Facts

Portuguese law requires every employer to keep a record of hours worked by each of their employees in a location that is accessible and in such a way that it can be consulted immediately. The record must set out the times when the working hours begin and end, as well as breaks, so as to allow calculation of the number of hours worked by each employee. The law gives ACT inspectors the right to demand immediate examination of all relevant documents. ACT is the Portuguese Authority for Working Conditions.

On 9 March 2010, ACT carried out an inspection at Worten’s establishment in Viseu, following which it produced a report stating that:

• Worten employed four workers in that establishment working on a rotating shift;
• the record of working time, setting out the daily work periods, the daily and weekly rest periods and the calculation of the daily and weekly working hours of the workers was not accessible for immediate consultation;
• the workers recorded their working hours by inserting a magnetic card into a time clock installed in the premises of a store located beside the inspected premises;
• not only was the record of working time not accessible to any worker, but it could also be consulted only by the person who had computerised access to it, namely the regional manager of Worten, who was not present at the time of the inspection; in such a case, only Worten’s central human resources department could provide the data in that register.

On 15 March 2010, in response to a notice to present documents, the record of working time, setting out the legally required data, was submitted to ACT.

By a decision of 14 March 2012, ACT found that Worten had committed a serious administrative offence since it had not permitted ACT to carry out an immediate consultation, in the establishment concerned, of the record of the working time of the workers employed in that establishment. The serious nature of the offence was stated to arise from the fact that the record of working time allows quick and direct verification of whether the organisation of an undertaking’s activities complies with the regulations concerning working hours. Consequently, ACT imposed a fine of € 2,000 on Worten.

National proceedings

Worten brought an action for annulment against that decision before the Tribunal do trabalho de Viseu. It decided to stay the proceedings and refer the following questions to the ECJ for a preliminary ruling:

“1. Is Article 2 of Directive 95/46 to be interpreted as meaning that the record of working time is included within the concept of ‘personal data’? 
2. If so, is the Portuguese State obliged, under Article 17(1) of Directive 95/46, to provide for appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network? 
3. Likewise, if Question 2 is answered in the affirmative, when the Member State does not adopt any measure pursuant to Article 17(1) of Directive 95/46 and when an employer, as a controller of such data, adopts a system of restricted access to those data which does not allow automatic access by the national authority responsible for monitoring working conditions, is the principle of the primacy of European law to be interpreted as meaning that the Member State cannot penalise that employer for such behaviour?”

ECJ’s findings

1. A record of working time constitutes ‘personal data’ within the meaning of Directive 95/46 (§ 18-22).
2. Contrary to the premise on which the second and third question are based, Article 17(1) of Directive 95/46 does not require Member States to adopt technical and organisational measures to protect personal data against unauthorised disclosure etc., except where a Member State is itself the ‘controller’ as defined in the Directive. In the present case, Worten was the ‘controller’, not the Portuguese State (§ 23-26).
3. Worten argues that the obligation to make available the record of working time so as to allow its immediate consultation is, in practice, incompatible with the obligation to establish an adequate system of protection of the personal data contained in that record. The ECJ rejects this argument. The obligation of an employer (as a ‘controller’ of personal data) to provide the national authority responsible for monitoring working conditions immediate access to the record of working time in no way implies that the personal data contained in that record must necessarily, on that ground alone, be made available to unauthorised persons. Accordingly, it does not appear that Article 17(1) of Directive 95/46 is relevant for the purposes of resolving the dispute in the main proceedings (§ 27-29).
4. Under Article 7(c) and (e) of the directive, the processing of personal data is permissible only if it is “necessary for compliance with a legal obligation to which the controller is subject”. According to the European Commission, although Directive 2003/88 does not expressly require Member States to adopt legislation such as that at issue in the main proceedings, the monitoring of compliance with the obligations imposed by that directive pursues the establishment of surveillance measures. In the Commission’s view, the employer’s obligation to allow immediate consultation of the record of working time ensures that data are not altered during the interval between the inspection visit carried out by the competent national authorities and the actual verification of those data by those authorities (§ 30-41).
5. Worten claims, by contrast, that this obligation is excessive, given the interference it entails in workers’ private lives. First, the record of working time is intended to provide workers with a means of proving the hours they have actually worked. The authenticity of that record has not been contested in the main proceedings. Secondly, that record allows the assessment of average working times, for the purposes of monitoring, inter alia, working hours exemptions. For that purpose, the immediate availability of those records does not, according to Worten, provide any added value. Moreover, the information in that record could be submitted subsequently (§ 42).
6. 6. In the present case, it is for the referring court to examine whether the employer’s obligation to provide the competent national authority access to the record of working time so as to allow its immediate consultation can be considered necessary for the purposes of the performance by that authority of its monitoring task, by contributing to the more effective application of the legislation relating to working conditions, in particular as regards working time (§ 43). 
7. In that respect, it must also be noted that, in any case, if such an obligation is considered necessary to achieving that objective, the penalties imposed with a view to ensuring the effective application of the requirements laid down by Directive 2003/88 must also respect the principle of proportionality, which it is also for the referring court to verify in the main proceedings (§ 44).

Ruling

Article 2(a) of Directive 95/46 […] is to be interpreted as meaning that a record of working time, such as that at issue in the main proceedings, which indicates, in relation to each worker, the times when working hours begin and end, as well as the corresponding breaks and intervals, is included within the concept of ‘personal data’, within the meaning of that provision.

Article 6(1)(b) and (c) and (e) of Directive 95/46 do not preclude national legislation, such as that at issue in the main proceedings, which requires an employer to make the record of working time available to the national authority responsible for monitoring working conditions, so as to allow its immediate consultation, provided that this obligation is necessary for the purposes of the performance by that authority of its task of monitoring the application of the legislation relating to working conditions, in particular as regards working time.