Battery Passport and Privacy

Privacy in the battery passport is handled by the access tier structure, by the kind of data that Annex XIII requires, and by the separation between battery data and holder data, rather than by treating the passport as a public file about a person. The passport describes a battery, its model and its individual history, and it does not need to contain personal data about a holder to serve its purpose, because the history can be recorded by identifier, date and status, without naming a private individual. A reader who expects the passport to name every holder, or who treats the passport as a record about a person, misunderstands the design, and a record that contains unnecessary personal data creates a privacy risk that the tier structure is designed to avoid. The privacy reading therefore starts from what the record needs, and treats anything beyond that need as a question.

The scope is privacy in the Annex XIII record structure, as checked on 28 October 2026. The guide does not state data protection law, and it does not advise on any particular processing of personal data.

What personal data does a passport need?

A passport needs the manufacturer and operator information that Annex XIII requires at model level, and the identifier linked individual information that describes the battery, without needing personal data about a private holder, a driver or a user. Operator information, such as a company name and address, is business information, distinct from personal data about an individual, although a sole trader operator may blur that line, and the record should state the operator information that the Regulation requires, in the tier that the Regulation assigns to it. Holder identity for a transfer can be recorded by role, by company or by a reference that the holder file can resolve, without publishing a private name in the public tier. Data minimisation, in this context, means recording the identifier, the date and the status, and no more personal detail than the purpose requires.

How do access tiers protect privacy?

Access tiers protect privacy by limiting who sees detailed information, with public fields open to general access, legitimate interest fields open to persons who need them for repair, repurposing or recycling, and authority fields open to authorities. A private holder who appears in a transfer document does not appear in the public passport fields merely because a transfer happened, because the transfer is documented by invoice or contract, held by the parties, while the passport shows the dated status and use information without the private detail. The tier structure therefore separates the commercial file, which names the parties, from the passport, which describes the battery, and a reader who conflates the two files will expect personal detail in a place where the Regulation does not put it.

What about location and use data?

Location and use data raise a privacy question where later use information could reveal where a battery was used, how it was used or by whom, and the passport should record use information at the level that Annex XIII requires, namely performance, durability, state of health and status, without recording continuous location or continuous use logs. A record that contains a charge by charge log, a location history or a driving history would contain more than the passport needs, and would create a privacy and security risk that the tier structure alone cannot cure. The record design should therefore state the level of use information to be recorded, keep that level consistent, and avoid collecting use detail beyond the Regulation requirement. The level should be recorded in the data plan, so that a later reader can see the boundary that was applied.

What does a privacy table look like?

A privacy table maps the data, the tier and the purpose, so that unnecessary data is visible. The table below uses general data kinds.

How should a holder handle a privacy concern about a record?

A holder with a privacy concern about a record should identify the field, the tier, the personal data in question and the purpose that the field serves, and should raise the concern with the record holder, with the field and tier named, rather than withholding the record or deleting the field. Deleting a field that the Regulation requires creates a record gap, while publishing personal data that the Regulation does not require creates a privacy risk, and the correct route is to check the tier and the data minimisation boundary, and to correct the record through the correction method where the field is wrong. The concern, the check and the outcome should be recorded, so that a later reader can see that privacy was considered, not ignored.

What about trade and personal data together?

Trade and personal data together raise a combined question, because a field can be both commercially sensitive and personal, such as a sole trader operator name, and the record should apply both protections, tiering the field as Annex XIII requires and minimising the detail to the Regulation requirement. The trade secrets guide in this cluster describes the commercial protection, and this guide describes the privacy protection, and a reader should apply both, rather than treating one protection as covering the other. A field that is protected as a trade secret may still contain personal data, and a field that contains no personal data may still be commercially sensitive, so the two checks should be done separately, field by field, and recorded separately.

What limits apply to privacy readings?

The limits are that this guide describes the tier structure and data minimisation in general terms, and does not state data protection law. This guide gives general educational information only and is not individual legal advice. A holder with a specific privacy question should check the Regulation text and the applicable data protection law as checked on 28 October 2026 before acting.