Can a school be the data controller of personal data of clients who use a vehicle diagnostic station registered on its premises?

ANSWER

It should first be noted that under Article 4(7) GDPR a data controller may be a natural or legal person, a public authority, agency or other body which alone or jointly with others determines the purposes and means of processing personal data. Since a diagnostic station may be operated not only by entrepreneurs entered in the register of vehicle inspection station operators, but also by non-entrepreneurial entities such as schools or training centres, in the case described the data controller will be the school, represented by the head teacher. As regards the legal basis for processing clients' personal data at the station, this will be Article 6(1)(b) GDPR. When a client brings a vehicle to the station, they conclude a contract with it for the provision of vehicle diagnostic services.