Court of Justice of the European Communities (including Court of First Instance Decisions)

Provisional text

OPINION OF ADVOCATE GENERAL

CAMPOS SÁNCHEZ-BORDONA

delivered on 4 May 2023 (1)

Case C‑319/22

Gesamtverband Autoteile-Handel e.V.

v

Scania CV AB

(Request for a preliminary ruling from the Landgericht Köln (Regional Court, Cologne, Germany))

(Reference for a preliminary ruling – Market for motor vehicle repair and maintenance information services – Regulation (EU) 2018/858 – Independent operators – Information easily accessible in a machine-readable format that is capable of being electronically processed – Vehicle identification number (VIN) – Protection of personal data – Regulation (EU) 2016/679 – Conditions for lawful processing of personal data – Article 6(1)(c))

1.        The EU legislature aims to ensure competition in the motor vehicle repair and maintenance sector, within the internal market, in such a way that vehicle manufacturers do not monopolise (by themselves or through their authorised dealers and workshops) the supply of those services.

2.        For that purpose, Regulation (EU) 2018/858 (2) requires automotive manufacturers to provide ‘independent operators’ with unrestricted, standardised and non-discriminatory access to information on certain vehicle systems, equipment and tools and their repair and maintenance.

3.        The application of Regulation 2018/858 (or some of the regulations which it amends) has led to disputes between vehicle manufacturers, on the one hand, and independent operators, on the other. Certain requests for a preliminary ruling come from proceedings in which an entity (3) whose members are responsible for 80% of the turnover of the motor vehicle parts aftermarket in Germany has been involved. (4)

4.        In this reference for a preliminary ruling, the Landgericht Köln (Regional Court, Cologne, Germany) has submitted three questions which concern, in turn:

–      the content of the information which manufacturers must provide to independent operators (does it include all repair and maintenance information, within the meaning of Article 3(48) of Regulation 2018/858, or only information relating to spare parts?);

–      the manner and format in which manufacturers must provide that information;

–      the obligation to supply independent operators with vehicle identification numbers (‘VINs’), (5) in conjunction with Article 6(1)(c) of Regulation (EU) 2016/679. (6)

5.        As directed by the Court, I shall confine my Opinion to the third question.

I.      Legislative framework

A.      Regulation 2018/858

6.        Recital 50 reads:

‘Unrestricted access to vehicle repair and maintenance information, via a standardised format that can be used to retrieve the technical information, and effective competition in the market for services providing such information, are necessary to improve the functioning of the internal market, in particular as regards the free movement of goods, the freedom of establishment and the freedom to provide services. …’

7.        In accordance with recital 52:

‘In order to ensure effective competition in the market for vehicle repair and maintenance information services, and in order to clarify that the information concerned also covers information which needs to be provided to independent operators other than repairers, so as to ensure that the independent vehicle repair and maintenance market as a whole can compete with authorised dealers, regardless of whether the vehicle manufacturer gives such information to authorised dealers and repairers or uses such information for the repair and maintenance purposes itself, it is necessary to set out the details of the information to be provided for the purposes of access to vehicle repair and maintenance information.’

8.        Recital 62 is worded as follows:

‘Whenever the measures provided for in this Regulation entail the processing of personal data, they should be carried out in accordance with [the GDPR] …’

9.        Article 3 contains the following definitions:

‘…

(45)      “independent operator” means a natural or legal person, other than an authorised dealer or repairer, who is directly or indirectly involved in the repair and maintenance of vehicles, and include repairers, manufacturers or distributors of repair equipment, tools or spare parts, as well as publishers of technical information, automobile clubs, roadside assistance operators, operators offering inspection and testing services, operators offering training for installers, manufacturers and repairers of equipment for alternative-fuel vehicles; it also means authorised repairers, dealers and distributors within the distribution system of a given vehicle manufacturer to the extent that they provide repair and maintenance services for vehicles in respect of which they are not members of the vehicle manufacturer’s distribution system;

…

(48)      “vehicle repair and maintenance information” means all information, including all subsequent amendments and supplements thereto, that is required for diagnosing, servicing and inspecting a vehicle, preparing it for road worthiness testing, repairing, re-programming or re-initialising of a vehicle, or that is required for the remote diagnostic support of a vehicle or for the fitting on a vehicle of parts and equipment, and that is provided by the manufacturer to his authorised partners, dealers and repairers or is used by the manufacturer for the repair and maintenance purposes;

