CJEU - C‑319/22 - Gesamtverband Autoteile-Handel (Access to vehicle information)
| CJEU - C‑319/22 Gesamtverband Autoteile-Handel (Access to vehicle information) | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 4(1) GDPR Article 6(1)(c) GDPR |
| Decided: | 09.11.2023 |
| Parties: | |
| Case Number/Name: | C‑319/22 Gesamtverband Autoteile-Handel (Access to vehicle information) |
| European Case Law Identifier: | ECLI:EU:C:2023:385 |
| Reference from: | |
| Language: | 24 EU Languages |
| Original Source: | Judgement |
| Initial Contributor: | sh |
The CJEU held that Vehicle Identification Numbers taken as such, are not personal in nature. However, they become personal data when someone (a natural person) who has access to it has the means to identify the owner of the vehicle.
English Summary
Facts
Scania, a manufacturers of heavy goods vehicles in Europe, grants car repairers access to repair and maintenance information via a website. That website enables searches to be carried out either on the basis of general vehicle information, such as the model, engine or the year of manufacture, or on a given vehicle, by entering the last seven figures of the Vehicle Identification Number (VIN) of that vehicle. VINs in this context are serial numbers and should not be confused for license plates.
Gesamtverband, a competitor of Scania, argued that the information granted by Scania to repairers is anti-competitive. It requested the court to order Scania to grant also independent operators (rather than just repairers) access to the above information.
Alongside other questions, the referring court (while taking the view that, as a general rule, the VIN does not constitute personal data) asked whether Article 61 of Regulation 2018/858 must be interpreted as imposing on vehicle manufacturers a legal obligation to process data, within the meaning of Article 6(1)(c) of the GDPR.
Holding
The CJEU split the question into two topics. Firstly, whether a VIN can be considered personal data. Secondly, if a VIN is personal data, whether an obligation to provide a VIN can be compatible with the GDPR.
On the first point, the CJEU held that VINs constitute personal data within the meaning of Article 4(1) GDPR, in so far as the natural person who has access to a VIN may have means which reasonably allow them to use the VIN to identify the owner of the vehicle to which it relates. It is for the referring court to examine whether that occurs in each case. To come to this decision, the court referenced Article 4(1) GDPR which states that personal data is ‘any information relating to an identified or identifiable natural person’ and paragraphs 42 and 43 of Breyer (C 582/14, EU:C:2016:779). They also stated that the issue was settled (to a degree) by the judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes). In that judgment, access to certain VINs, in particular, and the provision of information regarding adverts published by an economic operator on its internet portal were classified as the disclosure of ‘personal data’.
On the second point, the court decided that even when a VIN is classified as personal data, the GDPR does not preclude car manufacturers from being obliged to make them available to independent operators. Regulation 2018/858 does not exclude the application of the legislation on data protection.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
