The digital product passport for furniture is essentially designed to record something about the product: materials, origin, maintenance advice, disassembly instructions. Personal data have no place there in principle. Yet in practice, the question regularly arises whether somewhere among those product data also data of a person end up, and whether that then falls under the GDPR.
The short answer is that the passport itself is set up at product level, but that the data collected and retained around it — think of contact details of a supplier, a contact person at an importer, or maintenance records — can indeed contain personal data. At that point, the digital product passport for furniture regulation and the GDPR run parallel to each other, and both apply.
What is and is not in the passport
The data that the regulation requires for the passport concern the product: which materials have been used, how the component can be disassembled, which substances it contains, who is responsible for placing it on the market. That last point is precisely where the point of contact arises: the name and details of the supplier are part of the passport, and if that supplier is a sole trader or if a name of a contact person is included, that is personal data.
With larger companies that have a trade register number and a general business address, this usually matters less. With smaller businesses, where the owner is also the point of contact, it is closer to the person. Anyone who is unsure whether specific data in the passport count as personal data is best to submit this to a lawyer or to the Authority for Personal Data, because that is an assessment that differs per situation.
Where personal data more often play a role than in the passport itself
Most points of contact with the GDPR are not in the passport that the end user sees via the QR code, but in the administration surrounding it. Think of a maintenance log in which a technician is mentioned by name, a service appointment linked to a customer name, or internal documentation recording who has provided which data for the passport. That documentation is often necessary to be able to demonstrate that data are correct and where they come from, and that is precisely where personal data slip in without anyone having intended it as such.
It is therefore advisable to determine in advance when setting up your own process which data you need for the passport and which data you store separately, and for a different purpose. Anyone who keeps that distinction clear prevents product information and personal data from becoming mixed up in the same system. In the knowledge base with all topics is set out per situation which data are needed for the passport itself.
How the GDPR and the digital product passport for furniture regulation relate to each other
The GDPR and the digital product passport for furniture regulation exist independently of each other and do not address the same things. The digital product passport for furniture regulation prescribes which product information must be available and for how long. The GDPR regulates, regardless of which sector it concerns, what may happen with data that can be attributed to a person: on what basis they are processed, how long they may be retained, and who has access to them. Both regulations apply at the same time, and one does not relieve a company of the other.
This means that a company that correctly compiles the passport does not automatically comply with the GDPR, and vice versa. These are two separate assessment frameworks that can happen to land on the same file. If there is any doubt about the company's own processing of data, the Authority for Personal Data is the competent authority, not the supervisor of the product passport.
What this means for your own administration
For a company that has the passport compiled, it is especially practical to determine in advance which data goes into the passport and which data remains internal. Data on materials, components and origin can be shared without difficulty; data that identifies an individual employee or customer generally does not belong there. Those who make agreements about this with a software supplier or with furnipas.eu can record that distinction in the process by which data is supplied and hosted.
On how we handle data is described how data for the passport is processed and stored. Those who wish to check how this applies to their own situation will find it in the frequently asked questions about the passport a number of common cases of doubt.
Would you like to first get an impression of what the furniture passport entails for your company, without immediately creating an account? Take the free quick-scan via a few questions that map out your situation, or browse through the topics in the knowledge base for more background.