Third Party Question

Discussion in 'General Data Protection Regulation (GDPR) Forum' started by BigPhill, Mar 6, 2018.

  1. BigPhill

    BigPhill UKBF Contributor Free Member

    41 15
    This doesn't apply to my line of work, it's more a matter of interest...

    Today I phoned a local car parts company and asked for a specific part... They needed my vehicle registration number to look up the details on the computer. Fair enough

    Now, i'm assuming this information is supplied by the DVLA, however my number plate is a personal plate owned by me...

    Yes, it's obviously registered to my current vehicle, however *in theory* is this regarded as a "Personal Identifier" under GDPR?

    If so, would third party companies such as this have to ask for consent to view this information?
    Posted: Mar 6, 2018 By: BigPhill Member since: Oct 13, 2017
  2. Simon Plummer

    Simon Plummer UKBF Contributor Free Member

    82 22
    This is an interesting one - and certainly open to interpretation. My view on this is that it is an identifier of a vehicle. On its own it is just some letters and numbers. However, combine this with further information from the DVLA database (i.e. name/address/owner of plate etc) and it then becomes personal so GDPR applies. You could however argue that it is publicly available information since it sits on your car (retention situations aside). So the concern should be around the DVLA database more than the number itself as this is the link between just data and personal data. I would expect that people/companies that have access to this database are subject to terms of use and privacy controls - i expect they would be defined as processors whilst the DVLA are the controllers. Good question - got me thinking :)
    Posted: Mar 6, 2018 By: Simon Plummer Member since: Dec 6, 2017
  3. Mr D

    Mr D UKBF Legend Free Member

    10,569 1,109
    Interesting. Personal plates or random stuff on there when car purchased, either way identifies the vehicle.
    Should companies be asking for reg number if they are not dealing with the vehicle themselves?
    Posted: Mar 6, 2018 By: Mr D Member since: Feb 12, 2017
  4. Mike Hayes

    Mike Hayes UKBF Enthusiast Full Member

    832 204
    I would have thought yes, it's a personal identifier as the DVLA can map a registration to an individual. In the same way that a website visitor's IP address is considered a personal identifier because ISP's keep records of which customer a certain IP address is assigned to at any time.
    Posted: Mar 6, 2018 By: Mike Hayes Member since: Jan 7, 2016
  5. Simon Plummer

    Simon Plummer UKBF Contributor Free Member

    82 22
    Ultimately if you give them the plate then you have consented to it. You could say they could look the car up by make/model and probably VIN too - just like on the halfords website - its just easier! GDPR is generally about common sense. The company, if they really wanted to be 100% would state what they do with the plate details in their privacy statement under their processing activities section, for example "we process number plate details to provide a service, once the service is complete we do not hold or continue to process that data" - this is VERY rough and off the top of my head, but you hopefully get my point.
    Posted: Mar 6, 2018 By: Simon Plummer Member since: Dec 6, 2017
  6. Keith Budden

    Keith Budden UKBF Contributor Full Member

    77 10
    Just to clarify, under GDPR, a car registration number is regarded as PII data, regardless of whether it is a 'normal' plate or a generic plate.

    Incidentally, this raises a larger issue around office visitor books which ask for car registration number, but I will leave that one for another day.....
    Posted: Mar 30, 2018 By: Keith Budden Member since: Mar 30, 2018