?-

'~3

~·
~

freedom of expression and information, the freedom to conduct a business, the right to
an effective remedy and to a fair trial as well as cultural, religious and linguistic
diversity.
HAVE ADOPTED THIS REGULATION:

CHAPTER I
GENERAL PROVISIONS
Article 1
Subject matter and objectives

1.

This Regulation lays down rules relating to the protection of individuals with regard
to the processing of personal data and rules relating to the free movement of personal
data.

2.

This Regulation protects the fundamental rights and freedoms of natural persons, and
in particular their right to the protection of personal data.

3.

The free movement of personal data within the Union shall neither be restricted nor
prohibited for reasons connected with the protection of individuals with regard to the
processing of personal data.
Article 2
Material scope

t
·.<
:~:r

:.~·

~=:

~{(

~I

~ij'
,)

~

*I

EN

1.

This Regulation applies to the processing of personal data wholly or partly by
automated means, and to the processing other than by automated means of personal
data which form part of a filing system or are intended to form part of a filing
system.

2.

This Regulation does not apply to the processing of personal data:
(a)

in the course of an activity which falls outside the scope of Union law, in
particular concerning national security;

(b)

by the Union institutions, bodies, offices and agencies;

(c)

by the Member States when carrying out activities which fall within the scope
of Chapter 2 of the Treaty on European Union;

(d)

by a natural person without any gainful interest in the course of its own
exclusively personal or household activity;

(e)

by competent authorities for the purposes of prevention, investigation,
detection or prosecution of criminal offences or the execution of criminal
penalties.

EN

 m~~~-c::;*-';hTI~~~WR%'~<k~:~"~:W.::t~~:~r~.~m~::l?~?,:{~§;:&.,~::Wf;;S~.~&-:~:;;:r~;~i1r>:J.o!i:'W;;91~~~~j3};(~i:~m~~~ti~8j

~

~zqj

-r

!

!I

.

•

~

I

~~c.

~.~
.~·\i

<tZ:~.

pH"l.:J

\\~

-·
-;-·

~

...,. .

~

Q

;,

~0;·~~

>·:k~

ji

'''k~

~ ~i~
·~~;

3.

~1.·;~'1
;v·
~

I
I~.

This Regulation shall be withdut prejudice to the application of Directive
2000/31/EC, in particular of the liability rules of intermediary service providers in
Articles 12 to 15 of that Directive.

&1~

Article 3
Territorial scope

ij

<

II

1.

This Regulation applies to the processing of personal data in the context of the
activities of an establishment of a controller or a processor in the Union.

2.

This Regulation applfes to the processing of personal data of data subjects residing in
the Union by a controller not established in the Union, where the processing
activities are related to:

:~

~
~
~
w
~~

~ .KJ

<

(a)

the offering of goods or services to such data subjects in the Union; or

(b)'

the monitoring of their behaviour.
~:f

3.

.
'

>

J

I~1

This Regulation applies to the processing of personal data by a controller not
established in the Union, but in a place where the national law of a Member State
applies by virtue of public international law.

I
k
~
~

;,.~

'•

Article 4
Definitions

~\~

For the purposes of this Regulation:

m
©

·,:--·

u
rt

I

(1)

'data subject' means an identified natural person or a natural person who can be
identified, directly or indirectly, by means reasonably likely to be used by the
controller or by any other natural or legal person, in particular by reference to an
identification number, location data, online identifier or to one or more factors
specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of that person;

I~

(2)

'personal data' means any information relating to a data subject;

-•

(3)

'processing' means any operation or set of operations which is performed upon
personal data or sets of personal data, whether or not by automated means, such as
collection, recording, organization, structuring, . storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, erasure or destruction;

(4)

'filing system' means any structured set of personal data which are accessible
according to specific criteria, whether centralized, decentralized or dispersed on a
functional or geographical basis;

(5)

'controller' means the natural or legal person, public authority, agency or any other
body which alone or jointly with others determines the purposes, conditions and
means of the processing of personal data; where the purposes, conditions and means
of processing are determined by Union law or Member State law, the controller or

~

~~
fu

~
~
~
~
~

~

~
~

$f~

~

I
I
~

m

0

~

i1

M

~

I
·: ~ . \

~/·:

t:\:\

.'~Y(
···~

!i~

EN

EN

 ~-"'"'"'"""""'~=,w-~--"""&<c~i:'!\lW&ji1iil1'0'iZ1l

~()~,'
~\}f!
It~;]
w~-~J

,~d

ll

l
f

~,

\\\

~~~

'Qg~

"•\'J~:~;'1

tlM

the specific criteria for his nomination may be designated by Union law or by
Member State law;

f~~
~\~~

I·~~~
~~~.i
,.,,~

(6)

'processor' means a natural or legal person, public authority, agency or any other
body which processes personal data on behalf of the controller;

(7)

'recipient' means a natural or legal person, public authority, agency or any other body
to which the personal data are disclosed;

1.c'ih:1

!t"'·~

I

(8)

'the data subject's consent' means any freely given specific, informed and explicit
indication of his or her wishes by which the data subject, either by a statement or by
a clear affirmative action, signifies agreement to personal data relating to them being
processed;

(9)

'personal data breach' means a breach of security leading to the accidental or
unlawful destruction, loss, alteration, unauthorised disclosure of~ or access to,
personal data transmitted, stored or otherwise processed;

(1 0)

··genetic data' means all data, of whatever type, concerning the characteristics of an
individual which are inherited or acquired during early prenatal development;

(11)

'biometric data' means any data relat~ng to the physical, physiological or behavioural
characteristics of an individual which allow their unique identification, such as facial
images, or dactyloscopic data;

(12)

'data concerning health' means any information which relates to the physical or
mental health of an individual, or to the provision of health services to the individual;

(13)

'main establishme11t' means as regards the controller, the place of its establishme11t in
the Union where the main decisions as to the purposes, conditions and means of the
processing of personal data are taken; if no decisions as to the purposes, conditions
and means of the processing of personal data are taken in the Union, the main
establishment is the place where the main processing activities in the context of the
activities of an establishment of a controller in the Union take place. As regards the
processor, 'main establishment' means the place of its central administration in the
Union;

(14)

'representative' means any natural or legal person established in the Union who,
explicitly designated by the controller, acts and may be addressed by any supervisory
authority and other bodies in the Union instead of the controller, with regard to the
obligations of the controller under this Regulation;

(15)

'enterprise' means any entity engaged in an economic activity, irrespective of its
legal form, thus including, in pa1iicular, natural and legal persons, partnerships or
associations regularly engaged in an economic activity;

~~
§l1

(16)

~

'group of undertakings' means a controlling undertaking and its controlled
undertakings;

(17)

'binding corporate rules' means personal data protection policies which are ad.hered
to by a controller or processor established on the territory of a Member State bf the

[{tl

't~
i~£~
·~[~

~~

''l~'l
11a
~i~~.

h~'~l

s:,w
i<'~i1

{h?.'

h>iJ
;)111

~;~

1!~

,- ~~·"'.

k~<!

~;r;;
:·~ ::~:~

\~:l

:<:~j
' ...~:1

~!
1-:

~·:

':' ~;

:. :~~j
·:·.\;~

;
~-.:~~

( /~.·

-.•·!

