In the present judgment (Case no. C‑319/22 of November 9, 2023) on the basis of a referral from Cologne Regional Court on the question of whether Vehicle identification numbers (“FIN”; also called “VIN”) Personal data within the meaning of the GDPR.
The background to this is the obligation of vehicle manufacturers under European law to provide access to certain vehicle information via a website. Because Scania did not provide the VIN, apparently (also) based on data protection arguments, the Gesamtverband Autoteile-Handel e.V. took legal action. As a result, the question arose as to whether the VIN is personal data and – if so – whether the obligation to provide it is a legal basis within the meaning of Art. 6 para. 1 lit. c GDPR.
On the first question, the ECJ follows the relative approach, with reference to his Breyer decision:
45 This definition [of personal data] applies if the information in question is linked to a specific natural person by virtue of its content, purpose and effects […]. When deciding whether a natural person is directly or indirectly identifiable, the following should be taken into account all means are taken into accountwhich could reasonably be expected either by the controller within the meaning of Art. 4 No. 7 GDPR or could be used by a third partyto identify the person concerned, without it being necessary for all the information necessary to identify that person to be in the hands of a single body […].
48 Under these circumstances, the VIN is personal data within the meaning of Art. 4 No. 1 GDPR of the person identified in the registration certificate, if the person who has access to the FIN could have the means to do soto use the VIN to identify the keeper of the vehicle to which the VIN relates or to identify the person who can dispose of the vehicle in question on the basis of another legal title than as keeper.
49 As the Advocate General stated in points 34 and 41 of his Opinion, the FIN, if the independent economic operators can reasonably be expected to have the means to attribute the VIN to an identified or identifiable natural person – which is a matter for the referring court to examine, personal data for these economic operators and indirectly for the vehicle manufacturers who provide the VIN within the meaning of Art. 4 No. 1 GDPR, even if the VIN in itself does not constitute personal data for the vehicle manufacturers, especially if the vehicle to which it was assigned does not belong to a natural person.
Thus, the ECJ (again; cf. also the Judgment of the EGC in Case. T‑557/20) it is clear that the question of the possibility of identifying a date can only be assessed from the perspective of bodies that have access to the date, but not by third parties. This is the relative approach. It does not say exactly how high the threshold of the possibility of identification should be set and what “identification” in itself actually means (this is where the discussion about singularization comes in), but at least: abstract possibilities of identification of third parties are not taken into account.
It will now be up to the national courts to examine the question of personal reference from this perspective.
However, if they come to the conclusion that personal data has been disclosed, they must legitimized by the aforementioned disclosure obligation:
58 These provisions of EU law thus impose a “legal obligation” on vehicle manufacturers within the meaning of Art. 6 para. 1 lit. c GDPR to provide the VIN, among other data, to independent economic operators. […]
60 According to recital 50 in the preamble to Regulation 2018/858, such competition is necessary for the better functioning of the internal market, in particular for the free movement of goods, the freedom of establishment and the freedom to provide services. Thus, the objective referred to in the preceding recital is in the public interest and is therefore legitimate […]
61 Finally, as regards the third condition for the lawfulness of the processing of personal data, which is laid down in Art. 6 para. 3 GDPR, according to which such processing must be ‘proportionate to the legitimate aim pursued’, it is sufficient […] to establish, first, that only the search by VIN leads to the exact identification of the data of a specific vehicle and, second, that the file before the Court does not show any other, less intrusive identification measure which preserves the effectiveness of the search by VIN and at the same time makes it possible to pursue the public interest objective set out in the preceding paragraph.