—

Worten – Equipamentos para o Lar SA, by D. Abrunhosa e Sousa and J. Cruz Ribeiro, advogados,

—

the Portuguese Government, by L. Inez Fernandes and C. Vieira Guerra, acting as Agents,

—

the Czech Government, by M. Smolek, acting as Agent,

—

the Italian Government, by G. Palmieri, acting as Agent, assisted by M. Russo, avvocato dello Stato,

—

the Hungarian Government, by M. Fehér, K. Szíjjártó and Á. Szilágyi, acting as Agents,

—

the European Commission, by P. Costa de Oliveira and B. Martenczuk, acting as Agents,

1

This request for a preliminary ruling concerns the interpretation of Article 2 and Article 17(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

2

The request has been made in proceedings between Worten – Equipamentos para o Lar SA (‘Worten’), a company established in Viseu (Portugal), and the Autoridade para as Condições de Trabalho (the Authority for Working Conditions; ‘ACT’), concerning ACT’s request to Worten for access to the latter’s record of working time.

3

Under Article 2 of Directive 95/46, headed ‘Definitions’:

‘For the purposes of this Directive:

...’

4

Article 3 of that directive, entitled ‘Scope’, is worded as follows:

‘1.   This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

2.   This Directive shall not apply to the processing of personal data:

5

Article 6 of that directive, which concerns the principles relating to data quality, provides:

‘1.   Member States shall provide that personal data must be:

...

...

2.   It shall be for the controller to ensure that paragraph 1 is complied with.’

6

Article 7 of that directive, which concerns the criteria for making data processing legitimate, states:

‘Member States shall provide that personal data may be processed only if:

...

...

...’

7

Article 17 of Directive 95/46, entitled ‘Security of processing’, is worded as follows:

‘1.   Member States shall provide that the controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected.

...’

8

Under the heading ‘Purpose and scope’, Article 1 of Directive 2003/88/EC of the European Parliament and of the Council of 4 November 2003 concerning certain aspects of the organisation of working time (OJ 2003 L 299, p. 9), provides:

‘1.   This Directive lays down minimum safety and health requirements for the organisation of working time.

2.   This Directive applies to:

...’

9

Article 6 of that directive, entitled ‘Maximum weekly working time’, provides:

‘Member States shall take the measures necessary to ensure that, in keeping with the need to protect the safety and health of workers:

...

10

Under the first subparagraph of Article 22(1) of that directive:

‘A Member State shall have the option not to apply Article 6, while respecting the general principles of the protection of the safety and health of workers, and provided it takes the necessary measures to ensure that:

...

…’

11

Article 202 of the Employment Code (Codigo do trabalho), approved by Law No 7/2009 of 12 February 2009, provides, under the heading ‘Record of working time’:

...

12

Law No 107/2009 of 14 September 2009 includes, in particular, the following provision:

‘Article 10 –

Inspection procedures

1.   In the performance of his duties, the employment inspector is to carry out, without prejudice to the provisions of a specific regulation, the following procedures:

...

2.   In the performance of his duties, the social security inspector is to carry out, without prejudice to the provisions of a specific regulation, the following procedures:

...’

13

On 9 March 2010, ACT carried out an inspection at Worten’s establishment in Viseu, following which it produced a report stating that:

14

On 15 March 2010, in response to a notice to present documents, the record of working time, setting out the legally required data, was submitted to ACT.

15

By decision of 14 March 2012, ACT found that Warton had committed a serious administrative offence by infringing the rules concerning the record of working time set out in Article 202(1) of the Employment Code, since Warton had not permitted ACT to carry out an immediate consultation, in the establishment concerned, of the record of the working time of the workers employed in that establishment. The serious nature of the offence was stated to arise from the fact that the record of working time allows quick and direct verification of whether the organisation of an undertaking’s activities complies with the regulations concerning working hours. Consequently, ACT imposed a fine of EUR 2 000 on Worten.

