A passport must outlive its vendor

I'm Daniel Carlman, and this is DPP Academy. Today: why a passport must outlive the company, and the system, that created it.

Each delegated act sets how long a passport must stay available. That period must be at least the expected lifetime of the product.

And it must stay available for that whole period, even if the company responsible for it becomes insolvent, is liquidated, or stops its activity in the EU.

That is why ESPR requires a back-up copy. When placing the product on the market, the economic operator makes a back-up copy available through a digital product passport service provider: an independent third party, authorised by the operator.

Service providers may not sell, reuse or process the data beyond what the service needs, unless agreed with the operator. And the Commission can set requirements for becoming one.

The standard EN 18221 adds the detail. The back-up provider stores the latest version and the required history, under the same access rules. And once the operator is no longer active on the market, general access comes from the back-up.

History matters too. Archiving starts with the first change, every change is archived, and authorised users can retrieve the version for a given point in time.

And changes are replicated to the back-up often enough to keep data loss to a minimum, using the standard API or another agreed secure method.

That's the end of season one. I'm Daniel. Thanks for watching.

Next season: by category, batteries first. This is not legal advice.