(49)      “vehicle on-board diagnostic (OBD) information” means the information generated by a system that is on board a vehicle or that is connected to an engine, and that is capable of detecting a malfunction, and, where applicable, is capable of signalling its occurrence by means of an alert system, is capable of identifying the likely area of malfunction by means of information stored in a computer memory, and is capable of communicating that information off-board;

…’

10.      Article 61 (‘Manufacturers’ obligations to provide vehicle OBD information and vehicle repair and maintenance information’) states:

‘1.      Manufacturers shall provide to independent operators unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information. Information shall be presented in an easily accessible manner in the form of machine-readable and electronically processable datasets. Independent operators shall have access to the remote diagnosis services used by manufacturers and authorised dealers and repairers.

Manufacturers shall provide a standardised, secure and remote facility to enable independent repairers to complete operations that involve access to the vehicle security system.

2.      Until the [European] Commission has adopted a relevant standard through the work of the European Committee for Standardisation (CEN) or a comparable standardisation body, the vehicle OBD information and vehicle repair and maintenance information shall be presented in an easily accessible manner that can be processed with reasonable effort by independent operators.

The vehicle OBD information and the vehicle repair and maintenance information shall be made available on the websites of manufacturers using a standardised format or, if this is not feasible, due to the nature of the information, in another appropriate format. For independent operators other than repairers, the information shall also be given in a machine-readable format that is capable of being electronically processed with commonly available information technology tools and software and which allows independent operators to carry out the task associated with their business in the aftermarket supply chain.

…

4.      The details of the technical requirements for access to vehicle OBD information and vehicle repair and maintenance information, in particular technical specifications on how vehicle OBD information and vehicle repair and maintenance information are to be provided, are laid down in Annex X.

…

11.      The Commission is empowered to adopt delegated acts in accordance with Article 82, amending Annex X to take account of technical and regulatory developments or prevent misuse by updating the requirements concerning the access to vehicle OBD information and vehicle repair and maintenance information …’

11.      Point 6.1 of Annex X (‘Access to vehicle OBD information and vehicle repair and maintenance information’) stipulates:

‘…

Information on all parts of the vehicle, with which the vehicle, as identified by the VIN and any additional criteria such as wheelbase, engine output, trim level or options, is equipped by the vehicle manufacturer and that can be replaced by spare parts offered by the vehicle manufacturer to its authorised repairers or dealers or third parties by means of reference to original equipment (OE) parts number, shall be made available, in the form of machine readable and electronically processable datasets, in a database that is easily accessible to independent operators.

This database shall comprise the VIN, OE parts numbers, OE naming of the parts, validity attributes (valid-from and valid-to dates), fitting attributes and, where applicable, structuring characteristics.

…’

B.      Regulation No 19/2011

12.      Point 2 of Article 2 (‘Definitions’) includes the following definition:

‘“vehicle identification number” (VIN) means the alphanumeric code assigned to a vehicle by the manufacturer in order to ensure proper identification of every vehicle’.

13.      In Annex I (‘Technical requirements’), Part B (‘Vehicle identification number (VIN)’), point 1.2 provides:

‘The VIN shall be unique and unequivocally attributed to a particular vehicle.’

C.      The GDPR

14.      Under Article 4(1), ‘“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’.

15.      Article 6 (‘Lawfulness of processing’) provides:

‘1.      Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(c)      processing is necessary for compliance with a legal obligation to which the controller is subject;

…

3.      The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a)      Union law; or

(b)      Member State law to which the controller is subject.

