Context and Key Issues (Paragraphs 1-2)
- Case Reference: C‑319/22.
- Court: Landgericht Köln (Regional Court, Cologne, Germany).
- Parties: Gesamtverband Autoteile-Handel eV (German trade association) vs. Scania CV AB (Swedish vehicle manufacturer).
- Key Issue: Dispute over Scania’s provision of vehicle on-board diagnostic (OBD) information and vehicle repair and maintenance information.
Legal Context (Paragraphs 3-14)
- Regulation 2018/858 (EU Law): Concerns market surveillance of motor vehicles and their trailers.
- GDPR (General Data Protection Regulation): Focuses on the processing of personal data.
- Directive 1999/37 and Other Regulations: Pertains to vehicle identification numbers (VINs) and their role in vehicle registration and identification.
Main Proceedings and Questions for Preliminary Ruling (Paragraphs 16-24)
The document discusses the concept of “personal data” in the context of the General Data Protection Regulation (GDPR) and specifically examines whether a Vehicle Identification Number (VIN) can be considered personal data. Here are the key points:
- Definition of Personal Data (Article 4(1) of GDPR): Personal data is defined as any information relating to an identified or identifiable natural person. This includes direct or indirect identification through an identifier like a name, identification number, location data, online identifier, or factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
- Context of VIN as Personal Data:
- General Rule: As a general rule, a [[VIN]] does not constitute [[personal data]] since it is an alphanumeric code assigned to a vehicle for identification purposes and is not inherently personal.
- Specific Contexts: However, a VIN becomes personal data if independent operators can reasonably link the VIN to an identified or identifiable natural person. This linkage makes the VIN personal data for them and indirectly for the vehicle manufacturers who make it available.
- In order to determine whether a natural person is identifiable, directly or indirectly, account should be taken of all the means likely reasonably to be used either by the controller, within the meaning of Article 4(7) of the GDPR, or by any other person, to identify that person, without, however, requiring that all the information enabling that person to be identified should be in the hands of a single entity (see, to that effect, judgment of 19 October 2016, Breyer (C‑582/14, EU:C:2016:779, paragraphs 42 and 43).” (paragraph 45 in case)
- In order to ensure that the vehicle is properly identified and which, as such, is not ‘personal’ – becomes personal as regards someone who reasonably has means enabling that datum to be associated with a specific person. (para 46)
- In those circumstances, the VIN constitutes personal data, within the meaning of Article 4(1) of the GDPR, of the natural person referred to in that certificate, in so far as the person who has access to it may have means enabling him to use it to identify the owner of the vehicle to which it relates or the person who may use that vehicle on a legal basis other than that of owner. (Para 48)
- As the Advocate General observed in points 34 and 41 of his Opinion, where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person, which it is for the referring court to determine, that VIN constitutes personal data for them, within the meaning of Article 4(1) of the GDPR, and, indirectly, for the vehicle manufacturers making it available, even if the VIN is not, in itself, personal data for them, and is not personal data for them in particular where the vehicle to which the VIN has been assigned does not belong to a natural person. (para 49)
- Legal Obligations: EU law imposes a legal obligation on car manufacturers to make VINs available to independent operators as ‘controllers’ within the meaning of GDPR. (Regulation 2018/858). This obligation arises when the VIN constitutes personal data within the scope of GDPR, which happens when it can be linked to a natural person.
- Conditions for Processing VIN as Personal Data:
- Lawfulness: The processing of VINs as personal data must comply with the GDPR, particularly when it meets the legal obligation under [[Article 6(1)(c)]].
- Proportionality and Public Interest: Processing must be proportionate to the legitimate objective pursued. For instance, using the VIN enables accurate identification of data corresponding to a particular vehicle, which is seen as necessary for the functioning of the internal market and is in the public interest
- Ruling: Article 61(1) of Regulation 2018/858 establishes a legal obligation under GDPR for manufacturers to make VINs available to independent operators.
Court’s Determination: The court emphasizes that it is for the referring court to determine whether a VIN must be regarded as personal data in specific instances. This determination depends on the ability to link the VIN to an identified or identifiable natural person.
These points outline the nuanced approach to determining whether a VIN is personal data under the GDPR, highlighting that the context and capability to link the VIN to an individual are crucial factors.
Other Issues
Second Question: Accessibility and Database Requirements (Paragraphs 30-42)
- Ruling: Manufacturers are not required to provide a database interface for automated search but must make information available in a directly processable electronic format.
Conclusions (Paragraph 63)
- Costs: Decisions on costs are deferred to the national court.
This case addresses intricate issues about the extent of access to vehicle information required under EU law, the format of such information, and the implications of GDPR in the context of vehicle identification numbers. The rulings clarify obligations of vehicle manufacturers regarding data accessibility and protection.
Cases referenced:
- [[Vyriausioji tarnybinės etikos komisija]], C‑184/20, EU:C:2022:601; (Paragraph 60)
- Context: This case is cited in relation to the [[public interest]] and the legitimacy of processing personal data.
- Relevance: It may provide insights into how the court balances the interests of various stakeholders when considering what constitutes personal data.
- [[Inspektor v Inspektorata kam Visshia sadeben savet]] (Purposes of the processing of personal data – Criminal investigation), C‑180/21, EU:C:2022:967: (Paragraph 45)
- Context: This case is mentioned in relation to the definition of personal data and the conditions under which information is linked to a particular natural person.
- Relevance: It could offer guidance on the interpretation of what constitutes personal data, particularly in situations involving indirect identification.
- [[ADPA and Gesamtverband Autoteile-Handel]], C‑390/21, EU:C:2022:837: (paragraphs 11 and 17)
- Context: This case is referenced in discussions about manufacturers’ obligations to provide information in a machine-readable format and the implications for the processing of personal data.
- Relevance: This judgment might shed light on the legal obligations regarding data accessibility and processing, which could indirectly relate to VINs as personal data.
- [[Gesamtverband Autoteile-Handel]], C‑527/18, EU:C:2019:762: (paragraph 13)
- Context: The case is cited concerning manufacturers’ requirements to create a database that includes VINs.
- Relevance: It could provide context on the legal expectations for data management and accessibility, particularly how VINs are handled within these databases.
- [[Breyer]], C‑582/14, EU:C:2016:779: (paragraph 19)
- Context: This case is mentioned in the discussion about identifying a natural person directly or indirectly, considering all reasonable means available to the controller or any other person.
- Relevance: It offers insight into the criteria for determining whether a piece of information, such as a VIN, can be linked to an identifiable individual, thus qualifying as personal data.