Technical loophole that allows access to details of vehicle owners 'an utter disaster'

The loophole may constitute a data breach.

A technical loophole within an online system for transferring motor vehicle ownership, allowing the name and address of any vehicle owner to be accessed by motor dealerships, has been described as “an utter disaster”.

The loophole, which may represent a major data breach under the auspices of the EU’s General Data Protection Regulation, involves unrestricted access to the National Vehicle and Driver File (NVDF).

First raised by law student Roman Shortall, the loophole sees motor dealerships capable of gaining access to the name and address of owners of any vehicle on the street.

The NVDF is a database of all registered vehicles and their particulars maintained by the Department of Transport. It contains records of 2.5m registered vehicles and 2.6m licensed drivers.

Under statutory regulations signed into Irish law by then-minister for transport Paschal Donohoe in 2015, that database can be accessed by certain approved bodies, such as the Health and Safety Authority, the Motor Insurers’ Bureau of Ireland, and tolling companies like Eflow, but only having first requested that information from the Department of Transport.

Motor manufacturers and dealerships have a right to request access to the database, ostensibly to identify “registered owners of mechanically propelled vehicles to facilitate actions for the remediation of mechanical faults which potentially endanger the health and safety of drivers, passengers or other persons”.

However, the State introduced an online service for those transferring the ownership of vehicles to expedite the process of updating said details on the NVDF, a legal requirement for any motor sale, which hitherto involved the posting of amended vehicle registration certificates.

It has now emerged that anyone in possession of a ‘garage code’, a password delivered to garages and dealerships for the use of the online system (known as MotorTrans), can access the details of any vehicle with a registration plate.

Contacted for comment, the Department of Transport initially said the address of the owner is not displayed on MotorTrans. A spokesman then said the address is only displayed once a transaction has been completed.

It was pointed out to the department this is not the case and a vehicle registration certificate is not required, whereupon a subsequent request for further comment was not answered at time of going to press.

Data consultant and chair of Digital Rights Ireland, TJ McIntyre, described the loophole as “an absolute, utter disaster”.

“It fractures almost every principle of the GDPR. If this access is taking place then it is a burning clown car of ineptitude.”

A spokesperson for the Data Protection Commission said the DPC “has not been made aware” of any data processing issue regarding the NVDF. They said that contact had been made with the department regarding the issue. “We are awaiting a response,” they said.