System that revealed details of vehicle owners partially altered amid GDPR concerns
Stock image.
The Department of Transport has partially removed a loophole allowing car dealerships access to the name and address of any vehicle owner, while saying that any instance where someone previously accessed such information for purposes other than a transfer of ownership could only happen via an “illegal” act.
On August 25, the reported the existence of the technical loophole which saw dealerships given unrestricted access to the National Vehicle and Driver File (NVDF).
Some 24 hours later, the system appeared to have been partially altered, with the address of vehicle owners removed from the list of historical transactions on Ireland’s online site for the transfer of motor ownership.
The name of an owner now also appears to have been removed from historic transactions. However, it can still be seen at the initiation of a new transaction.
The loophole in its previous state may have represented a major data breach under the auspices of the EU’s General Data Protection Regulation (GDPR), one which chairman of Digital Rights Ireland, TJ McIntyre, described at the time as being “an absolute, utter disaster”.
“We are aware that the department has made a change to the system and addresses are no longer visible,” said assistant commissioner with the DPC, Graham Doyle.
The NVDF is a database of all registered vehicles and their particulars maintained by the Department of Transport. It contains records of 2.5m registered vehicles and 2.6m licensed drivers.
In 2016, the State introduced an online service for those transferring the ownership of vehicles, to expedite the process of updating said details on the NVDF — a legal requirement for any motor sale which hitherto solely involved the posting of amended vehicle registration certificates.
It then emerged that anyone in possession of a ‘garage code’, a password delivered to garages and dealerships for the use of the online system (known as MotorTrans), could access the details of any vehicle with a registration plate.
Key to the department’s engagement with the DPC may be statutory regulations signed into Irish law by then-Minister for Transport Paschal Donohoe in 2015 allowing for the NVDF to be accessed by certain approved bodies, such as the Motor Insurers’ Bureau of Ireland, and tolling companies like Eflow.
Car manufacturers and distributors may access the database for the “remediation of mechanical faults”; however, motor dealerships do not appear on the list of approved bodies.
It is unclear where in law the online transfer of vehicle ownership is covered.
It is believed that the department has in the past month sought to engage in contracts, which heretofore had not existed, with approved bodies in order to regulate their access to the NVDF.
