Guidelines 05/2019 on criteria of the Right to be Forgotten in search engines

1.4 Ground 4:   The Right to request delisting when the personal data have been unlawfully processed (Article 17.1.d)

34. According to Article 17.1.d GDPR, a data subject may request the erasure of personal data concerning him or her in the instance where they have been unlawfully processed.

35. The notion of unlawful processing shall first be interpreted in view of Article 6 GDPR dedicated to lawfulness of processing. Other principles established under the GDPR (such as principles of Article 5 GDPR or of other provisions of Chapter II) may serve such interpretation.

36. This notion shall secondly be interpreted broadly, as the infringement of a legal provision other than the GDPR. Such interpretation must be conducted objectively by Supervisory Authorities, according to national laws or to a court decision. For instance, a delisting request shall be granted in the event where the listing of personal information has been expressly prohibited by a court order. In cases where a search engine provider is not able to demonstrate a legal basis for its processing, a delisting request may fall under the scope of art 17.1.d GDPR, as the processing of personal data in such cases must be considered unlawful. Nonetheless, it must be reminded that in case of unlawfulness of the original processing, the data subject remains entitled to request delisting under Article 17.1.c GDPR.