Court case 45128 – Court Ruling (Luxembourg, 2022)

The labour and mines inspection (controller) requested an employer to provide documents about its employees (data subjects) within 8 days. The controller is a public body tasked with supervisory authority to conduct controls and examinations. It has the authority to request documents and information from controllers regarding their employees (Article L.614-4(1)(a) Labour code). These documents had to contain information about, amongst other things, the beginning, end and duration of the daily work, extensions of the normal working time, the hours worked on Sundays, holidays and night work, information about wages, residence – and work permits, medical certificates and training certificates. (Articles L.614-4, paragraph (1) and L.614-5 Labour Code). The employer provided the requested information to the controller on 11 February 2020. However, the employer didn’t provide all the requested files according to the controller. After the Employer failed to provide the additional files, the controller fined the employer €8000. After objections of the employer, this fine was reduced to €6000. The employer appealed this fine at the court, stating that the controller was not entitled to demand the documents regarding salaries and proof of payment. It referred to written declarations of its employees, stating that the legal, administrative and contractual requirements in the law had been fulfilled. Therefore, there was no reason for the employer to provide these documents to the controller. According to the employer, its employees had also objected against the transfer of their salary-information to the controller, referring to their right of data protection. The employer also made an argument justifying the lack of communication regarding a holiday-register. The employer was obliged to keep a register on the legal leave of its employees according to Article L.233-17 of the Labour Code. The controller stated this register was not subject to any particular formalism and that its employees had stated in their written statements that they had no claims to their right to leave, thus confirming that their employer had complied with the law. Therefore, the fine was not justified. The employer also stated that that the fine imposed should be reversed with regard to the special register according to Article L.211-19 Labour Code, which stated the arrival time, departure time, working on Sundays or public holidays should be registered. According to the employer, the reason the fine should be reversed was the fact that these employees had all declared that they had entered their arrival and departure times on a daily basis in the working time register located at the reception desk and had never worked overtime, nor on Sundays or public holidays. The employer also provided an argument regarding the lack of medical certificates for recruitment provided to the controller. The employer stated that it relied on good faith that its employees would have been in possession of a certificate drawn up by the occupational health service. When this would not be the case, it affirmed during the proceeding that it would register these employees immediately. The court declared the appeal of the employer admissible, but dismissed the appeal and held that the government institution was in its right to fine the employer. The court held that the controller had the authority to conduct controls and examinations when it considered this necessary in order to guarantee that applicable legal and regulatory provisions would be met. This necessarily implied that the controller must be able to obtain the requested documents, without the employer being able to avoid this by producing testimonial certificates from his employees. Therefore, the argument of the employer regarding written declarations of its employees was deemed irrelevant. The court also considered the argument of the employer where it referred to right of data protection for its employees. The court made a reference the GDPR on its own, without any of the involved parties bringing this up. The court referred to Article 6(1)(e) GDPR and recital 45, and reiterated that processing shall be lawful when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Employer. The Court held that the above was applicable in this case, because controller’s authority to request documents form the employer was described in Luxembourg law (Article L.614-4(1)(a) Labour code). The court also rejected the argument from the employer regarding the lack of formality for the 'holiday-register' (Article L.233-17 of the Labour Code). Although the law did not specify the form of this register, it still required the establishment a material form that should allow the controller to verify the conditions regarding leave of employees. Based on the provisions above, the court held that the controller was within its right to fine the employer, because it had not provided the requested documents in time.