The answer to that question is: yes, a car registration plate is personal data if the car is owned by an individual or sole trader. The registration plates of commercial vehicles are not personal data of an individual as the vehicle is owned by an organisation.
The reasoning is as follows:
The GDPR and the Data Protection Act define personal data as: “any information relating to an identified or identifiable living individual”.
An identifiable living individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.
The Information Commissioner has considered that vehicle registration marks (VRMs) are personal data (especially when combined with other information such as geographical, manufacturer, model and colour information) and relate to the relevant vehicle keeper’s private life. A VRM is a unique mark linked to a specific vehicle.
Can my registration number be shared with others?
Yes, but it depends upon the circumstances and all sharing must have a legal basis.
For example, one of our clients had a staff member whose car was hit by another car in their parking lot. The client had the incident recorded on CCTV and wanted to know if they could give the registration number of the offending car to the staff member.
We advised the client that they could give the plate number to the staff member under the legal basis of the legitimate interests of a third party.
The reasoning is that the incident may be an offence under the Road Traffic Act and, as such, is reportable to the police. The staff member has a legitimate interest in obtaining the registration number of the offending car in order to contact the police. The school can rely on this legitimate interest to provide the plate number. In addition, the car registration number is a rather innocuous form of data and we took that into account in our assessment.