Hi Koen,
I'm quite sure the GPS tracker was used to automate "Kilometerregistratie", and somewhere someone neglected to remove the device when the car went out of the fleet. The fact that theres a reader there, suggests that this car had varying drivers, you get into the car, hold your rfid tag against the metal and you now are the "driver" of the car for the next trip.
This helps companies not get audited for their KM's by the belastingsdienst, saving them hassle and worry. (The company that manages the data gets audited).
Next to companies having to register all the KM's their cars make, the Dutch goverment now also implemented a "CO2 registratieplicht" when theres 100+ employees, a GPS device like this might also automate this. So you can expect to find these in second hand cars that used to belong to bigger companies all the time, or heck, even local goverments use this stuff in their fleets.
As to your questions, if the sim card is still in use, yeah free data. The device should also have an IMEI (15 digits) number, this number should help you to figure out which party has the data that is gathered for a GDPR request. (Yes the GDPR request should work).