16

Worten brought an action for annulment against that decision before the Tribunal do trabalho de Viseu.

17

In those circumstances, the Tribunal do trabalho de Viseu decided to stay the proceedings and refer the following question to the Court for a preliminary ruling:

18

By its first question the referring court asks whether Article 2(a) of Directive 95/46 is to be interpreted as meaning that a record of working time, such as that at issue in the main proceedings, containing the indication, in relation to each worker, of the times when working hours begin and end, as well as the corresponding breaks and intervals, constitutes ‘personal data’, within the meaning of that provision.

19

In that respect, it suffices to note that, as maintained by all of the interested parties who submitted written observations, the data contained in a record of working time such as that at issue in the main proceedings, which concern, in relation to each worker, the daily work periods and rest periods, constitute personal data within the meaning of Article 2(a) of Directive 95/46, because they represent ‘information relating to an identified or identifiable natural person’ (see, to that effect, inter alia, Joined Cases C-465/00, C-138/01 and C-139/01 Österreichischer Rundfunk and Others [2003] ECR I-4989, paragraph 64; Case C-524/06 Huber [2008] ECR I-9705, paragraph 43; and Case C-553/07 Rijkeboer [2009] ECR I-3889, paragraph 42).

20

The collection, recording, organisation, storage, consultation, and use of such data by an employer, as well as their transmission by that employer to the national authorities responsible for monitoring working conditions, thus represent the ‘processing of personal data’ within the meaning of Article 2(b) of Directive 95/46 (see, to that effect, inter alia, Österreichischer Rundfunk and Others, paragraph 64, and Huber, paragraph 43).

21

Moreover, since it is undisputed, in the main proceedings, that the processing of personal data is carried out by automatic means and that none of the exceptions set out in Article 3(2) of Directive 95/46 applies, that processing falls within the scope of Directive 95/46.

22

Therefore, the answer to the first question is that Article 2(a) of Directive 95/46 is to be interpreted as meaning that a record of working time, such as that at issue in the main proceedings, containing the indication, in relation to each worker, of the times when working hours begin and end, as well as the corresponding breaks and intervals, constitutes ‘personal data’, within the meaning of that provision.

23

By its second and third questions, which it is appropriate to examine together, the referring court asks, in essence, whether Article 17(1) of Directive 95/46 is to be interpreted as meaning that each Member State is obliged to provide for appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and, if so, whether a Member State which has not adopted such measures may penalise an employer which, as a controller of personal data, has adopted a system of restricted access to those data which does not allow automatic access by the national authority responsible for monitoring working conditions.

24

It must be recalled that, in accordance with Article 17(1) of Directive 95/46 concerning security of processing, Member States are to provide that the controller must implement appropriate technical and organisational measures which, having regard to the state of the art and the cost of their implementation, are to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected (see, to that effect, Rijkeboer, paragraph 62).

25

It follows that, contrary to the premiss on which the second and third questions are based, Article 17(1) of Directive 95/46 does not require Member States, except where they act as controllers, to adopt those technical and organisational measures, as the obligation to adopt such measures concerns solely the controller; namely, in the present case, the employer. Article 17(1) of Directive 95/46 does, however, require the Member States to adopt a provision in their national law providing for that obligation.

26

Furthermore, it is not in any way apparent from the order for reference that the data at issue in the main proceedings were the subject of accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, or any other unlawful form of processing, within the meaning of Article 17(1) of Directive 95/46. On the contrary, it follows from the information in the file before the Court that it is undisputed, in the main proceedings, that access to those data by the national authority responsible for monitoring working conditions is authorised by national law.

27

However, in its written observations, Worten claims that the obligation to make available the record of working time so as to allow its immediate consultation, set out in Article 202(1) of the Employment Code, is, in practice, incompatible with the obligation to establish an adequate system of protection of the personal data contained in that record. Such an obligation amounts to allowing any employee of the undertaking concerned to gain access to the personal data contained in that record, in breach of the obligation, set out in Article 17(1) of Directive 95/46, to ensure the security of such data. In Worten’s view, such generalised access therefore renders that provision entirely ineffective.

