News from the ECJ on "personal reference"

The term "personal reference" is more important in data protection law than any other. A recent ECJ ruling from November 9, 2023 initially confirms the relative understanding of personal reference, but at the same time creates new uncertainties by extending the "indirect personal reference" to actors who are not even in a position to establish a personal reference themselves. The ruling is likely to play an exciting role in developments in data protection law in the coming years.

What was it about?

The ruling is based on a legal dispute between the Gesamtverband "Autoteile-Handel" e. V. against a truck manufacturer. The truck manufacturer grants independent economic operators access to general vehicle information such as model, motorization or year of manufacture. This does not include the VIN (vehicle identification number). This can only be viewed by workshops directly in the registration documents to be submitted by the owner or directly on the chassis. The association took legal action against this. It was of the opinion that the truck manufacturer was obliged to disclose the VIN to independent economic operators in accordance with a special sectoral law on vehicle approvals. The Regional Court of Cologne referred this question to the ECJ and at the same time asked what data protection implications such an obligation would have. Part of the ECJ ruling therefore deals with the question of whether the VIN, as an alphanumeric code that the manufacturer assigns to a vehicle for the purpose of identifying it, constitutes personal data.

Previous understanding of personal reference in case law

The term "personal data" is defined in Art. 4 No. 1 GDPR as "any information relating to an identified or identifiable person". The law also stipulates that a person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier. The person therefore does not have to be identifiable on the basis of the "date" in question alone, but additional knowledge must always be taken into account. For a long time, however, the question arose as to whose additional knowledge is relevant: only the knowledge of the data controller, or all additional information known to any third party? In 2016, the ECJ turned to the former, so-called relative approach in its "Breyer" judgment, in which it ruled on the personal reference of dynamic IP addresses. It focused on the perspective of the data controller with regard to identifiability. However, the ECJ also allowed the additional knowledge of third parties to suffice if it is reasonably likely that the data controller has access to it, for example due to the legal means at its disposal. In the "Breyer" ruling, the Federal Court of Justice found it sufficient for identifiability if the public prosecutor's office and a court order can be used to determine the owner of an IP address from the relevant internet provider. This is a very broad interpretation, according to which a great deal of information for companies and authorities is to be regarded as personal data per se, even if it is regularly not possible for the authorities and companies to actually assign the data to a person. This broad interpretation was in turn often interpreted to mean that the Federal Court of Justice had in fact extended the relative concept of personal reference to such an extent that it came close to an absolute concept. The ECJ has thus left both legal scholars and practitioners with criteria that are difficult to apply and the resulting legal uncertainty.

The ECJ's decision on VIN

The current decision of the ECJ deals with the VIN, which in turn is an alphanumeric code that does not in itself allow any conclusions to be drawn about a natural person. However, the VIN is contained in the registration certificate alongside the address and name of the current and, if applicable, all former vehicle owners. Against this background, the ECJ ruled that the VIN is personal data for anyone who may have the means to use the VIN to identify the owner of the vehicle to which the VIN relates. The ECJ emphasized in several paragraphs that it depends on which actor has access to the VIN and the other data from the registration certificate and under what conditions. This is initially a clear confirmation of the relative understanding of personal reference.

Rather narrower understanding of the "means" that are "reasonably" used to make an identification

The ECJ left it to the court of fact to clarify the question of whether the independent economic operators – in this case the overall association – reasonably have the means to allocate the VIN. This already represents an initial ambiguity, as the standard of these "reasonably available means" was already insufficiently defined in the Breyer ruling. After all, the ECJ – unlike in the Breyer ruling – did not itself indicate a way in which an actor can "reasonably" match data. The very fact that the ECJ assumed in the Breyer ruling that a person can be identified by means of an IP address with the help of the public prosecutor's office – and the ruling can certainly be read to mean that all IP addresses are to be regarded as personal per se – leads to an extremely broad understanding of the reference to persons. The obstacles that arise here were hardly taken into account by the ECJ in 2016 (e. g. the fact that internet providers delete the assignment of dynamic IP addresses after a few days (after 7 days at the latest)) – or the fact that a large number of people often operate behind one IP address (e. g. in a public WLAN or in the network of a larger company; in both cases, hundreds and thousands of people can often appear externally with the same IP address). It is therefore very welcome that the ECJ is now acting more cautiously and has repeatedly emphasized that it depends on the means available to the person responsible. This can certainly be seen as a step towards a less narrow understanding of the concept of personal reference, although it remains to be seen how the courts of fact in Germany will decide.

Extension of the personal reference to vehicle manufacturers

In contrast, it is surprising that the ECJ then assumes that the personal reference – should it be affirmed for the association as a whole – also extends "indirectly" to the vehicle manufacturers. The ECJ writes in para. 49 of the judgment:

"As the Advocate General stated in points 34 and 41 of his Opinion, where the independent economic operators may reasonably have at their disposal means enabling the VIN to be attributed to an identified or identifiable natural person, which is a matter for the referring court to determine, the VIN constitutes personal data within the meaning of Article 4(1) GDPR for those economic operators and, indirectly, for the vehicle manufacturers who provide the VIN, even if the VIN does not in itself constitute personal data for the vehicle manufacturers, in particular if it does not belong to a natural person. 4(1) GDPR, even if the VIN does not in itself constitute personal data for the vehicle manufacturers, in particular if the vehicle to which it has been assigned does not belong to a natural person."

Based on the English language version of the judgment, it is likely that the manufacturer is not referring to an indirect, but rather an indirect personal reference within the meaning of Art. 4 No. 1 GDPR. Nevertheless, what is surprising about this insertion is that the ECJ inserts it in a subordinate clause without any justification and assumes that, despite the principle established, a personal reference should also exist for vehicle manufacturers, even if the VIN in itself does not constitute personal data for the vehicle manufacturer. This view hardly fits in with the concept of relative personal reference, which the ECJ itself repeats just one paragraph earlier.

Implications for practice

Economic operators should initially welcome the fact that the ECJ has now spoken out even more clearly in favor of the relative understanding of the term in the sense of a less broad interpretation of personal reference than was the case in the Breyer ruling. This is because the more one turns to the absolute theory, the more data is considered personal and triggers the applicability of the comprehensive GDPR obligations. However, due to the "indirect" inclusion of vehicle manufacturers, it should be treated with caution: this considerably extends the personal reference. However, it remains completely unclear how far this extension should extend.

In practice, it will not always be possible for the person initially "not responsible" under data protection law to assess with certainty whether data transmitted to a recipient must be regarded as personal data due to additional knowledge. There is also the question of whether, in such a case, only the direct recipient or possibly also other third parties to whom the recipient passes on the data should be taken into account.

Overall, it therefore remains to be seen what significance the ECJ will attach to this small insertion in the ruling, which is in itself to be welcomed. For the time being, however, there will remain a considerable lack of clarity when determining the personal reference of a date.