'\;-~.~

;~:

l-"\·'

i]
!!~

~:~~{

~
,if~'

-~{~

kf''
'.;·''

til'

~.-~

f.~

K~

.!!;j

k~

~~
~~

~ig..
~i~

I
~ii

~~

~~

\1lil
: .·~
·m

EN

EN

 ~

'

-"-"-"

~o ~
'·~.j'f'.~.:

.. • · - - -k.A

~~·

k'.A.'J...J(A

~-~----

:~·;.<;~:ll!..~·-,;"J',;••,;~t.;..,...........v..:..':.oo.,.-~"i.(~.-..O:"""V.t.'..."...-.:;'.'SV'L'w_,.,<,.,:,.~-vW:r-~\:~.).;~]:"W~~...,.),..,,;...·j_.J;..r'\'-.:-. ··~ • :·..-.,,~v-

i

.

.

§

§J

~~w
~
I*A

~~.~-·
I1!0/l
,1,1',

:~~

,

~
~

\\~

.

@.}

~~

~
~·

.

.

~<.'1.
\1~
'-"~lt.
~
~

1.

I';;

~
~
?,,
-

~
•t}'l,
·~l!.(:l;

1

.

~!f@

.

~~

~

Union for transfers or a set of transfers of personal data to a control er or processor m
one or more third countries within a group of undertakings;

~~

[~

~~-~

~{gl

;;.•

i~·
l:§'il

(18)

'child' means any person below the age of 18 years;

·I>)~
:,~

(19)

'supervisory authority' means a public authority which is established by a Member
State in accordance with Article 46.

~~·~

;; ~

*·:II
'ii@
iW

:'(

~~(
...-

;

~~

~~·/
<:_·.

~~~~~

·:·

CHAPTER II
PRINCIPLES

~l,l:j

~

:~ .~ ·~

t:::
i
;:~

1:~~~

ir.:,
~)!·

~\i"

Article 5

~~·

i0~1

'i•:

v

Principles relating to personal data processing

~
§k!
~.,\~{

".?

~:~

~

Personal data must be:

~~~

~.~ !~

~-.!

;,-•.:

t,

~ll

(a)

processed lawfully, fairly and in a transparent manner in relation to the data
subject;

(b)

collected for specified, explicit and legitimate purposes and not further
processed in a way incompatible with those purposes;

(c)

adequate, relevant, and limited to the minimum necessary in relation to the
purposes for which they are processed; they shall only be processed if, and as
long as, the purposes could not be fulfilled by processing information that does
not involve persortal data;

~~~

ll~'H~

}H

f()l

f~~~

~m

~~

't~.\tl
li(i''
:K~

!0

Il~

~~~

::::;

f;:

I
·~:

f~~
~I
i~6::

~~i&
(.5~

e-~.

o;,

(d)

~:~;

·~)~.

;;;

accurate and kept up to date; every reasonable step must be taken to ensure that
personal data that are inaccurate, having regard to the purposes for which they
are processed, are erased or rectified without delay;

z~

~;~

~j]

t•\
·~\'i

~~\·•'

(e)

~il'

¥''),

;rn
\i!l

::\

.......

·~l

kept in a form which permits identification of data subjects for no longer than
is necessary for the purposes for which the personal data are processed;
personal data may be stored for longer periods insofar as the data will· be
processed solely for historical, statistical or scientific research purposes in
accordance with the rules and conditions of Article 83 and if a periodic review
is carried out to assess the necessity to continue the storage;

) ~·

~:~~-

(::.:

(f)

f;~

H~
~t~
~u

&j

~t~;-

processed under the responsibility and liability of the controller, who shall
ensure and demonstrate for each processing operation the compliance with the
provisions of this Regulation.

(',i'.

::·:

,··-.

r.:: ~

~~

~~

Article 6

Lawfulness ofprocessing

~:

1.

,,.0·

~f:·;l
\'.!!
:<'i

Processing of personal data shall be lawful only if and to the extent that at least one
of the following applies:

·,;.\\

:i~:i
~<:.

'"'

...

: :~

._::/,

·:,
•.' ~ .I

~r~
:_.I
.,_, ·~::

~~:,:;

·~

EN

EN

 1fWh1~~~t't'i'lS~~~i:1~:~1J-~~~~~~:~~"'9~'$~('iZ:5~~2;,£:};:l:~tl.\~>.;x.~~:~~¥t..~¥2;~?Jt.:~;;~w}~f~~;,:~~::;~t~J~.l:lt.$2'~u~lK~~1

.

~

~
\·<-5§

~

~

~

~
:.:v.

:'x~~

~{j

?~~
~j

:0

@

~~~
~'~

,.~~

i~)
t"':. (j

&
~
>F'

I

~

~~

~\~

~~i0'W
,,,,

~~t,l~

~~~

{:t

~

~:.
l!S,.

l;:
«
.v:
~;
~"~

(a)

i

(b)

~tt

~~~

i::~

·~·:

the data subject has given cdnsent to the processing of their personal data for
one or more specific purposes;

~;~

;.::.
~}~

~·

processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior
to entering into a contract;

~;

~'(

<X

~3

ij
~

'i·~~l
'ltl

(c)

processing is necessary for compliance with a legal obligation to which the
controller is subject;

!(<'

J\lii
r~.,~

(d)

processing is necessary in order to protect the vital interests of the data subject;

t~'

t~'~~i t~

~

G-:?-

;~~~~

8.~
0:-~

,\~,

i.U~

~~
~/~

(e)

processing is necessary for the perfonnance of a task carried out in the public
interest or in the exercise of official authority vested in the controller;

(f)

processing is necessary for the purposes of the legitimate interests pursued by a
controller, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require protection
of personal data, in particular where the data subject is a child. This shall not
apply to processing carried out by public authorities in the performance of their
tasks.

o~l1

:~j

1
f. li

~

*

,$

~~~a

ff~-~

r!i!

r~
r~1~
$~

~'"·'
~'

ti~

2.

;;:,i

i1~l
t~~A

\~1

~m

$l~~I

3.

~l~~

'~:;.;~
n.:J

~J~

~

®·
r:?
~~

@

~~

~

:0:

~~~

>-:.~"

~~

~:{:
~~~:

Processing of personal data which is necessary for the purposes of historical,
statistical or scientific research shall be lawful subject to the conditions and
safeguards referred to in Article 83.

~~

l~i{~

The basis of the processing referred to in points (c) and (e) of paragraph 1 must be
provided for in:

/',-~.

(o~

;.~,~~

~~~

};

- .... 1

····-'i

.::,i

')j
.·i

(a)

Union law, or

(b)

the law of the Member State to which the controller is subject.

f"/

~

~~

.. ·1

':::'•·\i

The law of the Member State must meet an objective of public interest or must be
necessary to protect the rights and freedoms of others, respect the essence of the right
to the protection of personal data and be proportionate to the legitimate aim pursued.

Bft
~"%

~~~~

(c.,:S~
~:5(.\;
C~i·

6-;:·

4.

5.

'\"

:-.\:

I

~f~

Where the purpose of further processing is not compatible with the one for which the
personal data have been collected, the processing must have a legal basis at least in
one of the grounds referred to in points (a) to (e) of paragraph 1. This shall in
particular apply to any change of terms and general conditions of a contract.

I
)J(:

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying the conditions referred to in point (f)
of paragraph 1 for various sectors and data processing situations, including as regards
the processing of personal data related to a child.

iE_
"''{_:···

~-~~
(~.

