BIANCARDI v. ITALY JUDGMENT Protection Working Party, WP 225). The second part of the guidelines concerns common criteria which the data protection authorities were invited to apply when handling complaints following refusals by search engines to de-list search results. The thirteenth criterion reads as follows: “Does the data relate to a criminal offence? EU Member States may have different approaches as to the public availability of information about offenders and their offences. Specific legal provisions may exist which have an impact on the availability of such information over time. DPAs will handle such cases in accordance with the relevant national principles and approaches. As a rule, DPAs are more likely to consider the de-listing of search results relating to relatively minor offences that happened a long time ago, whilst being less likely to consider the de-listing of results relating to more serious ones that happened more recently. However, these issues call for careful consideration and will be handled on a case-by-case basis.” D. The General Data Protection Regulation 28. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation – hereinafter “the GDPR”), OJ 2016 L 119 p. 1, which entered into force on 24 May 2016 and repealed Directive 95/46/EC with effect from 25 May 2018. The relevant provision of the GDPR read as follows: Article 17 – Right to erasure (“right to be forgotten”) “1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; ... 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; ... (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right 12