DOES THE VEHICLE VIN REPRESENT PERSONAL DATA WITHIN THE MEANING OF THE PERSONAL DATA PROTECTION ACT?
As a rule, the VIN itself does not constitute information on the basis of which a particular person can be identified. Therefore, it cannot be regarded as personal data. However, for the data controller, which in this case is the minister responsible for public administration, the link of the VIN
With other information identifying the owner of the vehicle is not a problem. So it allows you to identify a specific person without excessive cost, time and action. The VIN is therefore personal data for him.
According to art. 6 of the law of 29 August 1997. On the protection of Personal data, hereinafter referred to as the Act, any information relating to an identified or identifiable natural person shall be considered as personal data. An identifiable person is an individual whose identity can be identified, directly or indirectly, in particular by reference to an identification number or one or more specific factors determining its physical characteristics , physiological, mental, economic, cultural or social. However, the information is not considered to allow the identification of a person if it would entail excessive costs, time or action. In the light of the definition cited, it is therefore for personal data to be considered as such that it is possible to directly identify the identity of a particular person, as well as those which do not allow it to be identified immediately, However, this allows for a certain amount of cost, time, or effort.
In determining whether a VIN belongs to the category of personal data, it is necessary to take into account both the provisions of the Act on the Protection of personal data and the normalisation of the law of 20 June 1997. Traffic law.
The latter stipulates that any vehicle involved in the movement should have the manufacturer’s identification characteristics, such as the VIN or the number of the bodywork, chassis or frame (article 66 (3a) of the Road Traffic law).
It is therefore difficult to conclude that the VIN itself constitutes personal data. It cannot, on the basis of that person, be identified either directly or indirectly without undue cost, time and action.
However, for certain entities having access to information gathered in central driver records, having the same VIN is the information on the basis of which they are able, without excessive cost, time and action, to identify Specific person.
According to art. 80a para. 2 traffic rights, central vehicle records collect data and information about registered vehicles and their owners or certain holders. Vehicle data is m.in. Make, type and model; Type Registration number; VIN identification number or bodywork number (chassis); Year of manufacture; Series and number of the registration certificate; The series and number of the vehicle card, if issued. On the other hand, the owner of the vehicle and his holder are collected data such as name and surname (name or company), address of residence (registered office), identification number of Pesel, number of Regon. Such records shall be maintained by the Minister responsible for public administration in the computerised system and is at the same time the controller of the data and information gathered there.
The Road Traffic Act indicates a closed directory of entities that have access to information gathered in central vehicle records. These are m.in. Police, prosecutors, courts, court bailiffs, Zus, municipal (municipal) authorities, tax inspectorates, competent authorities
In vehicle registration cases, tax authorities.
For them, the VIN number will be personal data.