Access to data in the automotive industry in light of judicial practice and new data regulation

The Court of Justice of the European Union (CJEU) has issued important rulings that have shed new light on the ongoing debate surrounding data access in the automotive industry. The new European Data Act regulation, set to take full effect on 12 September 2025, will introduce better availability of vehicle data. So what can you expect, and how should you prepare for it?

Method of accessing vehicle data

The GVA, the German industry association for the independent automotive parts trade, filed a lawsuit against a major truck manufacturer in a German court. The lawsuit claimed the manufacturer’s website restricted access to vehicle repair and maintenance information, requiring manual access. Users could search the website by entering general vehicle details such as the model or year of manufacture. Alternatively, a specific vehicle could be searched using the last seven digits of its Vehicle Identification Number (VIN). 

However, users could only print or save the search results as a PDF file through the website interface. According to the GVA, the manufacturer’s limited access to information failed to comply with the requirements outlined in the Motor Vehicle Approval Regulation 2018/858.[1] Article 61(1) and (2) provides that manufacturers should provide unrestricted, standardised and non-discriminatory access mainly to vehicle repair and maintenance information, which must be presented in an easily accessible manner in the form of machine-readable and electronically processable datasets.

The CJEU[2] in fact ruled in favour of GVA in the court proceedings. The court ruled that the manual search allowed by the manufacturer’s website does not meet the requirements of the Regulation Manufacturers are not required to provide vehicle repair and maintenance information through a database interface that allows automated queries and downloadable results. 

However, the information must be provided to independent economic operators in a file format suitable for direct electronic processing, rather than in PDF format which does not meet this requirement. The measures should simplify access to repair, maintenance, and spare parts information for independent operators such as repairers and spare parts dealers.

The VIN as personal data?

The data must also be searchable by vehicle VIN. The Court's decision confirms that a vehicle identification number (VIN) can be considered personal data. In practice, a VIN is seldom available in isolation and is frequently processed alongside other data that may already enable the identification of a specific individual. As such, the VIN is rightly subject to regulation under the GDPR. However, the Court has ruled that data protection regulations do not exempt manufacturers from the legal obligation to disclose information under Article 61 of Regulation 2018/858, including allowing searches by VIN. This disclosure is required as it falls under the legal obligations of manufacturers under Article 6(1)(c) of the GDPR.

Different dispute, same consequences for the manufacturer

Another CJEU decision[3] suggests a similar trend towards increased emphasis on disclosing data to manufacturers. A prominent vehicle manufacturer restricted access to vehicle data needed for diagnostics, repairs, and maintenance. Drivers had to register, log in to the company’s server, and purchase a subscription, i.e. conditions not specified in Regulation 2018/858. As expected, the court ruled that this procedure would not provide easily accessible information as required.

Data Act and its impact on the automotive industry

The Data Act,[4] an EU regulation that was enacted in January of this year but will only take full effect in September 2025, is also worth noting in the context of this topic. The Data Act aims to harmonise rules that ensure fair data access for users and approved third parties of connected products. This Regulation defines connected products as those that generate or collect data concerning their own activities or environment and are able to communicate those data. In this respect, connected vehicles can be considered as connected products that will be affected by the new regulation.

In the automotive industry, the Data Act has significantly expanded the rights of vehicle owners, allowing them greater access to primary vehicle data, service data, and associated metadata.[5] Manufacturers, as data holders, are required to provide only the data that is easily accessible, without needing to expend disproportionate effort beyond a basic task. However, the data collected through this method cannot be used to develop a competitive product or service.

Vehicle manufacturers will need to devote greater attention to their data access and security strategies due to this new regulation. Simplifying data access, as recommended by the European Commission, can improve the range of services offered for connected products. This increased competition in after-sales services and applications may ultimately lower costs for consumers. 

The Data Act imposes new disclosure requirements on companies that sell, rent, or lease connected products. Before entering into a contract, these entities will now be required to disclose what data their connected products generate and how users can access that data.

If you would like to get a more detailed understanding of the new obligations that apply to your business in connection with the above legislation (including the CJEU decisions), our dedicated legal team with many years of experience in the automotive sector is always ready to help you.

A comprehensive legal analysis and tailored recommendations can help you avoid non-compliance risks, such as significant fines, and leverage data to drive innovation and growth.