12/10/2019 CURIA - Documents 34 By its first question, the referring court essentially asks whether the provisions of Article 8(1) and (5) of Directive 95/46 must be interpreted as meaning that the prohibition or restrictions relating to the processing of special categories of personal data, mentioned in those provisions, apply also, subject to the exceptions provided for by the directive, to the operator of a search engine in the context of his responsibilities, powers and capabilities as the controller of the processing carried out for the needs of the functioning of the search engine. 35 It must be recalled, first, that the activity of a search engine consisting in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and, finally, making it available to internet users according to a particular order of preference must be classified as ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 when that information contains personal data and, second, that the operator of the search engine must be regarded as the ‘controller’ in respect of that processing within the meaning of Article 2(d) of that directive (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 41). 36 The processing of personal data in the context of the activity of a search engine can be distinguished from and is additional to that carried out by publishers of websites, consisting in loading those data on an internet page, and that activity plays a decisive role in the overall dissemination of those data in that it renders the latter accessible to any internet user making a search on the basis of the data subject’s name, including to internet users who otherwise would not have found the web page on which those data are published. Moreover, the organisation and aggregation of information published on the internet that are effected by search engines with the aim of facilitating their users’ access to that information may, when users carry out their search on the basis of an individual’s name, result in them obtaining through the list of results a structured overview of the information relating to that individual that can be found on the internet, enabling them to establish a more or less detailed profile of the data subject (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraphs 35 to 37). 37 Consequently, in so far as the activity of a search engine is liable to affect significantly, and additionally compared with that of the publishers of websites, the fundamental rights to privacy and to the protection of personal data, the operator of the search engine as the person determining the purposes and means of that activity must ensure, within the framework of his responsibilities, powers and capabilities, that the activity meets the requirements of Directive 95/46 in order that the guarantees laid down by the directive may have full effect and that effective and complete protection of data subjects, in particular of their right to privacy, may actually be achieved (judgment of 13 May 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 38). 38 The first question referred aims to determine whether, in the context of his responsibilities, powers and capabilities, the operator of a search engine must also comply with the requirements laid down by Directive 95/46 with respect to the special categories of personal data mentioned in Article 8(1) and (5) of the directive, where such data are among the information published or placed on the internet by third parties and are the subject of processing by that operator for the purposes of the functioning of his search engine. 39 As regards the special categories of data, Article 8(1) of Directive 95/46 provides that the Member States are to prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of data concerning health or sex life. Certain exceptions to and derogations from that prohibition are provided for inter alia in Article 8(2) of the directive. 40 Article 8(5) of Directive 95/46 states that the processing of data relating to offences, criminal convictions or security measures may be carried out only under the control of official authority, or if suitable specific safeguards are provided under national law, subject to derogations which may be granted by the Member State under national provisions providing suitable specific safeguards. However, a complete register of criminal convictions may be kept only under the control of official authority. Member States may provide that data relating to administrative sanctions or judgments in civil cases are also to be processed under the control of official authority. curia.europa.eu/juris/document/document_print.jsf?docid=218106&text=&dir=&doclang=EN&part=1&occ=first&mode=DOC&pageIndex=0&cid=2571804 11/19