CJEU, 3rd chamber, November 9, 2023, No C-319/22

THE COURT (Third Chamber),

1 This request for a preliminary ruling concerns the interpretation of Article 61(1) and (2) of Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC (OJ 2018 L 151, p. 1), and Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).

2 The request has been made in proceedings between Gesamtverband Autoteile-Handel eV (‘Gesamtverband’), a German trade association representing wholesalers of motor vehicle parts, and Scania CV AB (‘Scania’), a Swedish vehicle manufacturer, concerning Scania’s provision of vehicle on-board diagnostic (OBD) information and vehicle repair and maintenance information.

Legal context

Regulation 2018/858

3 Recitals 50 and 62 of Regulation 2018/858 state:

‘(50) ‘Unrestricted access to vehicle repair and maintenance information, via a standardised format that can be used to retrieve the technical information, and effective competition in the market for services providing such information, are necessary to improve the functioning of the internal market, in particular as regards the free movement of goods, the freedom of establishment and the freedom to provide services. …

…

(52) In order to ensure effective competition in the market for vehicle repair and maintenance information services, and in order to clarify that the information concerned also covers information which needs to be provided to independent operators other than repairers, so as to ensure that the independent vehicle repair and maintenance market as a whole can compete with authorised dealers … it is necessary to set out the details of the information to be provided for the purposes of access to vehicle repair and maintenance information.

…

(62) Whenever the measures provided for in this Regulation entail the processing of personal data, they should be carried out in accordance with [the GDPR] …’

4 Points (40), (45), (48) and (49) of Article 3 of Regulation 2018/858 are worded as follows:

‘For the purposes of this Regulation and the regulatory acts listed in Annex II, except as otherwise provided therein, the following definitions apply:

…

40. “manufacturer” means a natural or legal person who is responsible for all aspects of the type-approval of a vehicle, system, component or separate technical unit, or the individual vehicle approval, or the authorisation process for parts and equipment, for ensuring conformity of production and for market surveillance matters regarding that vehicle, system, component, separate technical unit, part and equipment produced, irrespective of whether or not that person is directly involved in all stages of the design and construction of that vehicle, system, component or separate technical unit concerned;

…

45. “independent operator” means a natural or legal person, other than an authorised dealer or repairer, who is directly or indirectly involved in the repair and maintenance of vehicles, and include repairers, manufacturers or distributors of repair equipment, tools or spare parts, as well as publishers of technical information, automobile clubs, roadside assistance operators, operators offering inspection and testing services, operators offering training for installers, manufacturers and repairers of equipment for alternative-fuel vehicles; it also means authorised repairers, dealers and distributors within the distribution system of a given vehicle manufacturer to the extent that they provide repair and maintenance services for vehicles in respect of which they are not members of the vehicle manufacturer’s distribution system;

…

48. “vehicle repair and maintenance information” means all information, including all subsequent amendments and supplements thereto, that is required for diagnosing, servicing and inspecting a vehicle, preparing it for road worthiness testing, repairing, re-programming or re-initialising of a vehicle, or that is required for the remote diagnostic support of a vehicle or for the fitting on a vehicle of parts and equipment, and that is provided by the manufacturer to his authorised partners, dealers and repairers or is used by the manufacturer for the repair and maintenance purposes;

49. “vehicle [OBD] information” means the information generated by a system that is on board a vehicle or that is connected to an engine, and that is capable of detecting a malfunction, and, where applicable, is capable of signalling its occurrence by means of an alert system, is capable of identifying the likely area of malfunction by means of information stored in a computer memory, and is capable of communicating that information off-board.’

5 Article 61 of that regulation, entitled ‘Manufacturers’ obligations to provide vehicle OBD information and vehicle repair and maintenance information’, provides:

‘1. Manufacturers shall provide to independent operators unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information. Information shall be presented in an easily accessible manner in the form of machine-readable and electronically processable datasets. …

…

2. Until the [European] Commission has adopted a relevant standard through the work of the European Committee for Standardisation (CEN) or a comparable standardisation body, the vehicle OBD information and vehicle repair and maintenance information shall be presented in an easily accessible manner that can be processed with reasonable effort by independent operators.

The vehicle OBD information and the vehicle repair and maintenance information shall be made available on the websites of manufacturers using a standardised format or, if this is not feasible, due to the nature of the information, in another appropriate format. For independent operators other than repairers, the information shall also be given in a machine-readable format that is capable of being electronically processed with commonly available information technology tools and software and which allows independent operators to carry out the task associated with their business in the aftermarket supply chain.

…

4. The details of the technical requirements for access to vehicle OBD information and vehicle repair and maintenance information, in particular technical specifications on how vehicle OBD information and vehicle repair and maintenance information are to be provided, are laid down in Annex X.

…’

6 Under point 2.5.1 of Annex X to that regulation, entitled ‘Access to vehicle OBD information and vehicle repair and maintenance information’, that information includes ‘an unequivocal identification of the vehicle, system, component or separate technical unit for which the manufacturer is responsible’.

7 As set out in the third and fourth paragraphs of point 6.1 of that annex:

‘Information on all parts of the vehicle, with which the vehicle, as identified by the [vehicle identification number (VIN)] and any additional criteria such as wheelbase, engine output, trim level or options, is equipped by the vehicle manufacturer and that can be replaced by spare parts offered by the vehicle manufacturer to its authorised repairers or dealers or third parties by means of reference to original equipment (OE) parts number, shall be made available, in the form of machine readable and electronically processable datasets, in a database that is easily accessible to independent operators.

This database shall comprise the VIN, OE parts numbers, OE naming of the parts, validity attributes (valid-from and valid-to dates), fitting attributes and, where applicable, structuring characteristics.’

Regulation (EU) No 19/2011

8 Article 2(2) of Commission Regulation (EU) No 19/2011 of 11 January 2011 concerning type-approval requirements for the manufacturer’s statutory plate and for the vehicle identification number of motor vehicles and their trailers and implementing Regulation (EC) No 661/2009 of the European Parliament and of the Council concerning type-approval requirements for the general safety of motor vehicles, their trailers and systems, components and separate technical units intended therefor (OJ 2011 L 8, p. 1), which was repealed with effect from 5 July 2022, but remains applicable ratione temporis to the dispute in the main proceedings, provided:

‘For the purposes of this Regulation:

…

(2) “vehicle identification number” (VIN) means the alphanumeric code assigned to a vehicle by the manufacturer in order to ensure proper identification of every vehicle’.

9 Annex I to Regulation No 19/2011, entitled ‘Technical requirements’, contained Part B, point 1.2 of which provided that ‘the VIN shall be unique and unequivocally attributed to a specified vehicle’.

The GDPR

10 Article 2 of the GDPR, entitled ‘Material scope’, provides, in paragraph 1 thereof:

‘This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.’

11 Article 4 of that regulation is worded as follows:

‘For the purposes of this Regulation:

(1) “personal data” means any information relating to an identified or identifiable natural person …; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

…

(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …

…’

12 Article 6 of that regulation, entitled ‘Lawfulness of processing’, provides:

‘1. Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

…

3. The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.

The purpose of the processing shall be defined in that legal basis … . The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

…’

Directive 1999/37

13 Point II.5 of Annex I to Council Directive 1999/37/EC of 29 April 1999 on the registration documents for vehicles (OJ 1999 L 138, p. 57), as amended by Commission Directive 2003/127/EC of 23 December 2003 (OJ 2004 L 10, p. 29), states that the registration certificate of a vehicle must contain the VIN, the name and address of the holder of that certificate, preceded by harmonised Community codes E and C.

14 In accordance with point II.5 and point II.6 of that annex, a natural person may be designated in that certificate as owner of the vehicle (codes C.2 and C.4) or as a person who can use the vehicle by virtue of a legal right other than that of ownership (code C.3).

Directive (EU) 2019/1024

15 Recital 35 of Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and re-use of public sector information (OJ 2019 L 172, p. 56), states:

‘A document should be considered to be in a machine-readable format if it is in a file format that is structured in such a way that software applications can easily identify, recognise and extract specific data from it. …’

The dispute in the main proceedings and the questions referred for a preliminary ruling

16 Scania, which is one of the largest manufacturers of heavy goods vehicles in Europe and a ‘manufacturer’, within the meaning of point 40 of Article 3 of Regulation 2018/858, grants independent operators manual access to vehicle, repair and maintenance information on those vehicles and on the OBD system via a website. That website enables searches to be carried out either on the basis of general vehicle information, such as the model, engine or the year of manufacture, or on a given vehicle, by entering the last seven figures of the VIN of that vehicle. The results of those searches can only be printed or saved on the computer as a PDF file, which excludes automated use of data. The results of searches concerning information on spare parts can be saved in the form of an XML file.

17 It is apparent from the order for reference that Scania does not make the VINs available to independent operators. Only repairers have access to those data, by virtue of the registration documents or the indication on the chassis of the vehicle entrusted by the customer for the maintenance or repair of the vehicle.

18 Gesamtverband, together with its members, accounts for 80% of the turnover in the independent trade in motor vehicle parts in Germany. Taking the view that the access to information granted by Scania falls short of the requirements imposed on it by Article 61(1) and (2) of Regulation 2018/858, it requested the Landgericht Köln (Regional Court, Cologne, Germany), the referring court, to order Scania to grant independent operators other than repairers, referred to in point 45 of Article 3 of that regulation, access to vehicle repair and maintenance information, within the meaning of point 48 of Article 3 of that regulation, through a database interface, enabling automated queries to be carried out and the results to be downloaded in the form of sets of data intended for electronic use.

19 The referring court considers that the outcome of the dispute before it depends on the interpretation of Article 61(1) and (2) of Regulation 2018/858. It asks, in the first place, whether the obligation imposed by paragraph 1 on vehicle manufacturers to present the information in an ‘easily accessible manner in the form of machine-readable and electronically processable datasets’ covers all vehicle repair and maintenance information, within the meaning of point 48 of Article 3 of that regulation, or only the information relating to spare parts, referred to in the third subparagraph of point 6.1 of Annex X to that regulation, to which Article 61(4) of that regulation refers.

20 In the second place, the referring court notes that, although Article 61(1) and (2) of Regulation 2018/858 does not expressly require the vehicle manufacturer to establish a database interface, they nevertheless require that the information be presented in an ‘easily accessible’ manner. According to that court, manual consultation of that information, which it considers to be a time-consuming method of access, does not comply with that requirement.

21 In the third place, the referring court asks whether Article 61(1) and (2) of Regulation 2018/858 must be interpreted as allowing a vehicle manufacturer to limit access, in relation to vehicle repair and maintenance information, to targeted searches by means of the VIN, without, however, making available to independent operators an up-to-date list of all the VINs of its vehicles.

22 In the fourth place, the referring court notes that Article 61(1) of Regulation 2018/858, in so far as it requires independent operators to be provided with the information which it sets out in the form of ‘machine-readable and electronically processable datasets’, does not mean that the file format may be processed directly electronically, without an intermediate step such as conversion into another file format. It doubts, however, whether the tables and texts of a PDF file can be regarded as complying with Directive 2019/1024, recital 35 of which states that, in order for a document to be regarded as being in machine-readable format, it must be in a structured file format, so that software applications can easily identify and recognise specific data and extract them.

23 In the fifth place, the referring court, while taking the view that, as a general rule, the VIN does not constitute personal data, questions whether Article 61 of Regulation 2018/858 must be interpreted as imposing on vehicle manufacturers a legal obligation to process data, within the meaning of Article 6(1)(c) of the GDPR.

24 In those circumstances, the Landgericht Köln (Regional Court, Cologne) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Does the requirement laid down in the second sentence of Article 61(1) of [Regulation 2018/858] … cover all vehicle repair and maintenance information within the meaning of point 48 of Article 3 of that regulation, or is that requirement limited to ‘spare parts information’ … referred to in point 6.1 of Annex X to that regulation?

(2) Must the second sentence of Article 61(1) [and (2), second subparagraph, of Regulation No 2018/858] be interpreted as meaning that the vehicle manufacturer fulfils its obligations in that regard only by:

(a) making the information accessible via the internet by means of a machine-controlled query via a database interface, which provides the possibility to download the results, or is it sufficient that the vehicle manufacturer enables only a manual search by a human user on-screen on a website and limits the result of the query to the visible content of the pages displayed on-screen?

and

(b) making it possible for all information in the database linked to the vehicle manufacturer’s vehicle identification numbers (VINs) to be searched for on the basis of those VINs, which are to be provided by it in a separate list, and, independently of that possibility,

– also on the basis of other vehicle identification characteristics in accordance with the third subparagraph of point 6.1 of Annex X to [Regulation 2018/858]

– and on the basis of the terms that the vehicle manufacturer otherwise uses for categories (such as categories of components, spare parts, repair and maintenance instructions and technical illustrations) and other database entries in any combination

or is it sufficient that the manufacturer offers the search exclusively as an individual query based on the VIN of a single, specific vehicle without at the same time providing an up-to-date list of all its vehicles’ VINs?

and

(c) providing those datasets in files in a format which is intended to make the datasets contained therein directly amenable to (further) electronic processing, the description of the dataset concerned being specified (in the case of texts and tables), or is the possibility to export mere screenshots in any conventional file format, such as a PDF file, sufficient for that purpose?

(3) Does Article 61(1) of Regulation [2018/858] constitute, for vehicle manufacturers, a legal obligation within the meaning of Article 6(1)(c) of the GDPR which justifies the disclosure of VINs or information linked to VINs to independent operators as other controllers within the meaning of point 7 of Article 4 of the GDPR?’

Consideration of the questions referred

The first question

25 By its first question, the referring court asks, in essence, whether the second sentence of Article 61(1) of Regulation 2018/858 must be interpreted as meaning that the obligation to present the information referred to in that paragraph in an easily accessible manner, in the form of machine-readable and electronically processable data sets, covers all ‘vehicle repair and maintenance information’, within the meaning of point 48 of Article 3 of that regulation, or only the information relating to the spare parts referred to in point 6.1 of Annex X to that regulation.

26 The first sentence of Article 61(1) of Regulation 2018/858 requires vehicle manufacturers to provide independent operators with unrestricted, standardised and non-discriminatory access, inter alia, to ‘vehicle repair and maintenance information’, within the meaning of point 48 of Article 3 of that regulation. Under the second sentence of Article 61(1) of that regulation, all such information must be presented in an easily accessible manner, in the form of machine-readable and electronically processable data sets.

27 It thus follows from the wording itself of that provision that the obligation which it lays down covers the same information as that referred to in the first sentence of Article 61(1) of that regulation, namely, in particular, vehicle repair and maintenance information.

28 Although, under Article 61(4) of Regulation 2018/858, ‘the details of the technical requirements for access … to vehicle repair and maintenance information, in particular technical specifications on how vehicle OBD information and vehicle repair and maintenance information are to be provided, are laid down in Annex X’, and although the third paragraph of point 6.1 of that annex refers only to information on vehicle parts which can be replaced by spare parts, the fact remains that the latter provision does not itself govern the extent of access to vehicle repair and maintenance information. It cannot therefore have the effect of reducing the vehicle repair and maintenance information to that relating to spare parts.

29 In the light of the foregoing, the answer to the first question is that the second sentence of Article 61(1) of Regulation 2018/858 must be interpreted as meaning that the obligation to present the information referred to in that paragraph in an easily accessible manner, in the form of machine-readable and electronically processable datasets, covers all ‘vehicle repair and maintenance information’, within the meaning of  point 48 of Article 3 of that regulation, and not only the information relating to spare parts referred to in point 6.1 of Annex X to that regulation.

The second question

30 By its second question, the referring court asks, in essence, whether the second sentence of Article 61(1) and the second subparagraph of Article 61(2) of Regulation 2018/858 must be interpreted as meaning that it requires vehicle manufacturers, first, to make vehicle repair and maintenance information accessible via a database interface enabling automated searches with downloading of results, second, to establish a database enabling search on the basis not only of the VIN but also of additional means and, third, to make that information available to independent operators in files the format of which allows the direct electronic use of the sets of data contained in those files.

31 In the first place, as has been recalled in paragraph 26 of the present judgment, Article 61(1) of Regulation 2018/858 requires vehicle manufacturers to provide independent operators with unrestricted, standardised and non-discriminatory access, inter alia, to vehicle repair and maintenance information and to present it in a manner that is ‘easily accessible, in the form of machine-readable and electronically processable datasets’.

32 The first sentence of the second subparagraph of Article 61(2) requires those manufacturers to make vehicle repair and maintenance information available on their websites in a standardised format or, if that is not feasible due to the nature of the information, in another appropriate format. The second sentence of that second subparagraph requires those manufacturers to provide that information to independent operators other than repairers in a machine-readable format, capable of being electronically processed by means of generally available computer tools and software, so that those operators can carry out their activities in the supply chain of the market for spare parts and equipment (see, to that effect, judgment of 27 October 2022, ADPA and Gesamtverband Autoteile-Handel, C‑390/21, EU:C:2022:837, paragraph 28).

33 Until the adoption by the Commission of an appropriate standard, the same manufacturers must, under the first subparagraph of Article 61(2) of Regulation 2018/858, present that information in an ‘easily accessible’ manner in such a way that it can be processed by independent operators ‘with reasonable effort’.

34 However, Article 61 of that regulation does not impose an obligation on vehicle manufacturers to set up an interface that can be used to search those manufacturers’ databases.

35 In the second place, under the third paragraph of point 6.1 of Annex X to Regulation 2018/858, to which Article 61(4) of that regulation refers, ‘information on all parts of the vehicle, with which the vehicle, as identified by the VIN and any additional criteria such as wheelbase, engine output, trim level or options, is equipped by the vehicle manufacturer and that can be replaced by spare parts offered by the vehicle manufacturer to its authorised repairers or dealers or third parties by means of reference to original equipment (OE) parts number, shall be made available, in the form of machine readable and electronically processable datasets, in a database that is easily accessible to independent operators’.

36 It follows from the wording itself of the third paragraph of point 6.1 that, as regards information on parts that can be replaced by spare parts, manufacturers are required to create a database (see, to that effect, judgment of 19 September 2019, Gesamtverband Autoteile-Handel, C‑527/18, EU:C:2019:762, paragraph 32), allowing searches to be carried out using not only the VIN but also the ‘additional criteria’ provided for in that provision.

37 That interpretation is consistent with the objective of ensuring effective competition on the market for vehicle repair and maintenance information services, as set out in recitals 50 and 52 of Regulation 2018/858. To that end, independent operators, such as publishers of technical information and manufacturers of parts, must be able, in order to carry out their activities in the supply chain of the spare parts and equipment market, to carry out searches by all the means listed in the preceding paragraph of the present judgment.

38 In the third place, the manufacturers’ obligation to make vehicle repair and maintenance information available to independent operators in a form amenable to electronic processing, laid down in Article 61(1) of Regulation 2018/858, must enable those operators to ‘retrieve the technical information’ (see, to that effect, judgment of 27 October 2022, ADPA and Gesamtverband Autoteile-Handel, C‑390/21, EU:C:2022:837, paragraph 27).

39 In addition, it should be noted that, according to recital 35 of Directive 2019/1024, in order for a document to be regarded as being in machine-readable format, it must be presented ‘in a file format structured in such a way that software applications can easily identify and recognise and extract specific data from it’.

40 It is apparent from the order for reference that making information available in a format such as that offered by Scania lends itself only to indirect electronic processing and requires those operators to carry out intermediate stages of file conversion which do not allow automated processing in a directly processable format. Subject to the checks which it is ultimately for the referring court to carry out, such making available cannot be regarded as complying with the second sentence of Article 61(1) and the second subparagraph of Article 61(2) of Regulation 2018/858.

41 That interpretation is consistent with the objective of ensuring effective competition on the market for vehicle repair and maintenance information services, as set out in recitals 50 and 52 of Regulation 2018/858. To that end, it is essential, as the Commission pointed out in its written observations, that independent operators should be able to extract technical data from the format by which manufacturers make the necessary information available to them and to retain those data immediately after their retrieval for re-use.

42 In the light of the foregoing, the answer to the second question is that the second sentence of Article 61(1) and the second subparagraph of Article 61(2) of Regulation 2018/858 must be interpreted as meaning that:

– it does not require vehicle manufacturers to make vehicle repair and maintenance information accessible by means of a database interface allowing automated search with downloading of results, but requires them to make that information available to independent operators in files the format of which allows for direct electronic processing of the sets of data contained in those files;

– read in conjunction with Article 61(4) of that regulation and the third subparagraph of point 6.1 of Annex X thereto, it requires vehicle manufacturers to establish a database making it possible to search for information on all the original parts of the vehicle on the basis not only of the VIN but also of the additional means provided for in that provision.

The third question

43 By its third question, the referring court asks, in essence, whether Article 61(1) of Regulation 2018/858 must be interpreted as establishing a ‘legal obligation’, within the meaning of Article 6(1)(c) of the GDPR, on vehicle manufacturers, to make the VINs of the vehicles that they manufacture available to independent operators, as ‘controllers’, within the meaning of Article 4(7) of that regulation.

44 In order to answer that question, it is necessary to examine, first, whether the VIN falls within the concept of ‘personal data’, within the meaning of Article 4(1) of the GDPR, which defines that concept as ‘any information relating to an identified or identifiable natural person’.

45 That definition is applicable where, by reason of its content, purpose and effect, the information in question is linked to a particular natural person (judgment of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet (Purposes of the processing of personal data – Criminal investigation), C‑180/21, EU:C:2022:967, paragraph 70). In order to determine whether a natural person is identifiable, directly or indirectly, account should be taken of all the means likely reasonably to be used either by the controller, within the meaning of Article 4(7) of the GDPR, or by any other person, to identify that person, without, however, requiring that all the information enabling that person to be identified should be in the hands of a single entity (see, to that effect, judgment of 19 October 2016, Breyer (C‑582/14, EU:C:2016:779, paragraphs 42 and 43).

46 As the Advocate General observed in points 34 and 39 of his Opinion, a datum such as the VIN – which is defined by Article 2(2) of Regulation No 19/2011 as an alphanumeric code assigned to the vehicle by its manufacturer in order to ensure that the vehicle is properly identified and which, as such, is not ‘personal’ – becomes personal as regards someone who reasonably has means enabling that datum to be associated with a specific person.

47 It follows from point II.5 of Annex I to Directive 1999/37 that the VIN must appear on the registration certificate for a vehicle, as must the name and address of the holder of that certificate. In addition, under points II.5 and II.6 of that annex, a natural person may be designated in that certificate as the owner of the vehicle, or as a person who can use the vehicle on a legal basis other than that of owner.

48 In those circumstances, the VIN constitutes personal data, within the meaning of Article 4(1) of the GDPR, of the natural person referred to in that certificate, in so far as the person who has access to it may have means enabling him to use it to identify the owner of the vehicle to which it relates or the person who may use that vehicle on a legal basis other than that of owner.

49 As the Advocate General observed in points 34 and 41 of his Opinion, where independent operators may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person, which it is for the referring court to determine, that VIN constitutes personal data for them, within the meaning of Article 4(1) of the GDPR, and, indirectly, for the vehicle manufacturers making it available, even if the VIN is not, in itself, personal data for them, and is not personal data for them in particular where the vehicle to which the VIN has been assigned does not belong to a natural person.

50 If it follows from the determination referred to in the preceding paragraph of the present judgment that a VIN must be regarded as personal data, it falls within the scope of the GDPR, pursuant to Article 2(1) thereof, and must therefore be processed in accordance with that regulation.

51 The concept of ‘processing’ is defined in Article 4(2) of the GDPR as any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automatic means, such as disclosure by transmission, dissemination or otherwise making available. That concept therefore covers the making available of a VIN by the ‘controller’, within the meaning of Article 4(7) of that regulation, where that VIN makes it possible to identify a natural person.

52 Article 6 of the GDPR lays down the conditions for the lawfulness of the processing of such data. In accordance with paragraph 1(c) of that article, processing is lawful where it is necessary for compliance with a legal obligation to which the controller is subject.

53 Article 6(3) of the GDPR states, moreover, that that processing must be based on EU law or on Member State law to which the controller is subject and that that legal basis must define the purposes of the processing and meet a public interest objective, and be proportionate to the pursuit of such an objective.

54 As stated in recital 62 of Regulation 2018/858, the rules on the protection of personal data must be applied whenever the measures provided for in that regulation entail the processing of personal data.

55 It is in the light of the foregoing that it is necessary to examine, secondly, the content and scope of Article 61(1) of Regulation 2018/858.

56 That provision, as has already been pointed out in paragraphs 26 and 31 of the present judgment, requires, first of all, vehicle manufacturers to make available to independent operators, inter alia, vehicle repair and maintenance information, defined in point 48 of Article 3 of that regulation as ‘all information, including all subsequent amendments and supplements thereto, that is required for diagnosing, servicing and inspecting a vehicle, preparing it for road worthiness testing, repairing, re-programming or re-initialising of a vehicle, or that is required for the remote diagnostic support of a vehicle or for the fitting on a vehicle of parts and equipment, and that is provided by the manufacturer to his authorised partners, dealers and repairers or is used by the manufacturer for the repair and maintenance purposes.’

57 In addition, Annex X to Regulation 2018/858, to which Article 61(4) of that regulation refers, states, in point 2.5.1, that vehicle repair and maintenance information is to include ‘an unequivocal identification of the vehicle’. Furthermore, in accordance with the fourth paragraph of point 6.1 of that annex, the VIN is to appear in the database that the manufacturer is required to establish, pursuant to the third subparagraph of point 6.1, concerning the original parts of the vehicle that can be replaced by spare parts.

58 Those provisions of EU law thus impose on vehicle manufacturers the ‘legal obligation’, within the meaning of Article 6(1)(c) of the GDPR, to make available to independent operators, among other data, the VINs. Such a ‘legal obligation’ satisfies the first condition for the lawfulness of the processing of personal data set out in paragraph 52 of the present judgment.

59 Next, Article 61(1) of Regulation 2018/858 defines the purpose of that data processing obligation, which is to provide independent operators with unrestricted, standardised and non-discriminatory access to, inter alia, vehicle repair and maintenance information within the meaning of point 48 of Article 3 of that regulation. The ‘legal obligation’ for manufacturers to make the VINs of their vehicles available to independent operators therefore meets the objective, set out in recital 52 of that regulation, of ensuring effective and undistorted competition on the market for vehicle repair and maintenance information services.

60 According to recital 50 of Regulation 2018/858, such competition is necessary in order to improve the functioning of the internal market, in particular as regards the free movement of goods, the freedom of establishment and the freedom to provide services. Therefore, the objective referred to in the preceding paragraph is in the public interest and, accordingly, legitimate (see, by analogy, judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, EU:C:2022:601, paragraph 75). The second condition for the lawfulness of the processing of personal data set out in paragraph 53 of the present judgment is thus satisfied.

61 As regards, lastly, the third condition for the lawfulness of the processing of personal data, laid down in Article 6(3) of the GDPR and requiring that that processing be ‘proportionate to the legitimate objective pursued’, it is sufficient to note, as the Advocate General did in the fourth indent of point 52 of his Opinion, first, that only the search using the VIN enables the data corresponding to a particular vehicle to be accurately identified and, second, that the file before the Court does not refer to any other less restrictive means of identification which, at the same time, would be as effective as search on the basis of the VIN and would enable the public interest objective identified in the preceding paragraph to be pursued. Article 61(1) of Regulation 2018/858 thus satisfies the third condition referred to in paragraph 53 of the present judgment.

62 In the light of the foregoing, the answer to the third question is that Article 61(1) of Regulation 2018/858, read in conjunction with Article 61(4) and point 6.1 of Annex X to that regulation, must be interpreted as meaning that it establishes a ‘legal obligation’, within the meaning of Article 6(1)(c) of the GDPR, on car manufacturers, to make the VINs of the vehicles which they manufacture available to independent operators, as ‘controllers’, within the meaning of Article 4(7) of that regulation.

Costs

63 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the national court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules:

1. The second sentence of Article 61(1) of Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC,

must be interpreted as meaning that the obligation to present the information referred to in that paragraph in an easily accessible manner, in the form of machine-readable and electronically processable datasets, covers all ‘vehicle repair and maintenance information’, within the meaning of point 48 of Article 3 of that regulation, and not only the information relating to spare parts referred to in point 6.1 of Annex X to that regulation.

2. The second sentence of Article 61(1) and the second subparagraph of Article 61(2) of Regulation 2018/858

must be interpreted as meaning that:

– it does not require vehicle manufacturers to make vehicle repair and maintenance information accessible by means of a database interface allowing automated search with downloading of results, but requires them to make that information available to independent operators in files the format of which serves for direct electronic processing of the sets of data contained in those files;

– read in conjunction with Article 61(4) of that regulation and the third subparagraph of point 6.1 of Annex X thereto, it requires vehicle manufacturers to establish a database making it possible to search for information on all the original parts of the vehicle on the basis not only of the vehicle identification number (VIN) but also of the additional means provided for in that provision.

3. Article 61(1) of Regulation 2018/858, read in conjunction with Article 61(4) and with point 6.1 of Annex X to that regulation,

must be interpreted as meaning that it establishes a ‘legal obligation’, within the meaning of Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), on car manufacturers, to make the VINs of the vehicles which they manufacture available to independent operators, as ‘controllers’, within the meaning of Article 4(7) of that regulation.