Does vehicle service data for services performed on a vehicle while owned by a previous owner belong to the new owner and need to be provided as part of a GDPR Access request?
Finland’s Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) says no. It’s personal data, but of the previous owner. Not the new one.
Some key points:
Vehicle maintenance history and repair data are in principle personal data
Per WP29 on Personal Data: “vehicle maintenance information maintained by the car mechanic or repair shop contains information about the vehicle (odometer reading, dates of maintenance inspections, technical problems and condition). The information is linked to a specific registration number, which in turn can be linked to the owner of the vehicle. When a workshop combines vehicle and owner information for billing, it “applies” to the owner or driver.”Per the European Commission: Vehicle registration is an indirect identifier and thus therefore is personal data.Per the EDPB: A vehicle’s service history data, despite not being stored or retained in a register attached to a specific owner, in principle, enable a person to be identified because the information, when combined with other information, makes it possible to distinguish the person from others. The fact that the controller does not have information about the owner of the vehicle, nor the purpose of obtaining such information, is not decisive in assessing the nature of the vehicle registration number as personal data.In Finland: the information of the current owner of the vehicle can be