4~1

~~~~

~I&~:

~~
~~

~1

. }~~
>('II

~1
~::~

i'~{N
-.·->:)
~~

~;~

~~

~~
j!

;,j~··
}~.

EN

EN

 ..• ',. ~

.•:."..''"""

··.~-'~·:.:.::,:·c;:::···

...,

ty@•

~ttl

\~"\
Article 7

Conditions for consent
1.

The controller shall bear the burden of proof for the data subject's consent to the
processing of their personal data for specified purposes.

2.

If the data subject's consent is to be given in the context of a written declaration
which also concerns another matter, the requirement to give consent must be
presented distinguishable in its appearance from this other matter.

3.

The data subject shall have the right to withdraw his or her consent at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent
before its withdrawal.

4.

Consent shall not provide a legal basis for the processing, where there is a significant
imbalance between the position of the data subject and the controller.

Article 8

Processing ofpersonal data of a child

:.~l

1.

For the purposes of this Regulation, in relation to the offering of information society
services directly to a child, the processing of personal data of a child below the age
of 13 years shall only be lawful if and to the extent that consent is given or
authorised by the child's parent or custodian. The controller shall make reasonable
efforts to obtain verifiable consent, taking into consideration available technology.

2.

Paragraph 1 shall not affect the general contract law of Member States such as the
rules on the validity, formation or effect of a contract in relation to a child.

3.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying the criteria and requirements for the
methods to obtain verifiable consent refelTed to in paragraph 1. In doing so, the
Commission shall consider specific measures for micro, small and medium-sized
enterprises.

4.

The Commission may lay down standard forms for specific methods to obtain
verifiable consent referred to in paragraph 1. Those implementing acts shall be
adopted in accordance with the examination procedure referred to in Article 87(2).

;~~

;;:~

;::1
?:·.i
:;.\

;_..,~ -~~

Article 9

Processing of special categories ofpersonal data

~:I

;!'I
.,.,

1.

The processing of personal data, revealing race or ethnic origin, political opinions,
religion or beliefs, trade-union membership, and the processing of genetic data or
data concerning health or sex life or criminal convictions or related security
measures shall be prohibited .

2.

Paragraph 1 shall not apply where:

',,I

:I
.''1

-i:-·1

;j

.,.
.;~

;t;

~~~

<~i

~~fHi

)(~j

l)~
lt-1

E'N

~-::

EN

 ~
~

jl-~~. ;
I

~.II:

;

•

!J

~}5

t®l

~~

}~

~~

~~

!.

II

~~

••~~

(a)

the data subject has given consent to the processing of those personal data,
subject to the conditions laid down in Articles 7 and 8, except where Union law
or Member State law provide that the prohibition referred to in paragraph 1
may not be lifted by the data subject; or

(b)

processing is necessary for the purposes of carrying out the obligations and
exercising specific rights of the controller in the field of employment law in so
far as it is authorised by Union law or Member State law providing for
adequate safeguards; or

~~

II

:M

!0

~

1

~

.·

'·'

I

'i~

(c)

~

I,,:.

processing is necessary to protect the vital interests of the data subject or of
another person where the data subject is physically or legally incapable of
giving consent; or

):
,._.

:~;
Lc

~.·

(d)

I

j

l
*
'

m

~
~

processing is carried out in the course of its legitimate activities with
appropriate safeguards by a foundation, association or any other non-profitseeking body with a political, philosophical, religious or trade-union aim and
on condition that the processing relates solely to the members or to former
members of the body or to persons who have regular contact with it in
connection with its purposes and that the data are not disclosed outside that
body without the consent of the data subjects; or

;/
c:;

,.·

~~

,.:;::

8

~

X'-

f~~

:~

~~;

~

(e)

the processing relates to personal data which are manifestly made public by the
data subject; or

v

(f)

processing is necessary for the establishment, exercise or defence of legal
claims; or

I

(g)

processing is necessary for the performance of a task carried out in the public
interest, on the basis of Union law, or Member State law which shall provide
for suitable measures to safeguard the data subject's legitimate interests; or

ill~

(h)

processing of data concerning health is necessary for health purposes and
subject to the conditions and safeguards referred to in Article 81; or

~
~. l

(i)

processing is necessary for histbrical, statistical or scientific research purposes
subject to the conditions and safeguards refen·ed to in Article 83; or

(j)

processing of data relating to criminal convictions or related security measures
is carried out either under the control of official authority or when the ·
processing is necessary for compliance with a legal or regulatory obligation to
which a controller is subject, or for the performance of a task carried out for
important public interest reasons, and in so far as authorised by Union law or
Member State law providing for adequate safeguards. A complete register of
criminal convictions shall be kept only under the control of official authority.

~. :.'
"''-·

~

~~
m

~

~
~

~

~
~

r

~

I•
'I
~

f

~

3.

f~

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying the criteria, conditions and
appropriate safeguards for the processing of the special categories of personal data
referred to in paragraph 1 and the exemptions laid down in paragraph 2.

&
~

~
~

~

~t

t

~

r~}~.'~

l
~

EN

EN

 ~\wx'>o.soo&MZ~ti>l.\G'..",c?W?.~-;-:~~{.w;?.,;'~:;";;";"•:o::0_-:.::5&%o&%1~~;_,cv;;c<{,,-t~o::u--2', "'' -- ,,, __ - < "-A?i.4J~~£,~~~:;::,__

'\ ~--- ·•' .-i:-c: · :F-:'<:_;;;;;SI:~;~;;;;;';I~;{ii:rt:;~~~oJ,_;_,vl

~~

'w

~~~

;_:.:::_

I

~

_,~g_.·

,_

8'''
,.~.

.;:,:
~;

~~~

~-

~\ \ ~

•c·-.{'

Anticle IO

Processing not allowing identification
If the data processed by a controller do not permit the controller to identify a natural person,
the controller shall not be obliged to acquire additional information in order to identify the
data subject for the sole purpose of complying with any provision of this Regulation .

:.:<'.,..

·.: :~~
.··: ~
,··,·:,

CHAPTER III
RIGHTS OF THE DATA SUBJECT
SECTION!
TRANSPARENCY AND MODALITIES
Article II

Transparent information and communication
:::-,:_:::

1.

The controller shall have transparent and easily accessible policies with regard to the
processing of personal data and for the exercise of data subjects' rights.

2.

The controller shall provide any information and any communication relating to the
processing of personal data to the data subject in an intelligible form, using clear and
plain language, adapted to the data subject, in particular for any information
addressed specifically to a child.

Article 12

Procedures and mechanisms for exercising the rights of the data subject
·.-;:

1.

The controller shall establish procedures for providing the information referred to in
Article 14 and for the exercise of the rights of data subjects referred to in Article 13
and Articles 15 to 19. The controller shall provide in particular mechanisms for
facilitating the request for the actions referred to in Article 13 and Articles 15 to 19.
Where personal data are processed by automated means, the controller shall also
provide means for requests to be made electronically.

2.

The controller ·shall inform the data subject without delay and, at the latest within one
month of receipt of the request, whether or not any action has been taken pursuant to
Article 13 and Articles 15 to 19 and shall provide the requested information. This
period may be prolonged for a further month, if several data subjects exercise their
rights and their cooperation is necessary to a reasonable extent to prevent an
unnecessary and disproportionate effmt on the part of the controller. The information
shall be given in writing. Where the data subject makes the request in electronic
form, the information shall be provided in electronic form, unless otherwise
requested by the data subject.

3.

If the controller refuses to take action on the request of the data subject, the
controller shall inform the data subject of the reasons for the refusal and on the
possibilities of-lodging a complaint to the supervisory authority and seeking a
judicial remedy.

