How the CJEU Scania judgment challenges the absolute definition of personal data

The relative nature of “personal data” strikes again (or does it?). In today’s judgment in C-319/22 (Scania), the CJEU has seemingly confirmed that whether information is “personal data” or not depends on the entity/person processing it, like the General Court had done in other cases.

This case asks whether a vehicle identification number (VIN) is “personal data” for “independent operators”, i.e. providers of vehicle repair and maintenance services who are *not* authorised dealers/repairers. Vehicle manufacturers are required to provide VINs to such independent operators.

The CJEU has said today that [rough translation] “where independent operators can reasonably have the means to link a VIN to an identified or identifiable natural person, which it is for the referring court to verify, that VIN constitutes personal data for them within the meaning of Article 4(1), of the GDPR”. In summary: if the independent operator has any means of linking VIN and person, it is personal data.

However, the CJEU added that the VIN is personal data also “indirectly, for the car manufacturers who make it available, even if the VIN is not, in itself, personal data for the latter”. It is unclear on which basis the CJEU reaches this conclusion (the Advocate General’s opinion doesn’t include any additional explanations either).
Does it imply that a party providing information to another has to treat it as personal data if there is any chance that the recipient might link it to a natural person? And does the providing party need to check compliance of the information sharing with data protection obligations, even though it isn’t personal data from his/her perspective?
Additional litigation will clearly be needed to clarify this point.

The CJEU finally added that the VIN is not personal data “when the vehicle to which that VIN has been assigned does not belong to a natural person”. This reinforces the fact that a VIN is not *in and of itself* personal data – everything depends on whether it can be linked to a natural person.

What does this all mean?

You don’t always need to assume that a bit of information is “personal data”, just because theoretically someone somewhere could link it to a natural person. What matters is the existence of lawful means *for you* to link that information to an identified or identifiable natural person. But perhaps also *for your recipient*, with an “indirect” transformation of non-personal data from your perspective into personal data just because the recipient might be able to create that link. This is a major source of legal uncertainty, though, so I hope this gets clarified in other litigation cases.

Judgment (currently only FR & DE): https://lnkd.in/eQCZjHbY
Commentary on previous General Court decisions: https://lnkd.in/eQbTTe6r