Does a car’s registration number count as personal data under the EU’s General Data Protection Regulation?
How about the VIN? (Vehicle Identification Number)
-
3If there is an available database, say a governmental one, that connects VINs or registration numbers to owner identities, wouldn't that make the VIN/Reg no a way to indirectly identify the owner, and thus personal information? I am not sure of this, which is why i make this a comment, not an answer.– David SiegelMar 25, 2019 at 15:22
-
1@DavidSiegel Yes, I agree. There was a similar discussion about phone numbers. In C‑582/14 the CJEU basically says that it does not matter how restrictive it is to identify the owner, if it is possible by law to get it, it constitutes a ‘reasonable means'. See also the text starting at the bottom of page 90 of the Handbook on European data protection law.– wimhMar 25, 2019 at 22:16
Add a comment
|
2 Answers
As far as I understand it the registration number and VIN are both information about a vehicle and not about a person, and therefore on their own would not qualify as personal data under GDPR.
Vehicle owner information such as name, address etc would be classed as personal data if stored/processed, as would driver information such as license details, endorsements, captured photos/CCTV where the driver can be identified etc.
For reference the definition of 'personal data' in GDPR is:
"(1) 'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"
EU General Data Protection Regulations (GDPR) Article 4 ('Definitions') Paragraph 1, p.33
In Germany it's not so clear:
https://www.lfd.niedersachsen.de/themen/datenschutz_im_kfz/kfz-und-datenschutz-148981.html
The situation is different with regard to personal data collected in connection with the vehicle. Data is personal if it relates to a "specific person" or at least to an "identifiable person". A person is "identifiable" if, for example, he or she can be identified via the vehicle identification number or other additional knowledge. The Federal Data Protection Act (BDSG) therefore applies in these cases. The BDSG in turn contains a clear statement: the data "belong" to the data subject. Related to the motor vehicle: The data "belong" to the driver or owner of the vehicle.