::·:

: .'-~

J~

~

I
~

~~~~
~

~

\.'

~

~
~

;
~

n
~

~
Th

m

*

p
~

~

~

~

I
~

I
~

3

~(~.~~
~

EN

EN

 ~~Y.~10W3l""'--'"'':~
t

,j

,,

~f

A

~
@~

~

:,~ \~

ww·.

~,"J;'l]

;
~i1~

•

~
~
~
'·'-1'1

;;,

~
~
,,.

$

I
~·

4.

:ii
~~

~
ml;":
~

~~

~

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying the criteria and conditions for the
manifestly excessive requests and the fees referred to in paragraph 4.

6.

The Commission may lay down standard forms and specifying standard procedures
for the communication referred to in paragraph 2, including the electronic format. In
doing so, the Commission shall take the appropriate measures for micro, small and
medium-sized enterprises. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 87(2).

~

I
1

i~

· ;.~

paragraph 1 shall be
free of charge. Where requests are mamfestly excessive, m particular because of their
repetitive character, the controller may charge a fee for providing the information or
taking the action requested, or the controller may not ~ake the acti?n requested .. In
t.hat case, t.he controller shall bear the burden of provmg the mamfestly excessive
character of the request.

5.

~~
jil,

The information and the actions taken ?n requests ":ferr7ct to

~

~:f1

::~

~

~
~.: '·c ;·:
~}

0

~'~2

:~

t

Article 13
Rights in relation to recipients

v~

&3

~:;~
'

';,~,

The controller shall communicate any rectification or erasure carried out in accordance with
Articles 16 and 17 to each recipient to whom the data have been disclosed, unless this proves
impossible or involves a disproportionate effort.

~~

~~
!!,;'

F~~ :'
~~

SECTION2
INFORMATION AND ACCESS TO DATA

~t1

~'M

1'~~

~~

~~ii

Article 14
Information to the data subject

.~~ji

~~a

•.

!;~

i::tJ

1"1

1.

I

·.~~~

Where personal data relating to a data subject are collected, the controller shall
provide the data subject with at least the following information:
(a)

the identity and the contact details of the controller and, if any, of the
controller's representative and of the data protection officer;

(b)

the purposes of the processing for which the personal data are intended,
including the contract terms and general conditions where the processing is
based on point (b) of Article 6( 1) and the legitimate interests pursued by the
controller where the processing is based on point (f) of Article 6(1);

(c)

the period for which the personal data will be stored;

(d)

the existence of the right to request from the controller access to and
rectification or erasure of the personal data concerning the data subject or to
object to the processing of such personal data;

(e)

the right to lodge a complaint to the supervisory authority and the contact
details of the supervisory authority;

"'~~,) ~

·t

K~

I
~~~;

8~
r::~
~'.~

,,:\1

~

'

'

u~

·;~

:··::;

:~~)

~
8M

m
~

ill•

m
~

w
~

~~

00

~~
U'

ffl
~.

EN

EN

 ~-:..':~:~~-~~;:;:;a-:;>!~·,;~:l&l.~~~;:;::»».x:~~-:::'$:::.'3'i:x~::;:·:-»::::::=:Y2::::»~::;::;:w.«::wi.o~.i.::):~%&;~~~u~::rl,f&~rz;~~:~:::::~>;;~~~~~iv,,,,~:~:~;:i_ik;;;:::,:;;::;.su;;~;:;;:;;{::)i:~~;!~f£

., ..,

~·

~

~

/;:~

I
~

~

l:?-

i?£

\\g

@»

I

~

!~

~

~){(

I

~%
::,--:--:.~

I

•
~

(f)

the recipients or categories o£recipients of the personal data;

(g)

where applicable, that the controller intends to transfer to a third country or
international organisation and on the level of protection afforded by that third
country or international organisation by reference to an adequacy decision by
the Commission;

~

::;(;

f~%i,.." (

~1
~
~

-

i

;;;>.,,

~~~
~·:;,.

;~~~·

~2

:~~;··

~~·?:

:f
(

(h)

2.

~

~
~~

any further information necessary to guarantee fair processing in respect of the
data subject, having regard to the specific circumstances in which the personal
data are collected.
·

4.

,
c::'

::J

~;~~:

~[;~~

;:so

~1}~

Where the personal data are collected from the data subject, the controller shall
inform the data subject, in addition to the information referred to in paragraph 1,
whether the provision of personal data is obligatory or voluntary, as well as the
possible consequences of failure to provide such data.

~-~~:
;-::·

~K
-~:1
(::"

~{~
!x··

~
~

I•

5.

~

~~7

Where the personal data are not collected from the data subject, the controller shall
inform the data subject, in addition to the information referred to in paragraph 1,
from which source the personal data originate.

~~~
?-~

:~;

~~

The controller shall provide the information referred to in paragraphs 1, 2 and 3:
(a)

at the time when the personal data are obtained from the data subject; or

(b)

where the personal data are not collected from the data subject, at the time of
the recording or within a reasonable period after the collection, having regard
to the specific circumstances in which the data are collected or otherwise
processed, or, if a disclosure to another recipient is envisaged, and at the latest
when the data are first disclosed.

.(~.~

Paragraphs 1 to 4 shall not apply, where:

~

N
~~~.;
I

(a)

I
~

the data subject has already the information referred to in paragraphs 1, 2 and
3; or

(b)

the data are not collected from the data subject and the provision of such
information proves impossible or would involve a disproportionate effort; or

(c)

the data are not collected from the data subject and recording or disclosure is
expressly laid down by law; or

(d)

the data are not collected from the data subject and the provision of such
information will impair the rights and freedoms of others, as defined in Union
law or Member State law in accordance with Article 21.

~

~~

~

~

fu
~~

I

'
~

~~

~
~

~

6.

In the case referred to in point (b) of paragraph 5, the controller shall provide
appropriate measures to protect the data subject's legitimate interests.

7.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifYing the criteria for categories of
recipients referred to in point (f) of paragtaph 1, the requirements for the notice of
potential access referred to in point (g) of paragraph 1, the criteria for the further

~

Iw
w.

~.;

'JI
~
~

ij
~

.,'

.··l

•.<

·::\
·:':,

;;:\

.~:;~

.:r:

?}.!;

i~i~ilA

~i~;~~~~!

h~

·~:::·'

EN

I

j

..

<~l'

~

3.

:,-,.;.

EN

 »}S~(~~~~'%':{-~>~o\{·~~~');•;;>-,.~5~1".~m._~~~"1f·~· M:«:-m·~;)"N.• 0:,">,--:,-.;;~};'J..::j{'"j(;{•

r

~QZ..-!"'!'S\t")~:t. ..X•J!~~WR~~ r,r/.;~(\Y_•5o...:

j,)_....,_

•

,t:.t:_·~

L~'-~ ..~~~,.,,h·~f.:.;;u.._,,

':1

,

:' .::~~·"=·~ ~;.'-;."~':.:•"< :-\'·~Y--; ';.\")-'1",\

.,.."j''!Y;t(itt~~-----'!..."~~--\L;c:._~\f_..,_.. ••• ., .... _~ ---

-

_,_

1
)"'Y'- "r'1~ ;J~:r,~~.,.~~·~·: ~'"' ;A,I....,(L..t'"' n -, - ~: • :>. _.. .r),.•'"'t<;~11:,;..'(.
~>(H_..,....~~t~'!fW~'\.~·~;>.."I~~-=;;:9x-,"-!\~),,.\r:,.:•• ~~-"'?- •• o....
;:_

_,(,{.; ~, V{'" \ "1(..:; ,• ~,-,-,•,• '}-".. ~{'/~

.'

·--

,'..' ••'.l.rJ.~v,_"

~~~

~~~~
~

.

~~~

'

~

N

~.~

~
~

z~

~

~l

~

~
~\~'j

~+·

e·

g;~~t)
~-~~;t{

%;:1'

~J}J

.

:;?

