Good question, but theoretically the user is in possession of that data (while the car is with them). Allow for the user to be able to extract the data might be mandated by it though.
I expect that a company buying a car and onselling it to a new customer has a duty of care to not expose the data of the original seller to the new buyer. So that’s the dealer’s responsibility. It sounds like Tesla itself also has some work to do given other comments in this thread indicating they could see the previous owners info on the My Tesla website.
