No 168/2023 : 9 November 2023
Approximation of laws
Car manufacturers must make vehicle identification numbers available to independent operators
Car manufacturers must make vehicle identification numbers available to
independent operators
Where that number makes it possible to identify the owner of a vehicle, thus constituting personal data, that
obligation is compatible with the General Data Protection Regulation.
EU law requires car manufacturers to make accessible to independent operators, including repairers, spare parts
distributors and publishers of technical information, the information necessary for the repair and maintenance of
the vehicles they manufacture.
A German trade association for the independent trade in motor vehicle parts considers that neither the form nor
the content of the information provided by the manufacturer of heavy goods vehicles, Scania, to its members fulfils
that obligation. In order to address that situation, that association brought proceedings before a German court.
Uncertain as to the scope of Scania’s obligations, that court in turn referred the matter to the Court of Justice. It
wishes to know, inter alia, whether the vehicle identification number is to be regarded as personal data that
manufacturers are required to communicate.
In response, the Court holds that car manufacturers are required to provide access to all vehicle repair and
maintenance information.
That information does not necessarily have to be made accessible by a database interface allowing automated
search with downloading of results. However, its format must lend itself to direct electronic use. Accordingly, it
must enable the relevant data to be extracted and retained immediately after their collection. The Court also holds
that car manufacturers are required to set up a database, which must cover information on parts that can be
replaced by spare parts. It must be possible to search for information in that database according to vehicle
identification numbers and other criteria, such as engine output or trim level of the vehicle.
The Court points out that vehicle identification numbers must be included in the database.
That number, taken as such, is not personal in nature. However, it becomes personal data when someone who has
access to it has the means to identify the owner of the vehicle, provided that the person concerned is a natural
person.
independent operators
Where that number makes it possible to identify the owner of a vehicle, thus constituting personal data, that
obligation is compatible with the General Data Protection Regulation.
EU law requires car manufacturers to make accessible to independent operators, including repairers, spare parts
distributors and publishers of technical information, the information necessary for the repair and maintenance of
the vehicles they manufacture.
A German trade association for the independent trade in motor vehicle parts considers that neither the form nor
the content of the information provided by the manufacturer of heavy goods vehicles, Scania, to its members fulfils
that obligation. In order to address that situation, that association brought proceedings before a German court.
Uncertain as to the scope of Scania’s obligations, that court in turn referred the matter to the Court of Justice. It
wishes to know, inter alia, whether the vehicle identification number is to be regarded as personal data that
manufacturers are required to communicate.
In response, the Court holds that car manufacturers are required to provide access to all vehicle repair and
maintenance information.
That information does not necessarily have to be made accessible by a database interface allowing automated
search with downloading of results. However, its format must lend itself to direct electronic use. Accordingly, it
must enable the relevant data to be extracted and retained immediately after their collection. The Court also holds
that car manufacturers are required to set up a database, which must cover information on parts that can be
replaced by spare parts. It must be possible to search for information in that database according to vehicle
identification numbers and other criteria, such as engine output or trim level of the vehicle.
The Court points out that vehicle identification numbers must be included in the database.
That number, taken as such, is not personal in nature. However, it becomes personal data when someone who has
access to it has the means to identify the owner of the vehicle, provided that the person concerned is a natural
person.
The Court notes in that regard that the owner is, like the identification number, indicated in the registration
certificate. Even where vehicle identification numbers are to be classified as personal data, the General Data
Protection Regulation does not preclude car manufacturers from being obliged to make them available to
independent operators.
certificate. Even where vehicle identification numbers are to be classified as personal data, the General Data
Protection Regulation does not preclude car manufacturers from being obliged to make them available to
independent operators.