Is it a breach reportable to PUODO to include in an advertising film footage showing visible registration numbers of private cars?

ANSWER

When addressing this question, it is first necessary to recall the differing interpretations as to whether vehicle registration numbers qualify as personal data.

Following the position of the President of PUODO, who supports treating vehicle registration numbers as personal data, the situation described would not be regarded as a personal data breach within the meaning of Article 4(12) GDPR.

It should be recalled that under the provision cited, a personal data breach may be said to occur where there has been: "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed".

The question indicates that the use for advertising purposes of footage showing visible registration numbers of private cars was a planned and organised action by the author of the material. In this case no incident occurred, which already rules out qualifying the event analysed under the definition cited above. However, a breach of data protection rules cannot be excluded in such a situation, e.g. in the form of lacking an appropriate legal basis for processing personal data (including their dissemination). Such conduct may give the data subject grounds to lodge a complaint with the President of PUODO.