Directive 2017/1132, in particular Article 16, and Article 17 of Regulation 2016/679 preclude Member State legislation or practice under which the authority keeping the commercial register refuses to erase personal data from a company's constitutive instrument published in that register, even where those data are not required by that directive or by national law, because the applicant did not provide a redacted copy of the instrument as required by national procedural rules.

Under Article 58(2)(d) and (g) of Regulation 2016/679, a Member State supervisory authority may, in the exercise of its corrective powers, order a controller or processor to erase unlawfully processed personal data even though the data subject has made no request for erasure under Article 17(1).

A controller must erase unlawfully processed personal data as soon as possible.

A controller's failure to comply with Articles 26 or 30 of Regulation 2016/679 does not by itself make the processing unlawful or give the data subject a right to erasure under Article 17(1)(d) or restriction under Article 18(1)(b). That remains so provided that the failure does not, as such, amount to an infringement of the principle of accountability in Article 5(2), read with Article 5(1)(a) and the first subparagraph of Article 6(1).

In the balancing exercise between the rights in Articles 7 and 8 of the Charter and the right in Article 11 of the Charter, a search engine cannot make de-referencing of links to content alleged to be inaccurate conditional on the accuracy of that content having been resolved, even provisionally, in proceedings brought by the requester against the content provider.

When balancing the rights in Articles 7 and 8 of the Charter against the right in Article 11 of the Charter on a request to remove thumbnail photographs from an image search based on a natural person's name, the informative value of those photographs must be assessed regardless of the context of their publication on the webpage from which they are taken. Any text that directly accompanies the display of those photographs in the search results, and is capable of shedding light on their informative value, must also be taken into account.

A subscriber's request to have personal data removed from publicly available telephone directories and directory enquiry services is an exercise of the right to erasure.

Article 17(2) does not preclude a national supervisory authority from ordering a provider of publicly available telephone directories and directory enquiry services, after a subscriber has asked it to stop disclosing that subscriber's personal data, to take reasonable steps to inform search engine providers of that erasure request.

Where a search engine operator grants a de-referencing request under Article 12(b) or Article 14(a) of Directive 95/46, or under Article 17(1) of Regulation 2016/679, it need not carry out that de-referencing on all versions of its search engine. It must do so on the versions corresponding to all Member States and, where necessary, use measures that effectively prevent - or at least seriously discourage - an internet user searching from a Member State on the basis of the data subject's name from accessing, via the results list, the links covered by the request.