28

That line of argument cannot succeed. Contrary to the premiss on which it is based, the obligation for an employer, as a controller of personal data, to provide the national authority responsible for monitoring working conditions immediate access to the record of working time in no way implies that the personal data contained in that record must necessarily, on that ground alone, be made accessible to persons not authorised for that purpose. As the Portuguese government rightly pointed out, all controllers of personal data must, under Article 17(1) of Directive 95/46, implement appropriate technical and organisational measures to ensure that only those persons duly authorised to access the personal data in question are entitled to respond to a request for access from a third party.

29

Accordingly, it does not appear that Article 17(1) of Directive 95/46 is relevant for the purposes of resolving the dispute in the main proceedings.

30

However, in the procedure laid down by Article 267 TFEU providing for cooperation between national courts and the Court of Justice, it is for the latter to provide the national court with an answer which will be of use to it and enable it to determine the case before it. To that end, the Court may have to reformulate the questions referred to it. The Court has a duty to interpret all provisions of European Union law which national courts require in order to decide the actions pending before them, even if those provisions are not expressly indicated in the questions referred to the Court of Justice by those courts (see, to that effect, inter alia, Case C-45/06 Campina [2007] ECR I-2089, paragraphs 30 and 31, and Case C-243/09 Fuß [2010] ECR I-9849, paragraph 39).

31

Consequently, even if, formally, the referring court has limited its questions to the interpretation of Article 17(1) of Directive 95/46, that does not prevent this Court from providing the referring court with all the elements of interpretation of European Union law that may be of assistance in adjudicating in the case pending before it, whether or not the referring court has referred to them in the wording of its questions. It is, in this regard, for the Court to extract from all the information provided by the national court, in particular from the grounds of the decision to make the reference, the points of European Union law which require interpretation in view of the subject-matter of the dispute (see Fuß, paragraph 40).

32

In the present case, it is clear from the documents before the Court that the referring court seeks, in essence, to determine whether the provisions of Directive 95/46 are to be interpreted as precluding national legislation, such as that at issue in the main proceedings, which requires an employer to make the record of working time available to the national authority responsible for monitoring working conditions so as to allow its immediate consultation. As noted in paragraph 15 of the present judgment, the breach of that obligation laid down in Article 202(1) of the Employment Code was the reason for the fine imposed on Worten.

33

It should be recalled that, in accordance with the provisions of Chapter II of Directive 95/46, entitled ‘General rules on the lawfulness of the processing of personal data’, all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles for making data processing legitimate listed in Article 7 of that directive (Österreichischer Rundfunk and Others, paragraph 65; Huber, paragraph 48; and Joined Cases C-468/10 and C-469/10 ANSEF and FECEMD [2011] ECR I-12181, paragraph 26).

34

More specifically, under Article 6(1)(b) and (c) of Directive 95/46, the data must be ‘collected for specified, explicit and legitimate purposes’ and must be ‘adequate, relevant and not excessive’ in relation to those purposes. In addition, under Article 7(c) and (e) of the directive, the processing of personal data is permissible only if it ‘is necessary for compliance with a legal obligation to which the controller is subject’ or ‘is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed’ (Österreichischer Rundfunk and Others, paragraph 66).

35

That seems to be the case in a situation such as that in the main proceedings, since it appears that – which is for the referring court to verify – on the one hand, the personal data contained in the record of working time are collected in order to ensure compliance with the legislation relating to working conditions and, on the other hand, the processing of those personal data is necessary for compliance with a legal obligation to which the employer is subject and to the performance of the monitoring task entrusted to the national authority responsible for monitoring working conditions.

36

As regards the actual rules for the organisation of the national authority’s access to those personal data in order to carry out its task of monitoring working conditions, it must be recalled that only the grant of access to authorities having powers in that field could be considered to be necessary within the meaning of Article 7(e) of Directive 95/46 (see, to that effect, Huber, paragraph 61).

