2. Article 17(3)(e) of Regulation 2016/679

must be interpreted as meaning that that provision does not formulate an alternative lawfulness condition which processing could satisfy in order to comply with Article 5(1)(a) of that regulation and which is distinct from any of those listed in the first subparagraph of Article 6(1) of that regulation.

2. Article 17(3)(b) of Regulation 2016/679, read in conjunction with point (c) of the first subparagraph of Article 6(1)and Article 6(3) thereof, and in the light of Article 52(1) of the Charter of Fundamental Rights of the European Union,

must be interpreted as meaning that the storage, in the personnel file of a police officer, for the purposes of the management of his career and the monitoring of compliance, by that staff member, with the rules inherent in his or her duties, of personal data relating to his or her status as a suspect in a suspended criminal investigation, where that officer has not been accused of or faced criminal charges for the offence concerned, may be regarded as justified for the purposes of compliance with a legal obligation to which the public authority, the employer of that officer, is subject on the basis of national law, provided that that legal basis is clear and precise, that its application is foreseeable for data subjects and that that obligation meets an objective of public interest and is proportionate to that objective.

Directive 2017/1132, in particular Article 16, and Article 17 of Regulation 2016/679 preclude Member State legislation or practice under which the authority keeping the commercial register refuses to erase personal data from a company's constitutive instrument published in that register, even where those data are not required by that directive or by national law, because the applicant did not provide a redacted copy of the instrument as required by national procedural rules.

Under Article 58(2)(d) and (g) of Regulation 2016/679, a Member State supervisory authority may, in the exercise of its corrective powers, order a controller or processor to erase unlawfully processed personal data even though the data subject has made no request for erasure under Article 17(1).

A controller must erase unlawfully processed personal data as soon as possible.

A controller's failure to comply with Articles 26 or 30 of Regulation 2016/679 does not by itself make the processing unlawful or give the data subject a right to erasure under Article 17(1)(d) or restriction under Article 18(1)(b). That remains so provided that the failure does not, as such, amount to an infringement of the principle of accountability in Article 5(2), read with Article 5(1)(a) and the first subparagraph of Article 6(1).

In the balancing exercise between the rights in Articles 7 and 8 of the Charter and the right in Article 11 of the Charter, a search engine cannot make de-referencing of links to content alleged to be inaccurate conditional on the accuracy of that content having been resolved, even provisionally, in proceedings brought by the requester against the content provider.

When balancing the rights in Articles 7 and 8 of the Charter against the right in Article 11 of the Charter on a request to remove thumbnail photographs from an image search based on a natural person's name, the informative value of those photographs must be assessed regardless of the context of their publication on the webpage from which they are taken. Any text that directly accompanies the display of those photographs in the search results, and is capable of shedding light on their informative value, must also be taken into account.

A subscriber's request to have personal data removed from publicly available telephone directories and directory enquiry services is an exercise of the right to erasure.

Article 17(2) does not preclude a national supervisory authority from ordering a provider of publicly available telephone directories and directory enquiry services, after a subscriber has asked it to stop disclosing that subscriber's personal data, to take reasonable steps to inform search engine providers of that erasure request.

Where a search engine operator grants a de-referencing request under Article 12(b) or Article 14(a) of Directive 95/46, or under Article 17(1) of Regulation 2016/679, it need not carry out that de-referencing on all versions of its search engine. It must do so on the versions corresponding to all Member States and, where necessary, use measures that effectively prevent - or at least seriously discourage - an internet user searching from a Member State on the basis of the data subject's name from accessing, via the results list, the links covered by the request.