The purpose of the processing shall be determined in that legal basis … The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

…’

D.      Directive 1999/37/EC (7)

16.      Annex I (‘Part I of the registration certificate’) includes the following wording:

‘…

II.5.      Part I of the Registration Certificate shall also contain the following data, preceded by the corresponding harmonised Community codes:

…

(C)      personal data;

(C.1)      holder of the Registration Certificate:

(C.1.1)      surname(s) or business name,

…

(C.1.3)      address in the Member State of registration on the date of issue of the document;

(C.4)      Where the particulars specified in II.6, code C.2 are not included in the Registration Certificate, reference to the fact that the holder of the Registration Certificate:

(a)      is the vehicle owner,

…

…

(E)      vehicle identification number;

…

II.6.      Part I of the Registration Certificate may, moreover, contain the following data, preceded by the corresponding harmonised Community codes:

(C)      personal data,

(C.2)      owner of the vehicle (repeated as many times as there are owners) …

…

(C.3)      natural or legal person who may use the vehicle by virtue of a legal right other than that of ownership …

…

…

…’

II.    Facts, dispute and questions referred for a preliminary ruling

17.      Scania CV AB (‘Scania’) is one of the largest producers of commercial vehicles, in particular heavy goods vehicles, in Europe. As a holder of EC type-approvals, it has the status of manufacturer within the meaning of Article 3(40) of Regulation 2018/858 and is required to provide the information laid down in Article 61(1) and (2) of that regulation.

18.      Scania provides independent operators (such as members of Gesamtverband A.‑H.) with access to information relating to vehicles, their repair and maintenance and the OBD system, through a website.

19.      Using that procedure, Scania enables human users to search for information about a particular vehicle by entering the last seven digits of the VIN, or, based on general vehicle information, to obtain broader information not relating to an individual vehicle. (8)

20.      However, Scania does not provide VINs to independent operators. Only workshops know the VIN of the specific vehicle to be serviced or repaired by them, because that number appears on the chassis of the vehicle entrusted to them by the customer; by contrast, manufacturers and distributors of spare parts do not have access to individual VINs, without which a search based on general criteria produces imprecise results. (9)

21.      Gesamtverband A.‑H. and Scania are in dispute in the main proceedings concerning the form, content and scope of the obligations incumbent on manufacturers under Article 61(1) and (2) of Regulation 2018/858.

22.      Against that background, the Landgericht Köln (Regional Court, Cologne) decided to refer three questions to the Court of Justice for a preliminary ruling. I shall deal only with the last question, which is worded as follows:

‘Does Article 61(1) of Regulation [2018/858] constitute, for vehicle manufacturers, a legal obligation within the meaning of Article 6(1)(c) of the GDPR which justifies the disclosure of VINs or information linked to VINs to independent operators as other controllers within the meaning of point 7 of Article 4 of the GDPR?’

III. Procedure before the Court of Justice

23.      The request for a preliminary ruling was received at the Registry of the Court on 11 May 2022.

24.      Written observations were lodged by Gesamtverband A.‑H., Scania and the Commission.

25.      It was not considered necessary to hold a hearing.

IV.    Analysis

26.      By its third question, the referring court asks whether Article 61(1) of Regulation 2018/858 imposes on vehicle manufacturers a legal obligation (within the meaning of Article 6(1)(c) of the GDPR) which justifies the disclosure of VINs, or information linked to VINs, to independent operators.

27.      The assumption on which the question is based is that, if such an obligation were to exist, compliance with it would necessitate the processing of personal data.

28.      The answer calls, first, for an examination of the nature of VINs and, second, if it is found that VINs constitute personal data, for identification of the possible lawful basis for the processing of those data.

A.      Is a VIN personal in nature?

29.      Do VINs constitute personal data? If they do not, the issue raised would be resolved without further ado because the GDPR would, quite simply, not apply. However, the referring court admits to harbouring some uncertainty in that regard.

30.      The referring court summarises the positions of the two parties to the dispute as follows:

–      Gesamtverband A.‑H. submits that VINs are not personal data with respect to manufacturers in so far as manufacturers do not have a reasonable factual or legal possibility to determine the identity of a natural person on the basis of the VIN. That applies in particular to Scania, since, as a general rule, purchasers of commercial vehicles are not natural persons. Nevertheless, if a VIN were capable of constituting personal data in an individual case, Scania would be authorised to grant access to it under Article 6(1)(c) of the GDPR. Article 61(1) of Regulation 2018/858 provides an appropriate legal basis because it requires manufacturers to disclose the information linked to a VIN;

–      Scania submits that VINs are personal data and the GDPR prohibits their disclosure without a proper legal basis. The only possible legal basis is Article 6(1)(c) of the GDPR. However, Article 61(1) of Regulation 2018/858 does not lay down any obligation of that kind. The provision is not precise enough, the purpose of the processing is not clearly defined, and Regulation 2018/858 does not say anything about data protection.

