It must be acknowledged that the issue of vehicle registration numbers as personal data, although raised multiple times over the past few years, has not been definitively resolved in the case law. It is not difficult to find rulings in which a registration number is undoubtedly considered personal data, as it can identify a natural person; on the other hand, there are judgments in which the judicial panel ruled entirely differently.
Registration Number as Personal Data
Let us take, for example, the judgment of the Provincial Administrative Court in Warsaw dated April 13, 2017 (case reference: VII SA/Wa 1069/16). In brief: the case concerned a complaint against a resolution of the City Council issued in violation of the law. According to the Complainant, the violation of personal data protection regulations (then still the Personal Data Protection Act of 1997) consisted of imposing an obligation in the resolution to provide the vehicle registration number in a situation where there was no statutory basis for processing such personal data. The Court agreed with the Complainant and stated that the vehicle registration number can lead to the identification of a person and therefore constitutes personal data that should be processed based on a legal basis for processing.
Interestingly, the WSA also pointed out that the fact of recognizing the registration number as personal data should depend on whether the entity that has access to such information is able, based on it, taking into account all reasonably probable means, to establish the identity of the natural person associated with the given vehicle. Let us recall that according to recital 26 of the GDPR Preamble, “to determine whether a particular method may reasonably be used to identify a person, all objective factors, such as the cost and time required to identify that person, should be taken into account, as well as the technology available at the time of data processing and technological progress.”
Example:
Translating this to our factual situation – the registration number processed, for example, by the Municipal Guard allows for the seamless identification of the vehicle owner (according to Article 80c of the Road Traffic Act, the officers of the Municipal Guard have access to the Central Vehicle Register). However, the same registration number in the hands of Mr. Jan Nowak, who maintains an internal register of individuals entering his small manufacturing facility, without linking it to a specific person, will not necessarily constitute personal data.
Or maybe not?
On the other side of the barricade stands the Provincial Administrative Court in Kraków, which in case file no. II SA/Lr/1339/16 stated that “the position of the authority asserting that the vehicle registration number has the status of personal data (...) should be considered completely erroneous. (...) Such qualification is not warranted for information that cannot be easily linked to a specific person without extraordinary effort. It must not escape attention that the vehicle registration number primarily serves to identify the vehicle to which it is assigned, and it is not possible, in a simple and easy manner, to link the vehicle registration number to a specific person – the owner (or possessor) of the vehicle.”
In a similar vein, as recently as June of last year, the Supreme Administrative Court (case file no. i OSK 2063/17) commented on registration numbers. In the dispute regarding the necessity of providing the registration number when paying for parking at a parking meter, the SAC stated that collecting the registration number of the parked vehicle is justified, as this number identifies the vehicle, not the person, and therefore cannot be considered personal data.
Position of the President of the Polish DPA
Although the matter seemed to have been resolved, the President of the Polish DPA, Jan Nowak, took a position contrary to the ruling of the NSA. This occurred in the context of work on the deregulatory package for drivers (i.e., the proposed amendments to the Road Traffic Law). The President of the Polish DPA accused the draft law of failing to take into account the aspect related to the protection of personal data and indicated that "The proposed regulation concerns registration plates that constitute personal data of the vehicle owner. This is indeed information through which it is possible to identify—indirectly—a natural person who is the owner of the vehicle."
On one hand, it is difficult to disagree with such an interpretation—although the identification of the vehicle owner (the owner—not the driver) can generally only be carried out by authorized services and public administration bodies, establishing the identity of the owner based solely on the registration plates is possible. At the same time, not recognizing them as personal data allows state authorities to process information, for example, about where and when we parked, without a legal basis and without transparency regarding the purposes for which such data may be used—as if the State did not already know too much about us... On the other hand, such an approach may lead to significant administrative disruptions in public offices and the private sector.
Conclusions?
Let us be more cautious when processing information in the form of registration numbers, including when disseminating visible registration plates online (despite the recent trend of sharing photos on social media that shame improper behavior of drivers), let us expect significant delays in legislative work on the deregulatory package, and let us observe how the obligation to provide registration numbers when paying for parking will be abolished in the future.
