Data Protection Ombudsman: data protection regulations neither prohibit nor requires the disclosure of a vehicle's service history to a new owner
The Data Protection Ombudsman has completed its assessment on whether a new owner of a pre-owned vehicle should have access to the service and repair history provided by a repair shop under the right to access. In the Data Protection Ombudsman's view, a vehicle's service history does not constitute such personal data of the new owner that would give the new owner the right to access such information specifically under the right as provided in the GDPR.
A person who had purchased a pre-owned car reported to the Office of the Data Protection Ombudsman that they had requested for a service and repair history of a vehicle for its entire lifecycle from Oy BMW Suomi Ab. The new owner requested the information from the company because the vehicle had undergone servicing at an authorised BMW repair shop. However, Oy BMW Suomi Ab had declined from providing such information.
The new owner did not have the right to the vehicle service history under a data subject's right of access
The Data Protection Ombudsman finds that, as a rule, a vehicle's service history constitutes personal data of the vehicle owner as referred to in the GDPR only during the data subject's ownership of the vehicle. A service history may directly or indirectly describe the owner of the vehicle or their actions. Irrespective of this, parts of a service history may include information other than personal data. Situations regarding requests for information other than personal data fall outside the jurisdiction of the Data Protection Ombudsman.
According to the GDPR, a person has the right of access to personal data concerning them. Since a vehicle's service and repair history does not constitute personal data of the new owner of a pre-owned vehicle, the new owner does not have the right to access this information under the GDPR.
Providing vehicle history information under other ground is allowed
The Data Protection Ombudsman wishes to emphasise that the decision does not include any assessment of whether or not Oy BMW Suomi Ab could provide the information in question on grounds other that the right of access to personal data. The Data Protection Ombudsman may only express an opinion on whether a vehicle's service and repair history constitute personal data to which a new owner of a pre-owned vehicle should have access specifically under the right of access.
The Data Protection Ombudsman finds that data protection regulations do not as such prohibit the disclosure of a vehicle's service and repair history to a new owner of a pre-owned vehicle. For example, this might be possible on the grounds of a legitimate interest as provided in the GDPR.
"While a repair shop does not have an obligation arising from the GDPR to disclose the service history of a vehicle, the GDPR does not specifically prohibit the disclosure of such information either. It is important not to overinterpret the GDPR in a way that prevents the new owner of a vehicle from accessing essential information regarding the vehicle," says Anu Talus, Data Protection Ombudsman.
The decision of the Data Protection Ombudsman in Finlex in Finnish
Further information:
Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel. +358 29 566 6766