Service and repair history of cars and personal data protection
Information on the service and repair history of cars may be considered personal data
Data protection legislation applies only to the processing of personal data.
Motor vehicles are registered in a a national vehicle register, which is carried out by the Icelandic Transport Authority. The vehicle register includes information about the vehicle, its owner and, where applicable, the operator.
The work performed on registered vehicles therefore follows the vehicle number in question and can thus be identifiable information, that is, personal data.
Sharing information on service and repair history of a car to a new car owner
All processing of personal data, such as the transmission of it from the Icelandic Transport Authority, insurance companies, car agencies or workshops, must be carried out on legal grounds, according to data protection legislation.
See here information regarding possible legal grounds on processing personal data.
A possbile legal ground for the abovementioned sharing of information is that it is considered necessary because of the legitimate interests of the responsible party (for example, a service shop or a car dealership) or a third party (for example, a new owner of a car).
It is the responsibility of the controller (that is, the person who disseminates the information) to assess whether and if any authorization for the dissemination exists, and thus whether a new car owner can request a repair and service history of a car, but this evaluation can be subject to review by the Data Protection Authority, if the institution receives a formal complaint.
