Editing CJEU - C-342/12 - Worten

From GDPRhub

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.

Latest revision Your text
Line 45: Line 45:
 
=== Facts ===
 
=== Facts ===
 
On 9 March 2010, the ACT carried out an inspection at a Worten establishment. As a result of the inspection, an official report was drawn up, the main message being that the working time register, as required by national law, was not available for immediate consultation by the ACT.  
 
On 9 March 2010, the ACT carried out an inspection at a Worten establishment. As a result of the inspection, an official report was drawn up, the main message being that the working time register, as required by national law, was not available for immediate consultation by the ACT.  
 
 
The report was followed by an order to provide the legally required information from the labour register.
 
The report was followed by an order to provide the legally required information from the labour register.
 
 
Two years later, by decision of 14 March 2020, the ACT found that Worten had committed a serious breach of labour law for breaching the rules on the working time register set out in Article 202(1) of the Labour Code, as Worten had failed to allow the ACT to immediately consult the working time register of the workers employed in the establishment concerned. The infringement was considered to be grave because the purpose of the working time register is to check immediately and rapidly whether the undertaking's activity is organised in accordance with the rules on working time. A fine of EUR 2 000 was imposed.
 
Two years later, by decision of 14 March 2020, the ACT found that Worten had committed a serious breach of labour law for breaching the rules on the working time register set out in Article 202(1) of the Labour Code, as Worten had failed to allow the ACT to immediately consult the working time register of the workers employed in the establishment concerned. The infringement was considered to be grave because the purpose of the working time register is to check immediately and rapidly whether the undertaking's activity is organised in accordance with the rules on working time. A fine of EUR 2 000 was imposed.
 
Worten then brought an action for the annulment of the decision before the Tribunal do Trabalho de Viseu.  
 
Worten then brought an action for the annulment of the decision before the Tribunal do Trabalho de Viseu.  
 
 
The Tribunal decided to stay the proceedings and requested the Court of Justice to give a preliminary ruling on the following questions:
 
The Tribunal decided to stay the proceedings and requested the Court of Justice to give a preliminary ruling on the following questions:
 
+
‘(1)      Is Article 2 of Directive 95/46 … to be interpreted as meaning that the record of working time, that is, the indication, in relation to each worker, of the times when working hours begin and end, as well as the corresponding breaks and intervals, is included within the concept of “personal data”?
# Is Article 2 of Directive 95/46 … to be interpreted as meaning that the record of working time, that is, the indication, in relation to each worker, of the times when working hours begin and end, as well as the corresponding breaks and intervals, is included within the concept of “personal data”?
+
(2)      If so, is the Portuguese State obliged, under Article 17(1) of Directive 95/46 … to provide for appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network?
# If so, is the Portuguese State obliged, under Article 17(1) of Directive 95/46 … to provide for appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network?
+
(3)      Likewise, if Question 2 is answered in the affirmative, when the Member State does not adopt any measure pursuant to Article 17(1) of Directive 95/46 … and when an employer, as a controller of such data, adopts a system of restricted access to those data which does not allow automatic access by the national authority responsible for monitoring working conditions, is the principle of the primacy of European law to be interpreted as meaning that the Member State cannot penalise that employer for such behaviour?’
# Likewise, if Question 2 is answered in the affirmative, when the Member State does not adopt any measure pursuant to Article 17(1) of Directive 95/46 … and when an employer, as a controller of such data, adopts a system of restricted access to those data which does not allow automatic access by the national authority responsible for monitoring working conditions, is the principle of the primacy of European law to be interpreted as meaning that the Member State cannot penalise that employer for such behaviour?’
 
  
 
=== Holding ===
 
=== Holding ===
 
The Court gives the following answers to the questions referred for a preliminary ruling.
 
The Court gives the following answers to the questions referred for a preliminary ruling.
 
Regarding the first question, "Must Article 2 of Directive 95/46/EC be interpreted as meaning that the recording of working time - that is, the recording, for each worker, of the beginning and end of the working period and of breaks or rest periods not included in that period - is to be regarded as personal data?
 
Regarding the first question, "Must Article 2 of Directive 95/46/EC be interpreted as meaning that the recording of working time - that is, the recording, for each worker, of the beginning and end of the working period and of breaks or rest periods not included in that period - is to be regarded as personal data?
 
 
The Court considers that the data contained in the working time register, relating to daily working periods and rest periods for each employee, constitute personal data within the meaning of Article 2(a) of Directive 95/46/EC, as they are 'information relating to an identified or identifiable natural person'. The Court refers in its answer, inter alia, to the judgments of 20 May 2003 in Joined Cases C-465/00, C-138/01 and C-139/01 Österreicherischer Rundfunk and Others [2003] ECR I 4989, paragraph 64; 16 December 2008 in Case C 524/06 Huber [2008] ECR I 9705, paragraph 43 and 7 May 2009 in Case C 553/07 Rijkeboer [2009] ECR I 3889, paragraph 42).
 
