Does vehicle service data for services performed on a vehicle while owned by a previous owner belong to the new owner and need to be provided as part of a GDPR Access request?

Finland’s Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) says no. It’s personal data, but of the previous owner. Not the new one.

Some key points:

Vehicle maintenance history and repair data are in principle personal data

  • Per WP29 on Personal Data: “vehicle maintenance information maintained by the car mechanic or repair shop contains information about the vehicle (odometer reading, dates of maintenance inspections, technical problems and condition). The information is linked to a specific registration number, which in turn can be linked to the owner of the vehicle. When a workshop combines vehicle and owner information for billing, it “applies” to the owner or driver.”
  • Per the European Commission: Vehicle registration is an indirect identifier and thus therefore is personal data.
  • Per the EDPB: A vehicle’s service history data, despite not being stored or retained in a register attached to a specific owner, in principle, enable a person to be identified because the information, when combined with other information, makes it possible to distinguish the person from others. The fact that the controller does not have information about the owner of the vehicle, nor the purpose of obtaining such information, is not decisive in assessing the nature of the vehicle registration number as personal data.
  • In Finland: the information of the current owner of the vehicle can be obtained via SMS, for example through the services of Fonecta and Elisa. In these services, the cost of a single registration number search is between 2.90 and 6.50 euros. Vehicle owner and occupier data, as well as historical data, are also available from the Finnish Transport and Communications Agency’s Traficom Traffic Register. Information about the owner of a vehicle based on the registration number of the vehicle is thus easily and at a fairly reasonable cost available to anyone.

The personal data is of the old owner not the new one

  • Per the EDPB: The so-called content or purpose or outcome factor mapping can be used to assess whether the information “concerns” a particular person. The purpose factor, on the other hand, is at hand when the information is used or is likely to be used to assess or treat a particular person in a particular way and the potential impact doesn’t have to be large. The outcome factor is again at hand when the use of the data is likely to affect the rights and interests of a particular person.
  • When evaluating the maintenance history and/or repair data of the previous owners or holders of the vehicle, it is not a question of information about the new owner or holder of the vehicle. The data tells about the time before the owner or occupier owned or occupied the vehicle.
  • Maintenance history and/or repair information from previous owners or holders of the vehicle is not used or is unlikely to be used to evaluate or treat the new owner or holder of the vehicle in any particular way. Nor is it intended to affect his position or behavior. [Note: Is this correct, though re: how a dealer would treat the new owner if they knew nothing of the car’s history?]
  • The importance of maintenance and repairs to the valuation of the vehicle can be considered marginal. The service history information is likely to be more relevant to the value in use of the vehicle. Proper maintenance and repairs can be expected to extend the life of the vehicle. It should be noted that, due to its content, purpose and/or effects, vehicle maintenance history data do not relate to the new owner or holder of the purchased vehicle.