ECJ decision: vehicle manufacturers may not restrict access to the vehicle data stream

In a test case brought by Carglass and A.T.U – both clients of the international legal practice Osborne Clarke – against vehicle manufacturer FCA Italy (Stellantis), the Court of Justice of the European Union (CJEU), following a referral by the Cologne Regional Court, has rendered a landmark decision in favour of competition in the automotive sector (Case C-296/22).

Vehicle manufacturers are obliged under Regulation (EU) 2018/858 to provide all workshops with access to the vehicle data stream via the on-board diagnostics (OBD) port of the vehicles. This access is essential for repair and maintenance. At the same time, vehicle manufacturers are obliged to ensure vehicle safety and security. The issue to be decided was whether a vehicle manufacturer may arbitrarily control access to the OBD port by making access dependent on a personal registration of the mechanic and an internet connection of the diagnostic device to a server designated by the manufacturer.

The CJEU followed the claimants A.T.U and Carglass and made the fundamental clarification that the fulfilment of statutory access rights may not be made subject to conditions not expressly permitted by the legislator (in this case in Regulation (EU) 2018/858).

The CJEU emphasised: “Moreover, were manufacturers able to limit at their discretion access to the direct vehicle data stream within the meaning of Point 2.9 of Annex X to the regulation, it would be open to them to make access to that stream subject to conditions capable of making access impossible in practice.”

According to the CJEU's decision, the vehicle manufacturer must ensure vehicle security through the technical construction of its vehicles (“security by design”). New cyber-security requirements (in particular according to UN Regulation No. 155) must be implemented in such a way that access claims of third parties are not affected.

“The impact of the judgment goes far beyond this specific case. The ECJ answers a fundamental question and makes it clear that regulated access claims must be fulfilled exactly according to the legal requirements,” Marcus Sacré, lawyer and Partner at Osborne Clarke, classifies the decision. “It is to be expected that all vehicle manufacturers will now immediately implement the requirements defined by the CJEU.”

The claimants were represented before the CJEU by Marcus Sacré, Elisabeth Macher and Paul Schmitz, all of Osborne Clarke.

FCA Italy SpA was advised by Dr Marc Ruttloff and Dr Christian Steinle (both Gleiss Lutz).