The pre-GDPR UK Data Protection Act obliged companies to hold data for no longer than necessary and not to transfer it to other parties, and is generally interpreted as requiring companies to wipe drives of computers it's disposing of. Difficult to see how a repair outlet selling on a disk drive full of its client's data as a "refurbished computer" would be exempted from that

That's a massive stretch. Has this ever made court?

I believe a court would find it was the owner's responsibility to wipe it, not Tesla's. Tesla didn't put it there.

Sounds like you theory crafting rather than an actual law.

The GDPR doesn't say its my job to make sure my data doesn't get shared with other people. I think it would be a clear case myself.