UFI decoder available

You may have seen that there is a UFI decoder available from a Polish consultancy, at https://www.decoder-ufi.com/.

Decoding the UFI will allow anyone to see the company VAT number which has been used, and also the product code.

This is incredibly worrying, because the EU taxation website allows anyone who holds a VAT number to look up the VAT number of any other company, and it doesn’t just say the VAT number is valid, it actually gives you the company name and address as well!  (Many thanks to the Forum Operator at CHCS for pointing this out).

I just checked whether this would work by checking my accountant’s VAT number, and the system brought up his company details. 

So with the combination of the UFI decoder and the EU VAT number validation tool, the UFI can be traced back to an individual company in a few minutes.

This is a very serious issue, because companies who want to sell the same mixture under different names may be using the same UFI, and this would give the game away to customers; or companies who may be using toll manufacturers or reselling products, may want to keep the company making the mixture private.​

Another scenario is where the “mixture in mixture” option is being used, where a mixture used in another mixture is identified by the UFI.  A competitor with a copy of the Safety Data Sheet could decode that UFI and find out which company was providing the mixture to you.

All of this may sound relatively trivial to an outsider, but within the chemical industry, this information is considered to be Confidential Business Information.

So what are your options for keeping this information as private as possible?

If you want to keep your product code private, you should invent a separate “product code” for UFI purposes, although you may need to track this carefully.​  In fact, some people are doing this as a matter of course, and it’s probably something you should consider.

If your mixture is not used as a mixture in a mixture, but you are selling it under different trade names into different marketplaces, then you could give the mixture different product codes for each market, and that would generate different UFIs, which are generated from both the product code and the VAT numbers.

In this scenario, you’re already selling the same product under different labels and with different Safety Data Sheets, so it doesn’t add significantly to the complexity of your product information.  All you have to do is add the relevant UFI to the label or package, and to the Safety Data Sheet, making sure it’s the correct UFI for that particular product.

Finally, if your mixture is used as a “mixture in a mixture” by one or more downstream users, you could consider making the Poison Centre notification using your downstream user’s VAT number, which would look to an outsider as if they were using an in-house mixture.

However, you would obviously need their agreement to be able to do this, or they might have to make the notification instead.  But you don’t want to give your downstream user your mixture formulation!  One way round this might be to use a third party consultant to make the notification on your end user’s behalf, using your confidential information, and their VAT number and other contact details.  Then you would place their UFI on your product label and Safety Data Sheet.

If you sell the mixture to other companies, this will inevitably mean you end up with multiple Safety Data Sheets for the different versions of the mixture.  The package will also require different UFIs, and this can be done by a second label with the UFI on it, allowing you to keep a single label; or if you want to put the UFI on the label, you will need to have different labels for the different versions of the mixture.

It really is a complicated situation, which has been brought about by the “open” culture within the EU. ECHA even publish the algorithms to generate the UFI, which is what the Polish consultancy have used to make their UFI decoder!  They really don’t appreciate the important of commercial confidentiality within the chemical industry.

The final thing to think about is what happens at Brexit?  Well, that will depend on when, or if, Brexit occurs.

If Brexit Day on the 31st October, or before the 31st December 2019, and we leave with No Deal (strictly speaking, on World Trade Organisation terms), then the provisions of Annex VIII of CLP will not be brought into UK law, so we will not be using the Poison Centre Notification Portal and the UFI in the UK.

If Brexit Day is after this date, and it’s No Deal, in theory we would need to use the UFI, but whether it would be the EU UFI or a UK version, I really don’t know if anyone’s thinking that far ahead.

And if the UK stays inside the EU, or there is some kind of Deal, then Annex VIII may end up being applicable in the UK after all.

I will do my best to keep you up to date with this.

GHS Classification Courses from TT Environmental Ltd

9th September 2019

Update 17th October 2019 – it does seem possible that you can use a non-VAT number for UFI generation, as long as you tick a box saying you don’t have one, or choose not to use one.  The number will need to be in VAT number format, and of course you should check that it isn’t someone’s actual VAT number. This goes against advice previously given to a colleague, which the above article was based on.  Many thanks to Marc Willemse and Janice (Jan) Robinson for helping untangle this situation via LinkedIn!

Like this article? You’ll love our free guide to CLP  (and you’ll also get our articles delivered direct to your inbox every week!)