The most common mistake in the overlap between the furniture passport and the GDPR is that companies assume a passport about a product never contains personal data, and therefore pay no attention to privacy. In practice, employees fill in fields with the name and telephone number of a contact person for warranty, a project manager or an installer. Once the passport is publicly accessible via the QR code, this is a processing of personal data that must comply with the GDPR, separate from the furniture regulation itself.
This mistake does not arise from carelessness but from a logical assumption: the passport is about the furniture, not about people. As a result, when data is submitted, there is rarely consideration of whether a field contains a person's name, a direct telephone number or a personal email address. With a digital passport that is publicly and globally accessible for ten years, that question weighs more heavily than with an ordinary quotation or invoice.
Why this happens more easily than you think
When compiling a passport, often not one person supplies all the data. A sales employee fills in technical specifications, a project manager adds maintenance instructions, and someone from customer service conveniently adds his own name and 06-number for "questions". None of them check this against the other entries, and there is often no fixed moment when someone assesses the whole before the passport goes live. This creates a document that is actually about a cabinet or desk, but nevertheless contains personal data visible to anyone with a smartphone.
What the GDPR additionally already determined
The GDPR existed long before the furniture regulation and does not change with the advent of the digital product passport. Anyone processing personal data must, among other things, be able to identify a purpose and a legal basis, and must not disseminate data further than necessary. Putting a name and mobile number in a publicly accessible passport is a form of processing where these questions apply: is this necessary for the purpose of the passport, and is the employee concerned aware that his data will remain publicly available for ten years? Supervisory authorities for the GDPR, in the Netherlands the Autoriteit Persoonsgegevens, assess such situations on the basis of the applicable rules, regardless of how the furniture regulation itself is enforced.
How you prevent this in practice
The simplest measure is a fixed rule: the passport contains only functional contact details, such as a general service address or a company number, never the name or direct number of a single employee. This not only prevents a GDPR issue, it also keeps the passport up to date when an employee changes position or leaves the company. A second measure is a control moment shortly before a passport is published, in which someone explicitly checks whether there are personal names, private telephone numbers or other identifiable data in it. With multiple submitting employees, that control moment is often the only moment when someone has an overview of the whole.
It is also worthwhile to conduct this discussion not only internally, but also with the party hosting the passport. Who has access to the entered data, how long it is retained and whether a data processing agreement is required are questions that belong in the overview of topics per situation. At furnipas.eu it is explained how data is stored and secured; you can read that on the page about privacy and data security.
What to do if it has already happened
If it turns out that a passport has contained personal data for a long time that should not have been there, the first step is to adjust or delete the field. Whether there are also notification obligations or other steps involved depends on the specific situation and is something to discuss with a lawyer or with the Authority for Personal Data; this is not a question that can be answered in general terms. However, it is advisable that when you discover such an issue, you immediately check whether the same problem occurs in other, not yet published passports, so that the error is not repeated.
Whether your company runs this risk depends on who supplies which data and how that process is set up. With the free quick-scan that gives a first indication in a few questions you can quickly see where points of attention lie, and in the collection of frequently asked questions you will find more background on how the furniture passport relates to existing rules such as the GDPR.