CASE STUDY 3/99
Vehicle Registration Unit - disclosure of names and addresses to a motor distributor - disclosure required by law
The complainant owned a particular make of car. He received a letter from the motor distributor advising him of a technical fault and offering to repair the fault for him. The letter indicated that the distributor was able to contact him directly through the co-operation of the Vehicle Registration Unit (VRU) of the Department of the Environment and Local Government. The complainant raised the matter with me, and expressed his concern that the VRU should pass his personal details to third parties. He had thought that only the Gardaí and certain Government Departments could access car registration data.
I raised the matter with the Department of the Environment and Local Government, and asked for their observations on the matter in the light of section 2(1)(c)(i)-(ii) of the Data Protection Act, which provides that personal data "shall be kept only for one or more specified and lawful purposes", and "shall not be used or disclosed in any manner incompatible with that purpose or those purposes".
In its response, the Department cited section 60(3) of the Finance Act, 1993, which provides as follows-
An officer of a Minister of the Government, a licensing authority or the competent authority for licensing vehicles and drivers of vehicles in another Member State of the European Communities, an officer of the Revenue Commissioners, a member of the Garda Síochána or such (if any) other persons as may be prescribed shall have access to and may inspect and examine records established under this section.
The Finance Act, 1993 (section 60) Regulations, 1996 2(S.I. Number 338 of 1996) include "motor vehicle manufacturers and distributors" among the persons prescribed for the purposes of section 60.
Section 8(e) of the Data Protection Act provides that -
Any restrictions in this Act on the disclosure of personal data do not apply if the disclosure is... required by or under any enactment or by a rule of law or order of a court ...
In my opinion, section 60, taken together with the regulations cited above, gives motor vehicle manufacturers and distributors access to vehicle registration and driver licensing records. It appears to me that a disclosure of personal data in compliance with section 60 comes within the scope of section 8(e) of the Data Protection Act, and therefore any such disclosure is not restricted by the Data Protection Act.
The Department of the Environment and Local Government pointed out to me that it is always conscious of maintaining the confidentiality of individual vehicle owners as recorded on the National Vehicle and Driver File (NVDF). Apart from specified Government Departments and Offices who require access to the vehicle records to carry out their functions, the Department assured me that the disclosure of details from the NVDF to any other third parties was strictly precluded. The Department indicated that a single exception to this principle is applied where the Department is satisfied that, in the interests of the safety of vehicle owners and other road users, data from the computer file should be provided to assist motor companies with recall campaigns where defects had been detected in particular models. I welcome this statement of policy which seems to me to strike a reasonable balance between protecting the privacy interests of data subjects whose data is kept on the NVDF, and the public interest in ensuring that defective vehicles are recalled as swiftly as possible. It was such a consideration that led the VRU to disclose details to the motor distributor in this case.
However, I have a residual concern that the inclusion of "motor vehicle manufacturers and distributors" in the regulations, coupled with the unqualified words "shall have access to" in section 60 referenced above, may have more far reaching consequences than are at first apparent and I suggest that this be reviewed when a suitable opportunity arises.