'

~~
If\",

~

~;;

• \ \

~"if/·j

~Y:
~;.

t-<§i.

I

~
t~

information necessary referred to
point (h) of paragraph 1 for specific sectors and
situati~ns, a~d the conditions and approp~iate safeguards fo~ t~e exceptions laid
down m pomt (b) of paragraph 5. In domg so, the Comm1ss10n shall take the
appropriate measures for micro, small and medium-sized-enterprises.

~1

.
(~i~

~

I
~

8.

~~.
~,

~

~

~H

~~
~

~

The Commission may lay down standard forms for providing the information
referred to in. paragraphs 1 to 3, taking into .acco~t t?e specific characteristics and
ne. eds of vanous sectors and data processmg s1tuatwns where necessary. Those
implementing acts shall be adopted in accordance with the examination procedure
referred to in Article 87(2).

f\;c~
~
IT~~

~j
·('·.::}. • .:
~~:

~)~

.

I

Right of access for the data subject

,i;:
~
~~
r;!

Art1cle 15

~
~it1

1.

Jlti
[~~'i
}~

IH;

I

in

I

1

~
l(~i

~~
l~~

The data subject shall have the right to obtain from the controller at any time, on
request, confirmation as to whether or not personal data relating to the data subject
are being .processed. "':her~ such p.ersonal data are being processed, the controller
shall prov1de the followmg mformat10n:

!i~f

(c)

the recipients or categories of recipients to whom the personal data are to be or
have been disclosed, in particular to recipients in third countries;

~;~-i

(d)

the period for which the personal data will be stored;

(e)

the existence of the right to request from the controller rectification or erasure
of personal data concerning the data subject or to object to the processing of
such personal data;

I

~

'

~

,::j
0(.~

r.~
~;

M
,v._,
%;

!>>
'-"·"

~

the right to lodge a complaint to the supervisory authority and the contact
details ofthe supervisory authority;

(g)

communication of the personal data undergoing processing and of any
available information as to their source;

(h)

the significance and envisaged consequences of such processing, at least in the
case of measures referred to in Article 20 .

~~

t~.

~~-

the categories of personal data concerned;

;)fJ'
r'.!;i
~~~

:>'

(b)

(f)

L~;:.,

ti·;·,

the purposes of the processing;

:-~~

~

I

(a)

.~. '!

I

:e:",

~

~"~~

m

i
~~5

~~~

[~l~

.

:\?~

t~

2.

The data subject shall have the right to obtain from the controller communication of
the personal data undergoing processing. Where the data subject makes the request in
~lectronic form, the information shall be provided in electronic form, unless
otherwise requested by the data subject.

3.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying the criteria and requirements for the
communication to the data subject of the content of the personal data referred to in
point (g) of paragraph 1.

:;;-~

r~:

:r·;

·.,~

e~:

~·i

.,Y.1

~

~-~

';it
··'··

-~-~J
.~:-.

~j

.....

. '• ~
~ ·,.1

··j

'·'

~-]

EN

EN

 ~-w.:..wr::-m~m:<-«W¥.1f&li;:~i~:::~:~;:;<<<~~:::r~"'~~~'«::::~:3~:(~:~.~\1~8&:56:r2»'*~@¥~~'$£st?!ra~f@r:~j~;;m;_m~:;~;;;g;a.:tiiZt@;:;~~:;::s~2S:ii':~:csJ:~~

~~il

.•..

~

~

;

I

t~1~

J

~

, .,
,~,

-

i

'Jl(,~

I
i

\~

~

. .

:o::

.

ti~~

4.