The Court considers that the data contained in the working time register, relating to daily working periods and rest periods for each employee, constitute personal data within the meaning of Article 2(a) of Directive 95/46/EC, as they are 'information relating to an identified or identifiable natural person'. The Court refers in its answer, inter alia, to the judgments of 20 May 2003 in Joined Cases C-465/00, C-138/01 and C-139/01 Österreicherischer Rundfunk and Others [2003] ECR I 4989, paragraph 64; 16 December 2008 in Case C 524/06 Huber [2008] ECR I 9705, paragraph 43 and 7 May 2009 in Case C 553/07 Rijkeboer [2009] ECR I 3889, paragraph 42).
 
 
Consequently, the collection, recording, organisation, storage, access and use of such data by an employer and their transmission to the national authorities responsible for monitoring employment conditions constitute 'the processing of personal data' within the meaning of Article 2(b) of Directive 95/46 (see, to that effect, inter alia, Österreichischer Rundfunk and Others, cited above, paragraph 64, and Huber, cited above, paragraph 43).
 
Consequently, the collection, recording, organisation, storage, access and use of such data by an employer and their transmission to the national authorities responsible for monitoring employment conditions constitute 'the processing of personal data' within the meaning of Article 2(b) of Directive 95/46 (see, to that effect, inter alia, Österreichischer Rundfunk and Others, cited above, paragraph 64, and Huber, cited above, paragraph 43).
 
 
The Court deals with the second and third questions together. The national court wishes to know whether Article 17(1) of Directive 95/46 must be interpreted as requiring each Member State to implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access and, if so, whether a Member State which has not implemented such measures may penalise an employer who, as the data controller, has established a system of restricted access to those data which is not immediately accessible to the national authority responsible for monitoring employment conditions.
 
The Court deals with the second and third questions together. The national court wishes to know whether Article 17(1) of Directive 95/46 must be interpreted as requiring each Member State to implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access and, if so, whether a Member State which has not implemented such measures may penalise an employer who, as the data controller, has established a system of restricted access to those data which is not immediately accessible to the national authority responsible for monitoring employment conditions.
 
 
However, that article does not oblige the Member States - unless they are responsible for the processing - to adopt those technical and organisational measures, since the obligation to adopt such measures rests solely with the controller, in this case the employer. That provision, on the other hand, obliges the Member States to include in their national law a provision laying down that obligation.
 
However, that article does not oblige the Member States - unless they are responsible for the processing - to adopt those technical and organisational measures, since the obligation to adopt such measures rests solely with the controller, in this case the employer. That provision, on the other hand, obliges the Member States to include in their national law a provision laying down that obligation.
 
Worten takes the view that the obligation to make the register available for immediate consultation is, in practice, incompatible with the obligation to establish a system providing adequate protection for the data contained in that register. Such an obligation would result in any employee of the undertaking concerned having access to those data, in breach of the obligation in Article 17(1) of Directive 95/46 to ensure the security of those data. Such generalised access would therefore deprive that provision of any useful effect.
 
Worten takes the view that the obligation to make the register available for immediate consultation is, in practice, incompatible with the obligation to establish a system providing adequate protection for the data contained in that register. Such an obligation would result in any employee of the undertaking concerned having access to those data, in breach of the obligation in Article 17(1) of Directive 95/46 to ensure the security of those data. Such generalised access would therefore deprive that provision of any useful effect.
  
 
The court considers that the argument cannot succeed. Since the employer is under an obligation to give immediate access to the working time register to the national authority responsible for monitoring working conditions. This in no way implies that the personal data in that register must necessarily be made accessible on that sole ground to persons who are not authorised to do so. The controller is responsible for ensuring that security measures are taken in line with the risks and that the accesses deemed necessary by the legislator are also guaranteed.
 
The court considers that the argument cannot succeed. Since the employer is under an obligation to give immediate access to the working time register to the national authority responsible for monitoring working conditions. This in no way implies that the personal data in that register must necessarily be made accessible on that sole ground to persons who are not authorised to do so. The controller is responsible for ensuring that security measures are taken in line with the risks and that the accesses deemed necessary by the legislator are also guaranteed.
 
 
The Court considers that the answer to the second and third questions is that Article 6(1)(b) and (c) and Article 7(c) and (e) of Directive 96/46 must be interpreted as not precluding national legislation, such as that at issue in the main proceedings, which requires an employer to make a register of working time available to the national authority responsible for monitoring working conditions, on request, in so far as that requirement is necessary to enable that authority to carry out the task of monitoring the application of legislation on working conditions, in particular as regards working time.
 
The Court considers that the answer to the second and third questions is that Article 6(1)(b) and (c) and Article 7(c) and (e) of Directive 96/46 must be interpreted as not precluding national legislation, such as that at issue in the main proceedings, which requires an employer to make a register of working time available to the national authority responsible for monitoring working conditions, on request, in so far as that requirement is necessary to enable that authority to carry out the task of monitoring the application of legislation on working conditions, in particular as regards working time.
  

Please note that all contributions to GDPRhub are considered to be released under the Creative Commons Attribution-NonCommercial-ShareAlike (see GDPRhub:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please answer the question that appears below (more info):

Cancel Editing help (opens in new window)

Template used on this page: