12/10/2019 CURIA - Documents 55 In accordance with Article 17(1) of the regulation, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase those data without undue delay where one of the grounds set out in that provision applies. As grounds, the provision mentions the cases in which the personal data are no longer necessary in relation to the purposes for which they were processed; the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; the data subject objects to the processing pursuant to Article 21(1) or (2) of the regulation, which replaces Article 14 of Directive 95/46; the data have been unlawfully processed; the data have to be erased for compliance with a legal obligation; or the data have been collected in relation to the offer of information society services to children. 56 However, Article 17(3) of Regulation 2016/679 states that Article 17(1) of the regulation is not to apply to the extent that the processing is necessary on one of the grounds set out in Article 17(3). Among those grounds is, in Article 17(3)(a) of the regulation, the exercise of the right of freedom of expression and information. 57 The circumstance that Article 17(3)(a) of Regulation 2016/679 now expressly provides that the data subject’s right to erasure is excluded where the processing is necessary for the exercise of the right of information, guaranteed by Article 11 of the Charter, is an expression of the fact that the right to protection of personal data is not an absolute right but, as recital 4 of the regulation states, must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see also judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C-92/09 and C-93/09, EU:C:2010:662, paragraph 48, and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraph 136). 58 In that context, it should be recalled that Article 52(1) of the Charter accepts that limitations may be imposed on the exercise of rights such as those set forth in Articles 7 and 8 of the Charter, as long as the limitations are provided for by law, respect the essence of those rights and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others (judgment of 9 November 2010, Volker und Markus Schecke and Eifert, C-92/09 and C-93/09, EU:C:2010:662, paragraph 50). 59 Regulation 2016/679, in particular Article 17(3)(a), thus expressly lays down the requirement to strike a balance between the fundamental rights to privacy and protection of personal data guaranteed by Articles 7 and 8 of the Charter, on the one hand, and the fundamental right of freedom of information guaranteed by Article 11 of the Charter, on the other. 60 It is in the light of those considerations that an examination must be made of the conditions in which the operator of a search engine is required to accede to a request for de-referencing and thus to delete from the list of results displayed following a search on the basis of the data subject’s name the link to a web page on which there are personal data falling within the special categories in Article 8(1) and (5) of Directive 95/46. 61 It must be stated, to begin with, that the processing by the operator of a search engine of the special categories of data referred to in Article 8(1) of Directive 95/46 is capable in principle of being covered by the exceptions in Article 8(2)(a) and (e), mentioned by the referring court, which provides that the prohibition is not to apply where the data subject has given his or her explicit consent to such processing, except where the laws of the Member State concerned prohibit such consent, or where the processing relates to data which are manifestly made public by the data subject. Those exceptions have now been repeated in Article 9(2)(a) and (e) of Regulation 2016/679. In addition, Article 9(2)(g) of the regulation, which essentially reproduces Article 8(4) of Directive 95/46, allows the processing of those categories of data where it is necessary for reasons of substantial public interest, on the basis of European Union or Member State law which must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. curia.europa.eu/juris/document/document_print.jsf?docid=218106&text=&dir=&doclang=EN&part=1&occ=first&mode=DOC&pageIndex=0&cid=2571804 14/19