What can the public read in a product passport, and what stays restricted?
It depends on the act covering the product group, which names the actors and the data each may read. The regulation lists who must have free access based on those rights, from customers and repairers to recyclers and market surveillance authorities, and keeps personal data out without consent.
Access rights come from the act
Article 9 of regulation (EU) 2024/1781 provides that the delegated act specifies the actors that are to have access to data in the passport and to what data, and separately the actors that may create or update data and what they may introduce. Reading and writing are two lists, not one.
Article 11 then requires the rights to introduce, modify or update data to be restricted according to those specified rights, and requires data authentication, reliability and integrity to be ensured. A passport anyone could edit would be a wiki, and the text is explicit that it is not one.
The actors the text lists
Article 11 names who must have free of charge and easy access, based on their respective rights: customers, manufacturers, importers, distributors, dealers, professional repairers, independent operators, refurbishers, remanufacturers, recyclers, market surveillance authorities and customs authorities, civil society organisations, trade unions and other relevant actors.
That list is the reason a passport is not a marketing page. A repairer and a recycler are named readers, and the data that serves them, composition and disassembly among it, sits in the same structure as what a customer sees.
Personal data is fenced off
Article 10 provides that personal data relating to customers is not stored in the passport without their explicit consent under Article 6 of the general data protection regulation. A passport that accumulated owner details by default would contradict its own rules.
So a product passport is not a customer record, and the uses that involve people, registering a warranty, transferring a product to a second owner, live beside it rather than inside it. The data protection page covers the general question, and the consequence here is structural: keep the two stores apart.
Batteries show the pattern
The batteries regulation writes the same idea with its lists filled in. Annex XIII of regulation (EU) 2023/1542 separates information accessible to the general public, information accessible only to notified bodies, market surveillance authorities and the Commission, and information accessible to anyone with a legitimate interest, for purposes the text names: dismantling, including the safety measures to take, and the detailed composition of the battery model.
Which is the useful way to read the ecodesign text: the act for your group will do what Annex XIII does, and the design question is not whether to have tiers but which data belongs in each.
Frequently asked questions
Who decides what the public sees?
The delegated act covering the product group. It names the actors and the data each of them may access.
Can anyone edit a passport?
No. The rights to introduce, modify or update data are restricted to the actors the act names, and integrity has to be ensured.
Does the passport hold customer data?
Not without explicit consent under the general data protection regulation. It is a product record rather than a customer record.
What does the battery text make public?
Annex XIII separates public model information, information for notified bodies and authorities, and information for anyone with a legitimate interest, such as dismantling and composition.