::3~

~);~

iB·;J

&~~.i
;t,&1
~

The ~ommission may sp.ecify st~dard forms and. procedures for r:quest~ng and
grantmg access to the mformat10n referred to m paragraph 1, mcludmg for
verification of the identity of the data subject and communicating the personal data to
the data subject, taking into account the specific features and necessities of various
sectors and d~ta processi~g s~tuations. Those impleme~ting .acts shall be adopted in
accordance With the exammatwn procedure referred tom Article 87(2).

~~~il ,
~~1:

(~~

~

~

~

~
~
r

~
~f~
~

SECTION 3
RECTIFICATION AND ERASURE

~
~

~
~.~.
3~:

01'

~

b

~

.

~~

~
~f

Art1cle 16
Right to rectification

~

~

~*~]

~]

@
~

The data subject shall have the right to obtain from the controller the rectification of personal
data relating to them which are inaccurate. The data subject shall have the right to obtain
completion of incomplete personal data, including by way of supplementing a corrective
statement.

~~
~~
H;l

I

~
~

@

I

.

~'~-''

Artzcle 17
Right to be forgotten and to erasure

~~

;iij

1.

1~~~~
(~1
1

1>'::,

~

w

~

~

The data subject shall have the right to obtain from the controller the erasure of
personal data relating to them and the abstention from further dissemination of such
data, especially in relation to personal data which are made available by the data
subject while he or she was a child, where one of the following grounds applies:

i

i

~~

,·:);

&r

(a)

:~h

:il
n~
~. :. :1

k~

(b)

the data subject withdraws consent on which the processing is based according
to point (a) of Article 6(1), or when the storage period consented to has
expired, and where there is no other legal ground for the processing of the data;

(c)

the data subject objects to the processing of personal data pursuant to Article
19;

::·:~l
; ;"} ~

';.:
~
~

,
~

i
~

(d)

~

~
~~

~
I
~

2.

~
~

~

~
~

I
~

rw

the data are no longer necessary in relation to the purposes for which they were
collected or otherwise processed;

~

tY.

~~
f.~

I

;~~~;;·

~f?

f~;~:

the processing of the data does not comply with this Regulation for other
reasons.

I

Where the controller referred to in paragraph 1 has made the personal data public, it
shall take all reasonable steps, including technical measures, in relation to data for
the publication of which the controller is responsible, to inform third parties which
are processing such data, that a data subject requests them to erase any links to, or
copy or replication of that personal data. Where the controller has authorised a third
party publication of personal data, the controller shall be considered responsible for
that publication.

~}-~;

~

0~~
r;-s.

V:5

i}£i

i~l

~

~
~

~

~

i•;!l
'"

~:~

~]
u1'~I

.

1
~

;.1

'"'

~·

~1

!,.

EN

EN

 tJ,.

·~\

-

3.

4.

The controller shall carry out the erasure without delay, except to the extent that the
retention of the personal data is necessary:
(a)

for exercising the right of freedom of expression in accordance with Article 80;

(b)

for reasons of public interest in the area of public health in accordance with
Article 81;

(c)

for historical, statistical and scientific research purposes in accordance with
Article 83;

(d)

for compliance with a legal obligation to retain the personal data by Union or
Member State law to which the controller is subject; Member State laws shall
meet an objective of public interest, respect the essence of the right to the
protection of personal data and be proportionate to the legitimate aim pursued;

(e)

in the cases referred to in paragraph 4.

Instead of erasure, the controller shall restrict processing of personal data where:
(a)

their accuracy is contested by the data subject, for a period enabling the
controller to verify the accuracy of the data;

(b)

the controller no longer needs the personal data for the accomplishment of its
task but they have to be maintained for purposes of proof;

(c)

the processing is unlawful and the data subject opposes their erasure and
requests the restriction of their use instead;

(d)

the data subject requests to transmit the personal data into another automated
processing system in accordance with Article 18(2).

5.

Personal data referred to in paragraph 4 may, with the exception of storage, only be
processed for purposes of proof, or· with the data subject's consent, or for the
protection ofthe rights of another natural or legal person or for an objective of public
interest.

6.

Where processing of personal data is restricted pursuant to paragraph 4, the
controller shall inform the data subject before lifting the restriction on processing.

7.

The controller shall implement mechanisms to ensure that the time limits established
for the erasure of personal data and/or for a periodic review of the need for the
storage of the data are observed.

·:]

8.

Where the erasure is carried out, the controller shall not otherwise process such
personal data.

•:.

9.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying:

.J

;.J

:i

·1-_,

::.;·'
.·i

·J

·. ~

}j
?~
li
i!

(a)

~r
!·'

~~'
·~·.
1::

~i.::

i~·

:~.:

:.:;
.....

"',,i
:1
i~,,
.:.~

EN

the criteria and requirements for the application of paragraph 1 for specific
sectors and in specific data processing situations;

EN

 -~~lillf~im~~~~£;~i!~'i~~zrl~&r~1~1l!;~1r~:?t~;~:-=l::~~r- -.-

·-·-· ·
~;;<·

'(··

);i
._,,
f::,·_·_

,_,_

r;~-~
-~1

..

11

~/

~,_;·

\~
(b)

the conditions for deleting links, copies or replications of personal data from
publicly available communication services as referred to in paragraph 2;

(c)

the criteria and conditions for restricting the processing of personal data
referred to in paragraph 4.

.,

...

/;_(·

:·>

Article 18
Right to data portability
".;·:,

1.
-·::~:-

The data subject shall have the right, where personal data are processed by electronic
means and in a structured and commonly used format, to obtain from the controller a
copy of data undergoing processing in an electronic and structured format which is
commonly used and allows for further use by the data subject.

;:">=:.
(..,-··

'='>-;!.--

,~·-:

-~/

2.

3.

~~::~

Where the data subject has provided the personal data and the processing is based on
consent or on a contract, the data subject shall have the right to transmit those
personal data a11d any other information provided by the data .subject and retained by
~n automated processing system, into another one, in an electronic format which is
commonly used, without hindrance from the controller from whom the personal data
are withdrawn.

~
~;:
.-,,,

The Commission may specify the electronic format referred to in paragraph 1 and the
technical ~tandards, modalities and procedures for the transmission of personal data
pursuant to paragraph 2. Those implementing acts shall be adopted in accordance
with the examination procedure referred to in Article 87(2).

SECTION 4
:,··

';·~

RIGHT TO OBJECT AND PROFILING

"."\,
).

~

II

I~
N

Article 19
Right to object

.';!

~~

~

"'m

1.

The data subject shall have the right to object, on grounds relating to their particular
situation, at any time to the processing of personal data which is based on points (d),
(e) and (f) of Article 6(1), unless the controller demonstrates compelling legitimate
grounds for the processing which override the interests or fundamental rights and
freedoms of the data subject.

2.

Where personal data are processed for direct marketing purposes, the data subject
shall have the right to object free of charge to the processing of their personal data
for such marketing. This right shall be explicitly offered to the data subject in an
intelligible manner and shall be clearly distinguishable from other information.

3.

Where an objection is upheld pursuant to paragraphs 1 and 2, the controller shall no
longer use or otherwise process the personal data concerned.

~
~
~

k

1i

~

~

~

~~
~

i

1

>
''•~

EN

EN

 ~·

"«W"

\~}
Article 20
Measures based on profiling
1.

Every natural person shall have the right not to be subject to a measure which
produces legal effects concerning this natural person or significantly affects this
natural person, and which is based solely on automated processing intended to
evaluate certain personal aspects relating to this natural person or to analyse or
predict in particular the natural person's performance at work, economic situation,
location, health, personal preferences, reliability or behaviour.

2.

Subject to the other provisions of this Regulation, a person may be subjected to a
measure ofthe kind referred to in paragraph 1 only if the processing:
(a)

is carried out in the course of the entering into, or performance of, a contract,
where the request for the entering into or the performance of the contract,
lodged by the data subject, has been satisfied or where suitable measures to
safeguard the data subject's legitimate interests have been adduced, such as the
right to obtain human intervention; or

(b)

is expressly authorized by a Union or Member State law which also lays down
suitable measures to safeguard the data subject's legitimate interests; or

(c)

is based on the data subject's consent, subject to the conditions laid down in
Article 7 and to suitable safeguards.

3.

Automated processing of personal data intended to evaluate certain personal aspects
relating to a natural person shall not be based solely on the special categories of
personal data referred to in Article 9.

4.

In the cases referred to in paragraph 2, the information to be provided by the
controller under Article 14 shall include information as to the existence of processing
for a measure of the kind referred to in paragraph 1 and the envisaged effects of "Such
processing on the data subject.

5.

The Commission shall be empowered to adopt delegated acts in accordance with
Article 86 for the purpose of further specifying the criteria and conditions for suitable
measures to safeguard the data subject's legitimate interests referred to in paragraph

2.
SECTIONS
RESTRICTIONS

Article 21
Restrictions
1.

EN

Union or Member State law may restrict by way of a legislative measure the scope of
the obligations and rights provided for in points (a) to (e) of Article 5 and Articles 11
to 20 and Article 32, when such a restriction constitutes a necessary 1 and
proportionate measure in a democratic society to safeguard:

EN

 -~~~--~

····:»~~=~~~~~~~~~Jr:1:~~~~~~~;r~:~{$~5~t~~-;~:-~_~;~~~~~:~~~~~~;:::·~~::;·:~~~~:~:~~~t~:·ris}.;r~;~\~r-~

~

~~~

~:.

r

\9..'\

~

i~

l)(•·

~~~

i'{
,>~·,

•

f;~

r~:

IN THE HIGH COURT OF DELHI AT NEW DELHI
/

EXTRAORDINARY, ORIGINAL CIVIL JURISDICTION

.,

:;·,

~
~

~

~

/2015

I.A.

~

~

IN
WP (C) NO.

~

OF 2016

~

~

~

8

IN THE MATTER OF:

~

LAKSH VIR SINGH YADAV

...... PETITIONER

~

VERSUS
UNION OF INDIA & OTHERS

I
~
~

...... RESPONDENTS

~

B
~~~;j

.:,-

APPLICATION UNDER SECTION ·151 OF THE CODE OF CIVIL
PROCEDURE, '1908 ON BEHALF OF THE PETITIONER FOR ADINTERIM EX-PARTE INTERIM RELIEFS

~?

f-,-

-~;;·~

MOST RESPECTFULLY SHOWETH:
1. That the Petitioner has preferred the accompanying Writ
Petition and the contents whereof are not being repeated herein
for the sake of brevity and may be read as part and parcel of the
present application.

2. The Petitioner has filed the accompanying writ petition seeking,
besides other directions, a direction against the.Respondent No.
5 to delete the confidential information of the writ petition
including the name of the Petitioner appearing during the search
results on the internet.

,·.··

j_:··.

 ~~~~~1i~~f.?~"~~-~-~~'X·~·}:_\.»:~~-~~:~~~~~~M·~%Yh.~~~~:.t'SXz-~t~~?~;~:~:~~~(~~~~r;:·a-~-;~~~~~~~11~~~~1~~~~2f~:~~~~~~~~~:,}'jJj~,;5;~~~~~~f$_})/~~}.i~·
'

j{'

~

I

..:'~
~~·
~

\~5

~

~;

s~

~:.('~

r·

3. The

Petitioner has

filed

this

Petition to

redress

&

his

~~

aforementioned grievance before this Hon'ble Court. This

~
~

®

Hon'ble Court being a Court of record, all the proceedings

Ii

before this Hon'ble Court are reportable except in cases where

~

there is a specific direction from this Hon'ble Court to keep the
proceedings confidential.

~

%
~
~

~
0

I
~·~­
~

4. Since the main grievance of the Petitioner is to strike off I

#
~

~\
~(

remove the confidential information including his name from

./•.'~!~'

56

~~~:

J(l•

search results on the internet, it is the apprehension of the

~~

Petitioner that the filing of the Present Petition before this

~

~~2

~~

..,_,;;.

