03/02/2020
CURIA - Documents
disclosure by transmission, dissemination or otherwise making available, alignment or combination,
blocking, erasure or destruction’.
26 As regards in particular the internet, the Court has already had occasion to state that the operation of
loading personal data on an internet page must be considered to be such ‘processing’ within the
meaning of Article 2(b) of Directive 95/46 (see Case C-101/01 Lindqvist EU:C:2003:596,
paragraph 25).
27 So far as concerns the activity at issue in the main proceedings, it is not contested that the data found,
indexed and stored by search engines and made available to their users include information relating to
identified or identifiable natural persons and thus ‘personal data’ within the meaning of Article 2(a) of
that directive.
28 Therefore, it must be found that, in exploring the internet automatically, constantly and systematically
in search of the information which is published there, the operator of a search engine ‘collects’ such
data which it subsequently ‘retrieves’, ‘records’ and ‘organises’ within the framework of its indexing
programmes, ‘stores’ on its servers and, as the case may be, ‘discloses’ and ‘makes available’ to its
users in the form of lists of search results. As those operations are referred to expressly and
unconditionally in Article 2(b) of Directive 95/46, they must be classified as ‘processing’ within the
meaning of that provision, regardless of the fact that the operator of the search engine also carries out
the same operations in respect of other types of information and does not distinguish between the latter
and the personal data.
29 Nor is the foregoing finding affected by the fact that those data have already been published on the
internet and are not altered by the search engine.
30 The Court has already held that the operations referred to in Article 2(b) of Directive 95/46 must also
be classified as such processing where they exclusively concern material that has already been
published in unaltered form in the media. It has indeed observed in that regard that a general derogation
from the application of Directive 95/46 in such a case would largely deprive the directive of its effect
(see, to this effect, Case C-73/07 Satakunnan Markkinapörssi and Satamedia EU:C:2008:727,
paragraphs 48 and 49).
31 Furthermore, it follows from the definition contained in Article 2(b) of Directive 95/46 that, whilst the
alteration of personal data indeed constitutes processing within the meaning of the directive, the other
operations which are mentioned there do not, on the other hand, in any way require that the personal
data be altered.
32 As to the question whether the operator of a search engine must be regarded as the ‘controller’ in
respect of the processing of personal data that is carried out by that engine in the context of an activity
such as that at issue in the main proceedings, it should be recalled that Article 2(d) of Directive 95/46
defines ‘controller’ as ‘the natural or legal person, public authority, agency or any other body which
alone or jointly with others determines the purposes and means of the processing of personal data’.
33 It is the search engine operator which determines the purposes and means of that activity and thus of
the processing of personal data that it itself carries out within the framework of that activity and which
must, consequently, be regarded as the ‘controller’ in respect of that processing pursuant to Article 2(d).
34 Furthermore, it would be contrary not only to the clear wording of that provision but also to its
objective — which is to ensure, through a broad definition of the concept of ‘controller’, effective and
complete protection of data subjects — to exclude the operator of a search engine from that definition
on the ground that it does not exercise control over the personal data published on the web pages of
third parties.
35 In this connection, it should be pointed out that the processing of personal data carried out in the
context of the activity of a search engine can be distinguished from and is additional to that carried out
by publishers of websites, consisting in loading those data on an internet page.
curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=DOC&docid=152065&occ=first&dir=&cid=667631
9/19