31.      After setting out the two positions, the referring court acknowledges that there are arguments in support of each one:

–      in support of Scania’s interpretation, it could be argued that Regulation 2018/858 does not expressly include aspects relating to data protection;

–      in support of the position of Gesamtverband A.‑H., it could be argued that VINs do not generally constitute personal data for manufacturers, with the result that the GDPR might not be applicable from the outset. In any event, Article 61(1) of Regulation 2018/858 could constitute the necessary ‘legal obligation’ within the meaning of Article 6(1)(c) of the GDPR and be the basis for data processing under the GDPR.

32.      The issue was settled (to a degree) by the judgment of 24 February 2022, Valsts ieņēmumu dienests (Processing of personal data for tax purposes). (10) In that judgment, access to certain VINs, in particular, and the provision of information regarding adverts published by an economic operator on its internet portal were classified as the disclosure of ‘personal data’. (11)

33.      In that case, Advocate General Bobek argued that ‘… the car chassis number [(VIN)] … [constitutes] “information relating to an identified or identifiable person”’. Therefore, VINs could be regarded as ‘personal data within the meaning [of] Article 4(1) of the GDPR’, to the extent that such ‘information allows car sellers and, therefore, potential taxpayers to be identified’. (12)

34.      However, I agree with the referring court and Gesamtverband A.‑H. that the VIN is not, in itself and in all cases, a personal datum. At least, it is not ‘as a general rule, … with respect to the [vehicle] manufacturer’ (13) and, certainly, not when the vehicle does not belong to a natural person.

35.      In the case that gave rise to the judgment in Valsts ieņēmumu dienests, the data at issue, including the VINs of vehicles advertised on an internet portal, were requested by a tax authority. In that context, the VINs were clearly ‘personal data’ within the meaning of Article 4(1) of the GDPR; in other words, ‘information relating to an identified or identifiable natural person’.

36.      Since the entity requesting the information at issue in the case that gave rise to the judgment in Valsts ieņēmumu dienests was a public administrative authority, the VINs could be used to identify the owners of the vehicles that were given those numbers. ‘All the means likely reasonably to be used’ by a public administrative authority for that personal identification include access to the (public) register of registration certificates.

37.      As I have already pointed out, the VIN is simply an ‘alphanumeric code assigned to a vehicle by the manufacturer’ which, strictly, is used only for the proper identification of that vehicle. It could be said that it is a datum ad rem, not ad personam.

38.      In accordance with the Court’s case-law:

–      the definition of ‘personal data’, within the meaning of Article 4(1) of the GDPR, ‘is applicable where, by reason of its content, purpose and effect, the information in question is linked to a particular person’; (14)

–      ‘to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person’. It follows that ‘for information to be treated as “personal data” … it is not required that all the information enabling the identification of the data subject must be in the hands of one person’. (15)

39.      Applying that case-law, a datum which, in principle, is not ‘personal’ in nature (because, by itself and without the involvement of other data, it does not contain information relating to an identified or identifiable natural person) becomes personal as regards someone who reasonably has means enabling that datum to be associated with a specific person.

40.      Registration certificates, on which the VIN and the identity of the vehicle owner must of necessity be recorded, are one of those means. (16) Using such a certificate, linking the VIN with the vehicle owner, an independent operator would be able to trace, for example, the distribution and sale process of a spare part until it identified the owner of the vehicle to which that part was fitted. (17)

41.      It is for the referring court to determine whether, as appears to be the case, members of Gesamtverbrand A.‑H. may reasonably have at their disposal means allowing a VIN to be linked to an identified or identifiable natural person. If that were the case, the VIN would be, as regards those members (and, indirectly, the manufacturer that provides the VIN), personal data the processing of which is subject to the GDPR.

42.      In short, and as an intermediate conclusion, I believe that VINs constitute personal data within the meaning of Article 4(1) of the GDPR, in so far as whoever has access to a VIN may have means which reasonably allow them to use the VIN to identify the owner of the vehicle to which it relates. It is for the referring court to examine whether that occurs in each case.

