How do I delete the data of a pass holder under GDPR?

Search for the person's pass under Passes and delete it. You are the data controller for your pass holders, so the deletion is yours to do. The Smart Scan app stores no data of its own.