Hon'ble Court may result in the reporting of any further orders'
in this Petition online and thereby giving third parties, the right
to access the very information which is sought to be kept

~
~.;~:
\

-~

,t;~~

confidential through this Petition.

~-~.

~}

5. The Petitioner has a good prima facie case in its favour.
Balance of convenience also lies in favour of the Petitioner and
against the Respondent. Interim reliefs as prayed hereunder are
necessary for the proper disposal of the case. If these interim
reliefs are not granted, the Petitioner shall suffer irreparable loss
and harassment, which cannot be compensated in any terms. On
the other hand, no prejudice or hardship would be caused1 to the
respondent, if the reliefs are granted as prayed for.

 ~

~

~~~.'

I

9

!

;

i

\~·~t.

~

~

•....

~

~}.·
~~

:;:·

~-

~t

Praver

~
~~

.;~··

~

'\

.,~:
;~

•'

1. It is therefore, most respectfully prayed that this Hon'ble, Court

;~.

,,

~~
•'

~~'

i"':-.~·.

may be pleased to:

~
~

~

~

~

~

A. Pass an order or direction, directing the Respondent No. 5 to
keep the name of the Petitior1er as anonymous during the
pendency and even after disposal of this writ petition;
B. Pass an order and I or direction directing the Respondent No. 5
to keep the proceedings in the present case confidential and
thereby not allowing online reporting of the case proceedings;

~
~
~

Q

~

~

~
~

~

~
»
~
I

~

~
~

~

I
~

~

y

~

C. Pass such other and further orders' as this Hon'ble Court may
deem fit, just and proper in the facts and circumstances of the

~

&
~

~

~

w
~
~

!;:··

case;

~;~:

i<).:.:

~x;

l;,~·,;

(-~'-:

.~:f~

ii~i

PETITIONER/APPLICANT

·.n~ouoV?

M(\ r~)'- ~
Uvo ROHIT MADAN & AKASH VAJPAI
.

v

ADVOCATES
496, GREATER KAILASH -I
NEW DELHI

NEW DELHI
DATED:~ 2016

1,'

 ~~~~3M'll12&>''1''""'~~Ii.!~'1'1~!'z:\'1~E:C·i.';;;l

~

\~1-

(~;

•

IN THE HIGH COURT OF DELHI AT NEW DELHI
EXTRAORDINARY ,ORIGINAL CIVIL JURISDICTION
I.A.

/2016
IN
OF 2016

WP(C)NO.

IN THE MATTER OF:

LAKSH VIR SINGH YADAV
...... PETITIONER
VERSUS
; . <''

.

'

\\~'':. UNION OF INDIA
'-~>:

\·

&OTHERS

I,

...... RESPONDENTS

'

.'~0~{(2',: ...,
....,

AFFIDAVIT

··-

I, )&Y~h..~l\"'( _SrJ\''-'A~v S/o Shri~~-s V\'f
)'&d¢tV,
aged about \A~-... Years, Petitioner in the above named, having my
office at e:8 1~Y-e€b~~c.\t>.,v'"e-, _$ot-<~1 N@\fo pe_lj) --\\~o\?r Do

Sm}

hat I am the Petitioner herein in. the abovementioned matter
nd competent to swear by way of the present affidavit.

\t}

~J.

~Q_f·

~

-

~

~

,...)

.

That I have read and understood the contents mentioned in the
present application and that content mentioned therein are true
and correct to the best of my knowledge and belief based on the
records available.
~~~ ~~~~ 'I~J..4N
DEPONENT
VERIFICATION

\fw

29 J~N 20~6

Verified at New Delhi on this . .
.. .
. .
.
"' ~"<19-.~t the contents of the above affidavit are true and correct to
~"\~\' i.tftl
!

\~~?~~~j"~~e~~ ~-h~.. ~es~ ~f~~y. ~-?wl~."~~ep and belief, that no part of it is

\O~~\~'i ~'?-6 '\\
\ ?>.'.fJ c.\~
\\ ~

false
.

~~~~:t~iTl~t~r,Iath~.~~-~.~ concealed therefro:n~,
s"
~~"'lv_~ Vi ''~~~
::.- "'·· ...... ~
'""
R......
. . ... ./.fl~..;j
._r. . · . ... ..··.. .··· ...................
. .
n

1·'- .

-~::····;
L:..:. ..... ....

.

. !J

. .

· :·. : '..

:_:n ..................

.k

·~··""(]""""'"'

JC· • t·'·'-~.....
· ~:: •.. ~-: -~.~ ':11i

..· ·

2n.

·

J·~-t-.l .. !:lr\~1·~(§)··.

~~~;1 :;::~.:1_~·.· .·:. . .:~ .. (~·~:(i;·~:.:·~;J 'J--l

c~•lr~.:ct to

lli:. kr.:;;.,,:.,u.·._,
""'

.;:,

.
.-

O:iitl: C~mrr · .>k:r.;;r, Oethi

·(_

DEPONENT

"""\.

cJa1\1

 \~

"

~·~

IN THE HIGH COURT OF DELHI AT NEW DELHI
EXTRAORDINARY ORIGINAL CIVIL JURISDICTION
I.A.

/2015
IN
OF 2016

WP (C) NO.
IN THE MATTER OF:
LAKSH VIR SINGH Y ADAV

......PETITIONER

VERSUS
UNION OF INDIA & OTHERS

...... RESPONDENTS

APPLICATION UNDER SECTION 151 OF THE CODE OF CIVIL
PROCEDURE, 1908 ON BEHALF OF THE PETITIONER FOR
EXEMPTION FROM FILING THE ORIGINAL COPY AND TRUE
TYPED COPY OF DIM/PROPER MARGIN/UNDERLINE/SINGLE
LINE SPACING OF THE ANNEXURES
MOST RESPECTFULLY SHOWETH:
1. That the Petitioner has preferred the accompanying Writ
Petition and the contents whereof are not being repeated herein
for the sake of brevity and may be read as part and parcel of the
present application.

2. That this Hon'ble Court may kindly exempt the Petitioner from
filing the true typed copy of dim/proper margin/underline/single
line spacing of the annexure.

 7.;J&~NG:.Cc::m?9)5!S'x"i!i$/J5X:?:'!tc~it))@§JWJJ?2i'!i(?Y/J..:'0J:i%i:I'YI'Z'§Z1Jf!§X!fr;:.;~~~~::;f}JY<?*-~'5f<:W%l%"iii."S;:f»"J!ijf~\"flt::c::¥,;;?lYZ22:i:?;'l;if:?i'xY)$;~Wt~'$~';?Z.:c~~
~
~

m
~
i'/·='

}>'

._--;
zy•

t~y

&'
"~'

-,

::;:~:~

~~~~:

3. That the Petitioner undertakes to file the fair typed of
dim/underline etc. of documents, if so directed by this Hon'ble
Court.

4. That the present application is filed bonafide and in the interest
of justice.
~:~~
er.:· ..
;~<

PRAYER

It is, therefore most respectfully prayed that in view of the facts

and circumstances of the case and in the interest of justice, this

::.,.··~(.-·

<·l

Hon'ble Court may be pleased to exempt the Petitioner from filing
the

Original

Copy

and

true

typed

copy

of dim/proper

margin/underline/single line spacing of the annexures.

