12/10/2019 CURIA - Documents 41 The content of Article 8(1) and (5) of Directive 95/46 was taken over, with some changes, in Article 9(1) and Article 10 of Regulation 2016/679. 42 It must be stated, first, that it is apparent from the wording of those provisions of Directive 95/46 and Regulation 2016/679 that the prohibition and restrictions laid down by them apply, subject to the exceptions provided for by the directive and the regulation, to every kind of processing of the special categories of data referred to in those provisions and to all controllers carrying out such processing. 43 Next, no other provision of that directive or that regulation provides for a general derogation from that prohibition or those restrictions for processing such as that carried out in the context of the activity of a search engine. On the contrary, as already pointed out in paragraph 37 above, it follows from the general scheme of those instruments that the operator of a search engine must, in the same way as any other controller, ensure, in the context of his responsibilities, powers and capabilities, that the processing of personal data carried out by him complies with the respective requirements of Directive 95/46 or Regulation 2016/679. 44 Finally, an interpretation of Article 8(1) and (5) of Directive 95/46 or Article 9(1) and Article 10 of Regulation 2016/679 that excluded a priori and generally the activity of a search engine from the specific requirements laid down by those provisions for processing relating to the special categories of data referred to there would run counter to the purpose of those provisions, namely to ensure enhanced protection as regards such processing, which, because of the particular sensitivity of the data, is liable to constitute, as also follows from recital 33 of that directive and recital 51 of that regulation, a particularly serious interference with the fundamental rights to privacy and the protection of personal data, guaranteed by Articles 7 and 8 of the Charter. 45 While, contrary to the submissions of Google in particular, the specific features of the processing carried out by the operator of a search engine in connection with the activity of the search engine cannot thus justify the operator being exempted from compliance with Article 8(1) and (5) of Directive 95/46 and Article 9(1) and Article 10 of Regulation 2016/679, those specific features may, however, have an effect on the extent of the operator’s responsibility and obligations under those provisions. 46 It must be observed in this respect that, as the European Commission emphasises, the operator of a search engine is responsible not because personal data referred to in those provisions appear on a web page published by a third party but because of the referencing of that page and in particular the display of the link to that web page in the list of results presented to internet users following a search on the basis of an individual’s name, since such a display of the link in such a list is liable significantly to affect the data subject’s fundamental rights to privacy and to the protection of the personal data relating to him (see, to that effect, judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 80). 47 In those circumstances, having regard to the responsibilities, powers and capabilities of the operator of a search engine as the controller of the processing carried out in connection with the activity of the search engine, the prohibitions and restrictions in Article 8(1) and (5) of Directive 95/46 and Articles 9(1) and 10 of Regulation 2016/679 — as indicated by the Advocate General in point 56 of his Opinion and as stated in essence by all the parties who have expressed an opinion on the point — can apply to that operator only by reason of that referencing and thus via a verification, under the supervision of the competent national authorities, on the basis of a request by the data subject. 48 It follows from the above that the answer to Question 1 is that the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out in connection with the activity of the search engine, on the occasion of a verification performed by that operator, under the supervision of the competent national authorities, following a request by the data subject. Question 2 49 By its second question, which consists of three parts, the referring court essentially asks curia.europa.eu/juris/document/document_print.jsf?docid=218106&text=&dir=&doclang=EN&part=1&occ=first&mode=DOC&pageIndex=0&cid=2571804 12/19