B.      The obligation to provide the VIN and the GDPR

43.      Contrary to a number of assertions set out in the order for reference, Regulation 2018/858 does not exclude the application of the legislation on data protection. In accordance with recital 62 of that regulation, ‘whenever the measures provided for in this Regulation entail the processing of personal data, they should be carried out in accordance with [the GDPR]’.

44.      Article 6(1) of the GDPR makes the lawfulness of the processing of personal data conditional on the existence of at least one of the justifications it lists. Those justifications include that the processing is necessary ‘for compliance with a legal obligation to which the controller is subject’ (point (c)) (italics added).

45.      That legal obligation is laid down in Article 61(1) and (4) of Regulation 2018/858, read in conjunction with point 6.1 of Annex X to that regulation. In accordance with that body of legislation, motor vehicle manufacturers are required to provide independent operators with, inter alia, VINs explicitly.

46.      Point 6.1 of Annex X to Regulation 2018/858 sets out the information which manufacturers must provide, in a database that is easily accessible to independent operators. That information is to include information relating to ‘… parts of the vehicle, with which the vehicle, as identified by the VIN … is equipped by the vehicle manufacturer’. Point 6.1 further states that the database which the manufacturer is required to set up ‘shall comprise the VIN’.

47.      Article 61(4) of Regulation 2018/858 provides specifically that the details of the technical requirements for access to that information are laid down in Annex X. As I have just indicated, point 6.1 of that annex imposes on manufacturers the obligation to provide information, ‘by [means of] the VIN’, on the vehicle and the parts with which the manufacturer has equipped it.

48.      Accordingly, every vehicle manufacturer has a clear obligation to provide VINs to independent operators.

49.      To the extent that VINs constitute personal data, (18) authorisation to access VINs entails ‘processing’ within the meaning of Article 4(2) of the GDPR.

50.      The Court has stated that all processing of personal data must comply with the principles set out in in Article 5 of the GDPR and with one of the criteria for lawfulness set out in Article 6 of the GDPR. (19)

51.      Of the conditions for lawfulness set out in Article 6(1) of the GDPR, the relevant condition for the present purposes is that referred to in point (c). That condition is fulfilled in this case, since, I repeat, enabling access to the VIN is a ‘legal obligation’ to which vehicle manufacturers are subject (Article 61(1) of Regulation 2018/858). If a manufacturer fails to provide independent operators with access to the VINs of its vehicles, it is breaching that legal obligation.

52.      However, it is not sufficient for the processing at issue to be necessary for compliance with a legal obligation. The conditions set out in Article 6(3) of the GDPR must also be satisfied. I believe that those conditions are satisfied in this case because:

–      the ‘basis for the processing’ (which must be ‘laid down by … Union law; or … Member State law to which the controller is subject’) is contained in Regulation 2018/858;

–      the ‘purpose of the processing’ (which ‘shall be determined in that legal basis’) is set out in Article 61(1) of Regulation 2018/858: the aim is to promote competition in the sector, (20) by providing independent operators with unrestricted, standardised and non-discriminatory access to certain information relating to vehicle equipment and vehicle repair and maintenance;

–      the ‘objective of public interest’ of the provision of EU law governing this field exists, for, as the Commission has stated, (21) the obligation laid down is aimed at improving ‘the functioning of the internal market, in particular as regards the free movement of goods, the freedom of establishment and the freedom to provide services’; (22)

–      the legislative basis is ‘proportionate to the legitimate aim pursued’: it is apparent from the order for reference that only a search using the VIN enables the exact identification of the information relating to a particular vehicle. As the Commission has also observed, (23) the referring court does not suggest another, less incisive, means of identification which preserves the effectiveness of a search based on the VIN while at the same time making it possible to satisfy the objective of public interest referred to above. The EU legislature itself conducted that assessment of proportionality in Regulation 2018/858.

53.      In summary, I believe that all the conditions laid down in Article 6(1)(c) and Article 6(3) of the GDPR are met. I should add, finally, that the referring court does not question the application to this case of the principles laid down in Article 5 of the GDPR.