AND FOR THIS ACT OF KINDNESS THE PETITIONER AS IN
DUTYBOUNDSHALLEVERPRAY

Filed By:
PETITIONER

THROUGH
ROHIT MADAN & AKASH VAJPAI
ADVOCATES
496, GREATER KAILASH -I
NEW DELHI
NEW DELHI
DATED: 30/01/2016

:1\
~; :'~

"··"'

 ~~~"~~m~~~~~''''~~~&i~@t8Ke~~::w~~K5::£:&%:';@tr:;~~::~«r1r1:~fi*~;;;~'if:~~~;;s;~:c:::~t::'r~::;r:K:~'%illtri~~~~;~:::;;;,;[~tt~:i:;~

,

0

r

(~~

~~~

(_',:"

g

~
~

('

;?:~·

)J,'t1

tf/2'!6'1

·~~

.?':
~~?
;i~!
-";!,

:6:

•
IN THE HIGH COURT OF DELHI AT NEW DELHI

:i·.·

~2
~-~-;

~;~

~~l

EXTRAORDINARY ORIGINAL CIVIL JURISDICTION

rx

8i

~~

/2016

I.A.
IN

f~-

OF 2016

WP (C) NO.

IN THE. MATTER OF:
t~

~.:

LAKSH VIR SINGH YADA V

~-·-

...... PETITIONER
' ....~- -~~-::~~:.~:~---~"'-:.=.~~
/.<::::· (,.':i'\1'' c.ornn.-. :--.,..,,

/~' •'J\

~· '.::·
/? C·

,_. ,.,, ••,(\',.i ..... ;,)

~.~' ~"-~- ~,;._.·•'.·.··........

,f:i·5··LJNtoN
\\'k
1,,

~

VERSUS

. ' . ·" .' ......~...

.

.

t':·· . .
.

~~

~·~,'

OFolNDliV.:;:)ll
·..

'··'
•"

& OTHERS

...... RESPONDENTS

. .~~::-?,' . ' '. : ... ;. . \.t;:i
.,r,· /

t' 'l'· 'rl \~ ~~~-·.;:.•

··.;;,:;;;tj_tqh

~-=~;;.-;;;:.... ~

AFFIDAVIT

/-::·::~:.: :~:~-.·;·:~::;::-~~:.::-_'::.: :::-.'

r, ~~v\< .<!.l'ib'fA~~st4'.'S4n\';"0

:~\t~h~cie;V

aged about . ~ ~ Years, Petlt1011l~f::.m't~~ abo~e.naJV:edi. ffavmg my
office at e:~, poe$:) fujqvS; .~'St~~. M?w_;~(lp! ~·:#fJoiA- Do
hereby solemnly affirm and declare as'liriq·~r:>:•'~·r': 1.~ "~·~:~..:::;.-·;:•.::.::-..
...·.
·~ .:::::·.~::·.::.::.::.::..;;.::.~;;:';:...

.. ~.!!'!.'!!!!::

. ~~\Cornrn ·"
1
~-o-at"
'·~sA~'h
,..:.<.~\
· '-.1?.
at
' r..,,. I 'r\C·C)·11"'"~
'-"'. 4
(i)

/~': ~~iu~:-?.·~.-~~.~;~;~urt
•

""·

V!..~~~-· ""~4

f. PI;· ':!

I am the Pet1t10ner
··
· m
· .the abovementwne
·
· d matter
·11erem
d competent to swear by way of the present affidavit.
·

~

.

3
: · ...;r1.~.. \='(•~,: : 1 •·.•~~~~-~;,~ •• ~~hat I have read and understood the contents mentioned in the
.... ,.
\e:·· ~
··.;;~~/ present application and that content mentioned therein are true
and correct to the best of my knowledge and belief based on the
l \;..'{~
records available.
\ . e;L.~~

~~J .

\J wS "'-

DEPONENr

~ (}'~ QJ"-~I\~~L•JI.,/~~;..,
.,.,_~, . ,

~ ~·~",'<'o
)

'!§•

~

~af~fi-ld_a_v-it~a-'-r-e-t-ru-e-an-d:;-:-c:or :;:ec~t- ;t~o
.

Verified at New Delhi .onbthis
that the contents of the a ove b 1' f that no. part of it is false
·
1 wledge and e re '
otbt >best ?f my
cealed therefrom.
.
.
hC;ls been con
1 \.J
s'antk'l)Otr
r.
L.
1 , ,
<'"'
S!o .
1/,.1} i / ;)z~.
: r "···J{.........
DEPONENr
r?t-::....
, .............
.
/;,,.
.I'Ll
4· }f;j:,h.

\\;o'. ••

,s;

(.:j

",{;'

2 9 JAN 2016

....

,,.,""_.,~

.

VERIFICATION

0

f;,, . . ·....: ·

;::;,; ,,; .
. ,, ..... ,'

(,

~o
'rl~· .·~W.· at~mal
<''''?~'"

~"'

2. g/J~N.:2~Yr·~f
. .. '~ "~~~
.

..

c~rr,,; '" ;i,;_ .\,._,,,.,~::.·:. '·' :;:.:~

. :.(;.,~
;, li<'· u;,

Oau, C.:orrlfi{f;.;;ionPr

r .... ·

·

Vw.!::..J~
. /'

.~•
r.:t~

 \_;'
VAKALATNAMA
IN THE HIGH COURT OF DELHI AT NEW DELHI
BWlfNO.:.
/2016

In re:... PETITIONER

LAKSHYADAV
VERSUS

... RESPONDENT

UNION OF INDIA & OTHERS

KNOW ALL to whom these presents shall come that I LAKSH YADAV,
RIO(;:~, )(,::l~~lve.~s, NEW DELHI, the above-named Petitioner do
hereby appoint
ROHITMADAN

(ADVOCATE )(D/559/1997)(9871588064)
151 LAYWERS CHAMBER, HIGH COURT OF DELHI, NEW DELHI,.
(Hereinafter called the advocate(s) to be my/our Advocate in the above-noted
case authorize him: To act, appear and plead in the above-noted case in this Court or in any other
Court in which the same may be tried or heard and also in the appellate Court.
To sign, file, verify and present pleadings, replications, appeals, cross-objections
or petitions for executions review, revision, restoration, withdrawal, compromise
or other petitions or affidavits or other documents as may be deemed necessary or
proper for the prosecution of the said case in all its stages. To file and take back
the documents.
To withdraw or compromise the said case or submit to arbitration any differences
or disputes that may arise touching or in any manner relating to the said case.
To appoint and instruct any other Legal Practitioner, Advocate, Senior Advocate
authorising him to exercise the power and authority hereby conferred upon the
Advocate whenever he may think fit to do so and to sign the power of attorney on
my/our behalf.
And I/we the undersigned do hereby agree to ratify and confirm all acts done by
the Advocate or his substitute in the matter as my/our own acts, as if done by
me/us to all intents and purposes.
And 1/we undertake that I/we or my/our duly authorised agent would appear in
Court on all hearings and will inform the Advocate for appearance when the case
is called out.
·
And I/we undersigned do hereby agree not to hold the advocate or his substitute
responsible for the result of consequence of his absence from the Court when the
s~id case for hearing or for any negligence of the said Advocate or his substitute.

In witness where of I/we do hereunto set my/our hand to these
presents the contents of which been understood by me/us on this
'1 ~ """'lay of .. C)\ .
2016.
\
~ r-...

w~

~

ADVOCATE..-

'

\J •(,

L*~v... w ~~""'
1

CLI~T

IJ\

1

J

;e:;oa.v