Court rules vehicle identification numbers must be made available to independent operators

Date: Monday 20 November 2023

---

Please note: This action should apply to the UK vehicle type approval and GDPR legislation, which still follows the same basis as in the EU.

Court of Justice of the European Union (ECJ) has handed down another landmark decision in favour of competition in the automotive aftermarket sector (Case C-319/22).

Car manufacturers must make vehicle identification numbers (VIN) available to independent operators, such as technical data publishers, spare parts distributors and repairers. 

However, where the VIN makes it possible to identify the natural person who is the owner of a vehicle, thus constituting personal data, that obligation must be compatible with the General Data Protection Regulation (GDPR) requirements. 

EU law requires car manufacturers to make accessible to independent operators, the information necessary for the repair and maintenance of their vehicles. 

A leading German trade association who represents the parts distributors considered that neither the form nor the content of the information provided by the manufacturer of heavy goods vehicles, Scania, to its members fulfils that obligation. In order to address that situation, that association brought proceedings before a German court. Uncertain as to the scope of Scania’s obligations, that court in turn referred the matter to the European Court of Justice. The ECJ was asked to rule that, inter alia, whether the vehicle identification number is to be regarded as personal data that manufacturers are required to make this available to independent operators. 

In response, the Court decided that car manufacturers are required to provide access to all vehicle repair and maintenance information, including the VIN. 

That information does not necessarily have to be made accessible by a database interface allowing automated search with downloading of results. However, its format must lend itself to direct electronic use. Accordingly, it must enable the relevant data to be extracted and retained immediately after their collection. The Court also stated that car manufacturers are required to set up a database, which must cover information on parts that can be replaced by spare parts. It must then be possible to search for information in that database according to vehicle identification numbers and other criteria, such as engine output or trim level of the vehicle. 

The Court points out that vehicle identification numbers must be included in the database. 

The VIN, taken in isolation, is not personal in nature. However, it becomes personal data when someone who has access to it also has the means to identify the owner of the vehicle, provided that the person concerned is a natural person. The Court notes in that regard the owner is, like the identification number, indicated in the registration certificate. Even where vehicle identification numbers are to be classified as personal data, the General Data Protection Regulation does not preclude car manufacturers from being obliged to make them available to independent operators. 

 

---