V.      Conclusion

54.      In the light of the foregoing considerations, I propose that the Court of Justice reply to the third question referred for a preliminary ruling by the Landgericht Köln (Regional Court, Cologne, Germany) as follows:

Article 61(1) and (4) of, in conjunction with point 6.1 of Annex X to, Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC

must be interpreted as meaning that it imposes on motor vehicle manufacturers a legal obligation, within the meaning of Article 6(1)(c) and Article 6(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), which justifies the disclosure of vehicle identification numbers (VINs) to independent operators.

1      Original language: Spanish.

2      Regulation of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC (OJ 2018 L 151, p. 1).

3      Gesamtverband Autoteile-Handel eV (‘Gesamtverband A.‑H.’).

4      Judgments of 19 September 2019, Gesamtverband Autoteile-Handel (C‑527/18, EU:C:2019:762), and of 27 October 2022, ADPA and Gesamtverband Autoteile-Handel (C‑390/21, EU:C:2022:837).

5      The VIN or chassis number consists of an alphanumeric code assigned to a vehicle by the manufacturer in order to ensure the identification of the vehicle. It is referred to in Commission Regulation (EU) No 19/2011 of 11 January 2011 concerning type-approval requirements for the manufacturer’s statutory plate and for the vehicle identification number of motor vehicles and their trailers and implementing Regulation (EC) No 661/2009 of the European Parliament and of the Council concerning type-approval requirements for the general safety of motor vehicles, their trailers and systems, components and separate technical units intended therefor (OJ 2011 L 8, p. 1), as amended by Commission Regulation (EU) No 249/2012 of 21 March 2012 (OJ 2012 L 82, p. 1).

6      Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).

7      Council Directive of 29 April 1999 on the registration documents for vehicles (OJ 1999 L 138, p. 57), as amended by Commission Directive 2003/127/EC of 23 December 2003 (OJ 2004 L 10, p. 29).

8      After entering the VIN or a general search term, a human user only has the possibility of printing the results shown on the screen or of saving those results locally on the computer as a PDF file. Consequently, the information content of such a printout or the PDF file created in that manner is limited to what can be seen on the screen.

9      Information on spare parts is provided to independent operators in the same form, the difference being that the user is additionally given the possibility to save the search results displayed on the website as an XML file locally on his or her computer.

10      C‑175/20, EU:C:2022:124; ‘judgment in Valsts ieņēmumu dienests’.

11      Judgment in Valsts ieņēmumu dienests (paragraphs 36 and 37).

12      Opinion of Advocate General Bobek in Valsts ieņēmumu dienests (Processing of personal data for tax purposes) (C‑175/20, EU:C:2021:690, point 36). Italics in the original.

13      Page 80 of the original German order for reference.

14      Judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation) (C‑180/21, EU:C:2022:967, paragraph 70), citing the judgment of 20 December 2017, Nowak (C‑434/16, EU:C:2017:994, paragraph 35).

15      Judgment of 19 October 2016, Breyer (C‑582/14, EU:C:2016:779, paragraphs 42 and 43).

16      Annex I, point II.5, code E, to Directive 1999/37.

17      As the Commission has pointed out in paragraph 53 of its observations, the reality of connected vehicles, which are capable of providing information likely to be linked to a person through the VIN, cannot be ignored. See point 29 of Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications (version 2.0), adopted on 9 March 2021 (https://edpb.europa.eu/system/files/2021-08/edpb_guidelines_202001_connected_vehicles_v2.0_adopted_en.pdf).

18      Point 42 above.

19      Judgments of 16 January 2019, Deutsche Post (C‑496/17, EU:C:2019:26, paragraph 57 and the case-law cited); of 24 September 2019, GC and Others (De-referencing of sensitive data) (C‑136/17, EU:C:2019:773, paragraph 64); and of 22 June 2021, Latvijas Republikas Saeima (Penalty points) (C‑439/19, EU:C:2021:504, paragraphs 96, 99, 100 and 102).

20      In accordance with recital 52 of Regulation 2018/858, the aim of the regulation is ‘to ensure effective competition in the market for vehicle repair and maintenance information services’.

21      Paragraph 65 of its observations.

22      As stated in recital 50 of Regulation 2018/858.

23      Paragraph 67 of its observations.

© European Union
The source of this judgment is the Europa web site. The information on this site is subject to a information found here: Important legal notice. This electronic version is not authentic and is subject to amendment.