Worten — Equipamentos para o Lar SA v Autoridade para as Condições de Trabalho (ACT).
Date: 2013-05-30
19. In that respect, it suffices to note that, as maintained by all of the interested parties who submitted written observations, the data contained in a record of working time such as that at issue in the main proceedings, which concern, in relation to each worker, the daily work periods and rest periods, constitute personal data within the meaning of Article 2(a) of Directive 95/46, because they represent ‘information relating to an identified or identifiable natural person’ (see, to that effect, inter alia, Joined Cases C‑465/00, C‑138/01 and C‑139/01 Österreichischer Rundfunk and Others  [2003] ECR I‑4989, paragraph 64; Case C‑524/06 Huber  [2008] ECR I‑9705, paragraph 43; and Case C‑553/07 Rijkeboer [2009] ECR I‑3889, paragraph 42).
20. The collection, recording, organisation, storage, consultation, and use of such data by an employer, as well as their transmission by that employer to the national authorities responsible for monitoring working conditions, thus represent the ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 (see, to that effect, inter alia, Österreichischer Rundfunk and Others , paragraph 64, and Huber , paragraph 43).
22. Therefore, the answer to the first question is that Article 2(a) of Directive 95/46 is to be interpreted as meaning that a record of working time, such as that at issue in the main proceedings, containing the indication, in relation to each worker, of the times when working hours begin and end, as well as the corresponding breaks and intervals, constitutes ‘personal data’, within the meaning of that provision.
The second and third questions
24. It must be recalled that, in accordance with Article 17(1) of Directive 95/46 concerning security of processing, Member States are to provide that the controller must implement appropriate technical and organisational measures which, having regard to the state of the art and the cost of their implementation, are to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected (see, to that effect, Rijkeboer , paragraph 62).
30. However, in the procedure laid down by Article 267 TFEU providing for cooperation between national courts and the Court of Justice, it is for the latter to provide the national court with an answer which will be of use to it and enable it to determine the case before it. To that end, the Court may have to reformulate the questions referred to it. The Court has a duty to interpret all provisions of European Union law which national courts require in order to decide the actions pending before them, even if those provisions are not expressly indicated in the questions referred to the Court of Justice by those courts (see, to that effect, inter alia, Case C‑45/06 Campina [2007] ECR I‑2089, paragraphs 30 and 31, and Case C‑243/09 Fuß  [2010] ECR I‑9849, paragraph 39).
31. Consequently, even if, formally, the referring court has limited its questions to the interpretation of Article 17(1) of Directive 95/46, that does not prevent this Court from providing the referring court with all the elements of interpretation of European Union law that may be of assistance in adjudicating in the case pending before it, whether or not the referring court has referred to them in the wording of its questions. It is, in this regard, for the Court to extract from all the information provided by the national court, in particular from the grounds of the decision to make the reference, the points of European Union law which require interpretation in view of the subject-matter of the dispute (see Fuß , paragraph 40).
33. It should be recalled that, in accordance with the provisions of Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles for making data processing legitimate listed in Article 7 of that directive ( Österreichischer Rundfunk and Others , paragraph 65; Huber , paragraph 48; and Joined Cases C‑468/10 and C‑469/10 ANSEF and FECEMD  [2011] ECR I‑0000, paragraph 26).
34. More specifically, under Article 6(1)(b) and (c) of Directive 95/46, the data must be ‘collected for specified, explicit and legitimate purposes’ and must be ‘adequate, relevant and not excessive’ in relation to those purposes. In addition, under Article 7(c) and (e) of the directive, the processing of personal data is permissible only if it ‘is necessary for compliance with a legal obligation to which the controller is subject’ or ‘is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed’ ( Österreichischer Rundfunk and Others , paragraph 66).
36. As regards the actual rules for the organisation of the national authority’s access to those personal data in order to carry out its task of monitoring working conditions, it must be recalled that only the grant of access to authorities having powers in that field could be considered to be necessary within the meaning of Article 7(e) of Directive 95/46 (see, to that effect, Huber , paragraph 61).
37. Concerning the employer’s obligation to provide that national authority immediate access to the record of working time, it is clear from the case‑law that such an obligation could be necessary, within the meaning of Article 7(e) of Directive 95/46, if it contributes to the more effective application of the legislation relating to working conditions (see, by analogy, Huber , paragraph 62).
38. In that respect, it must be pointed out that the purpose of Directive 2003/88 is to lay down minimum requirements intended to improve the living and working conditions of workers through approximation of national rules concerning, in particular, the duration of working time, by ensuring that they are entitled to minimum rest periods – particularly daily and weekly – and adequate breaks and by providing for a ceiling on the average duration of the working week (see, to that effect, inter alia, Joined Cases C‑397/01 to C‑403/01 Pfeiffer and Others  [2004] ECR I‑8835, paragraph 76, and Case C‑429/09 Fuß  [2010] ECR I‑12167, paragraph 43).
39. In view of the above, Article 6(b) of Directive 2003/88 requires the Member States to take the ‘measures necessary’ to ensure that, in keeping with the need to protect the safety and health of workers, the average working time for each seven‑day period, including overtime, does not exceed 48 hours (see, to that effect, Pfeiffer and Others , paragraph 100, and Case C‑243/09 Fuß , paragraph 33).
44. In that respect, it must also be noted that, in any case, if such an obligation is considered necessary to achieving that objective, the penalties imposed with a view to ensuring the effective application of the requirements laid down by Directive 2003/88 must also respect the principle of proportionality, which it is also for the referring court to verify in the main proceedings (see, by analogy, Case C‑101/01 Lindqvist  [2003] ECR I‑12971, paragraph 88).