VIDEO: Implementing Regulation (EU) 2021/392 – Data protection and the CO2 data transfer.

The European Union is striving to reduce traffic-related CO2 emissions. Consequently, it has set limits for the permissible CO2 emissions of vehicles. These limits always relate to the entire fleet of vehicles sold by a manufacturer within the European Union.

The legal regulations on these fleet emission values are spread across a whole series of different EU regulations.

Regulation EU 2021/392 now deals with the collection and evaluation of actual consumption and emission values from real-world operation by a manufacturer’s fleet.

The regulation is primarily aimed at manufacturers who wish to place passenger vehicles and light commercial vehicles on the market within the European Union. However, the regulation may also impose obligations on the authorized dealers or workshops of these manufacturers.

According to the regulation, manufacturers are obliged to transmit the actual fuel and energy consumption together with the vehicle identification number (VIN) to the member states. This can either be done directly and live from the vehicles via technical equipment, or the data must be read out and transmitted during each visit to an authorized workshop. If the latter procedure is chosen, the manufacturer must ensure that the data is transmitted by its authorized workshops or dealers. This obligation applies to all vehicles registered from January 1, 2021.

The consumption data should then be accredited and used to monitor actual emission levels and to inform the public.

Of course, the first question that arises is what European regulations on CO2 emissions have to do with data protection? A look at the IMPLEMENTING REGULATION (EU) 2021/392 reveals quite a lot. The connection point is that consumption values must be collected and transmitted together with the VIN. With the moment of registration, the VIN is linked to the owner of the respective vehicle and thus the transmitted data is personal information. This is once again explicitly clarified in the recitals.

The regulation also refers to the rights of the holder; after all, his data is fundamentally affected by the processing. A consent requirement, e.g. in the sense of a data protection consent in the sense of Art. 6 (1) lit. a DSGVO, is not provided for and not required. Instead, the data may not be transmitted if the holder expressly refuses this. In this regard, the Regulation clarifies that the right of refusal is not a right to object under Art. 21 DSGVO.

The entities obligated under the Regulation, in particular the authorized workshops, must therefore ensure that the keeper is informed about his right of refusal and can actually exercise it.

Art. 11 of the Regulation sets out a whole series of obligations for the protection of personal data. These are the well-known classics of data protection law. Thus, among other things, specifications are made for the information of the persons concerned according to Art. 13 and Art. 14 DSGVO on the purpose-related use of data and on storage periods.

Your team at aigner business solutions GmbH will continue to monitor this topic and keep you informed of relevant news. If you have any questions, please feel free to contact us.