37

Concerning the employer’s obligation to provide that national authority immediate access to the record of working time, it is clear from the case-law that such an obligation could be necessary, within the meaning of Article 7(e) of Directive 95/46, if it contributes to the more effective application of the legislation relating to working conditions (see, by analogy, Huber, paragraph 62).

38

In that respect, it must be pointed out that the purpose of Directive 2003/88 is to lay down minimum requirements intended to improve the living and working conditions of workers through approximation of national rules concerning, in particular, the duration of working time, by ensuring that they are entitled to minimum rest periods – particularly daily and weekly – and adequate breaks and by providing for a ceiling on the average duration of the working week (see, to that effect, inter alia, Joined Cases C-397/01 to C-403/01 Pfeiffer and Others [2004] ECR I-8835, paragraph 76, and Case C-429/09 Fuß [2010] ECR I-12167, paragraph 43).

39

In view of the above, Article 6(b) of Directive 2003/88 requires the Member States to take the ‘measures necessary’ to ensure that, in keeping with the need to protect the safety and health of workers, the average working time for each seven-day period, including overtime, does not exceed 48 hours (see, to that effect, Pfeiffer and Others, paragraph 100, and Case C-243/09 Fuß, paragraph 33).

40

Moreover, the first subparagraph of Article 22(1) of Directive 2003/88 provides that a Member State may choose not to apply Article 6 of that directive, provided, inter alia, it takes the necessary measures to ensure that the employer keeps up-to-date records of all workers who carry out such work (point (c) of the first subparagraph of Article 22(1) of that directive) and that the records are placed at the disposal of the competent authorities, which may, for reasons connected with the safety and/or health of workers, prohibit or restrict the possibility of exceeding the maximum weekly working hours (point (d) of subparagraph 1 of Article 22(1) of that directive).

41

According to the European Commission, although Directive 2003/88 does not expressly require the Member States to adopt legislation such as that at issue in the main proceedings, the monitoring of compliance with the obligations imposed by that directive may entail – as ‘measures necessary’ to the performance of the objectives which that directive pursues – the establishment of surveillance measures. In the Commission’s view, the employer’s obligation to allow immediate consultation of the record of working time ensures that data is not altered during the interval between the inspection visit carried out by the competent national authorities and the actual verification of those data by those authorities.

42

Worten claims, by contrast, that this obligation is excessive, given the interference it entails in workers’ private lives. First, the record of working time is intended to provide workers with a means of proving the hours they have actually worked. The authenticity of that record has not been contested in the main proceedings. Secondly, that record allows the assessment of average working times, for the purposes of monitoring, inter alia, working hours exemptions. For that purpose, the immediate availability of those records does not, according to Worten, provide any added value. Moreover, the information in that record could be submitted subsequently.

43

In the present case, it is for the referring court to examine whether the employer’s obligation to provide the competent national authority access to the record of working time so as to allow its immediate consultation can be considered necessary for the purposes of the performance by that authority of its monitoring task, by contributing to the more effective application of the legislation relating to working conditions, in particular as regard working time.

44

In that respect, it must also be noted that, in any case, if such an obligation is considered necessary to achieving that objective, the penalties imposed with a view to ensuring the effective application of the requirements laid down by Directive 2003/88 must also respect the principle of proportionality, which it is also for the referring court to verify in the main proceedings (see, by analogy, Case C-101/01 Lindqvist [2003] ECR I-12971, paragraph 88).

45

Consequently, the answer to the second and third questions is that Article 6(1)(b) and (c) and Article 7(c) and (e) of Directive 95/46 do not preclude national legislation, such as that at issue in the main proceedings, which requires an employer to make a record of working time available to the national authority responsible for monitoring working conditions so as to allow its immediate consultation, provided that this obligation is necessary for the purposes of the performance by that authority of its task of monitoring the application of the legislation relating to working conditions, in particular as regards working time.

46

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules: