On 9 November 2023, in case C-319/22 (Gesamtverband Autoteile-Handel e. V. vs. Scania CV AB), the European Court of Justice published the Advocate General’s opinion that Vehicle Identification Numbers (VINs), the numbers appearing on the chassis of a vehicle, constitute personal data within the meaning of Article 4(1) GDPR.
In other words, the Advocate General highlighted that anyone with access to a VIN has means, which reasonably allow them to use the VIN to identify the owner of the vehicle that it relates to:
“In these circumstances, the VIN constitutes personal data, within the meaning of Article 4(1) of the GDPR, of the natural person referred to in that certificate, in so far as the person who has access to it may have means enabling him to use it to identify the owner of the vehicle to which it relates or the person who may use that vehicle on a legal basis other than that of owner”. 
Importantly, this judgment aligns with the landmark decision in SRB v EDPS , which has been followed by the recent $93m settlement between Google and the California AG (see our related blogpost here). It reaffirms that where there are reasonable organisational measures in place to ensure the data is not linked to a specific individual, then the data should not be considered “personal data”.
In essence, the starting point for any identifier of an object is the reasonableness test of whether such an identifier is linked to a specific individual in the hands of the organisation. If reasonable organisational measures exist to keep the match key/identifier distinct from a specific individual, even though it is still linked to an object used by people, then it is not “personal data.”
Please contact Tim Cowen if you have any questions regarding the above.
The material contained in this article is only for general review of the topics covered and does not constitute any legal advice. No legal or business decision should be based on its content.
This article is written in English language. Preiskel & Co LLP is not responsible for any translation of all or part of its content into any language.