- Date:
- 18 Jun 2013
- By:
- Jens Harkov
The EU Court recently ruled that giving the authorities access to data on employees' working hours is not incompatible with data protection law
The EU Court recently ruled that giving the authorities access to data on employees’ working hours is not incompatible with data protection law.
When employers process employee data, they must protect the data against unauthorised access and they are not allowed to pass the data on to third parties without restrictions. But is this obligation compatible with the obligation to provide necessary data to authorities? This was the question before the EU Court in this case from Portugal.
In Portugal, employers are allowed in some cases to depart from the rule providing for a maximum of 48 weekly hours of work. In order to do so, however, they must keep a register of employees’ hours of work and the register must be immediately available to the Portuguese working environment authority. In this case, the employer had ensured that only its central HR department had access to the data. When the working environment authority decided to inspect the employer, there was therefore no access to the register and the employer was issued with a fine.
The employer believed that, in practice, it was impossible to provide the necessary level of security on the one hand and on the other hand allow the authorities immediate access to the data. The case therefore ended up in a Portuguese court, which decided to make a preliminary reference to the EU Court.
Working time is personal data
The Portuguese court asked whether data concerning working time constitute personal data within the meaning of the Data Protection Directive and also whether the Directive prevented the authorities from requiring immediate access to data held in the register.
The Portuguese court asked whether data concerning working time constitute personal data within the meaning of the Data Protection Directive and also whether the Directive prevented the authorities from requiring immediate access to data held in the register.
The EU Court was very clear that data concerning the working time of an identifiable employee are personal data within the meaning of the Directive.
On the question of the authorities’ access to the register, the EU Court ruled that giving the authorities access to the data which were necessary to handle its supervisory duties was compatible with the Data Protection Directive.
Norrbom Vinding notes
- that the EU Court’s ruling illustrates that the data protection rules do not prevent an employer from making personal data immediately available to authorities if the data are necessary for the authorities in question to carry out their supervisory duties;
- that the EU Court leaves it to the national courts to decide in each individual case whether the data requested are necessary or not; and
- that Danish employers’ disclosure to authorities of personal data which are necessary for the authorities in their supervisory duties may take place in accordance with the Danish Data Protection Act.
