Privacy concerns push efforts to regulate RFID
Privacy advocates are calling for federal government regulation of RFID to prevent retailers and other users of the item-tracking technology to intrude on consumers’ personal behavior. At a recent hearing conducted by the California State Senate, Beth Givens, founder and director of the Privacy Rights Clearinghouse, called for a set of seven principles that users of RFID technology would have to follow or face government-imposed sanctions. Among the principles is a prohibition of retail policies designed to coerce consumers to keep RFID tags on purchased products. “For example, merchants cannot tell customers that in order to return an item, the RFID tag must not be removed,” Givens said.
But Kevin Ashton, executive director of the Auto-ID Center, the RFID industry’s research and development organization, said the industry is working on ways to protect consumer privacy, such as by letting consumers deactivate RFID tags on purchased products.
California State Sen. Debra Bowen, who presided over the hearing, contends that RFID technology has reached a turning point that demands a public airing of its advantages and potential problems. “While the technology’s been around for three decades, new advances have brought both the size and the cost of manufacturing RFID chips down, making them versatile and inexpensive,” she says.
The retail industry, led by Wal-Mart Stores Inc. and consumer product goods manufacturer Procter & Gamble, is beginning to use RFID to track the movement of pallets and containers as they’re shipped through supply chains. An RFID tag, consisting of a computer chip and a radio frequency antenna, placed on a pallet or container contains product and shipment information that is automatically read by RFID readers as they pass points of distribution, such as the entrance to a warehouse. Eventually, RFID data will be accessible over an Internet-based Electronic Product Code Network, enabling retailers and suppliers to track the flow of goods.
While many in the retail industry see RFID technology as a way to streamline supply chain systems, providing greater visibility into the movement of products, Givens and other privacy advocates express concern that, when RFID tags are used to track individual products that consumers carry home, they will have to potential to grossly infringe on consumers’ privacy.
A report written for the hearing by the Auto-ID Center’s Ashton said the use of RFID to track the movement of individual products is not likely to occur on a broad scale until 2007 or 2008. Once RFID tags are placed on individual products, retailers will be able to track their movement off store shelves in real time, supporting faster replenishment and providing visibility into the effectiveness of merchandising programs. But Givens and other privacy advocates say government should act now to prevent product-mounted RFID tags from providing a window into consumers’ private affairs. She adds that a major concern is the possibility that consumers’ personal information will be tied to RFID-tagged products at the point of sale.
Although it’s unclear exactly how RFID tags embedded in products would actually infringe on personal privacy once consumers leave a store, Ashton’s report noted that the Auto-ID Center is working on ways to protect consumer privacy. These methods would let consumers know when products contain RFID tags, assure them that their personal data is kept separate from RFID product data, and allow consumers to deactivate an RFID tag at no cost after purchasing a product. “As the technology continues to mature and the market continues to grow, I expect that more and more sophisticated privacy and security features will be added,” he said in his report.
The Privacy Rights Clearinghouse is recommending:
• Individuals have a right to know that products contain RFID tags. Labeling must be clearly displayed and easily understood;
• Individuals also must know when, where, and why RFID tags are being read. There should be no tag-reading in secret;
• Individuals have the right to have RFID tags removed or permanently deactivated when they purchase products or otherwise obtain items containing RFID tags. Merchants must be prohibited from coercing customers into keeping the tags "live" on the product. For example, merchants cannot tell customers that in order to return the item, the RFID tag must not be disabled. The default option–-whether to disable a tag or keep it live-–must be to disable it. In situations where the individual’s preference is not known, the system must always disable the tag. Tags, once disabled, cannot be reactivated without the explicit consent of the individual associated with the tagged item. There can be no back-door means to reactivate tags once they have been permanently disabled.
• Individuals have the right to own and use inexpensive readers so they can both detect tags and permanently disable them.
• The individual has the right to access an RFID’s stored data pertaining to the individual.
• Require security and integrity in transmission, databases, and system access.
• An accountability mechanism. Industry processes and operations must be transparent. And individuals must know who they can contact in order to access data pertaining to them.
Back...
