Obligations relating to the protection of personal data
Article 3
1. The bodies or establishments responsible for roadworthiness testing, when collecting the VINs together with the real-world data directly from the vehicles shall, in relation to the collection and processing of the VINs, be considered as controllers of these data within the meaning of Article 4(7) of Regulation (EU) 2016/679, and shall provide information to vehicle owners in accordance with Article 13 of that Regulation. 2. Where the VINs together with the real-world data are obtained indirectly from vehicle owners, Member States, as controllers, shall provide information in accordance with Article 14 of Regulation (EU) 2016/679. 3. The EEA shall be regarded as a controller under Regulation (EU) 2018/1725 for the processing of VINs under this Regulation. 4. The data collected in accordance with Article 2 may only be retained for the following periods: (a) by the bodies and establishments responsible for roadworthiness tests, until six months after transmission of the data to the EEA or to the authorities designated by the Member States in accordance with Article 2(4); (b) by the authorities designated by the Member States pursuant to Article 2(4), until six months after transmission of the data to the EEA; (c) by the EEA, until 20 years from the date on which the data was first reported in accordance with Article 2(4).