New EU recommendations on RFID -Internet of Things

The European Commission adopted on May 12 a recommendation on the implementation of privacy and data protection principles in applications supported by radio-frequency identification. As the use of RFID tags will become the norm for retailers, they will be "in the privacy hot seat". Indeed, as the European Commission writes, "in the retail trade sector, an assessment of the privacy and data protection impacts of products containing tags which are sold to consumers should provide the necessary information to determine where there is a likely threat to privacy or the protection of personal data."

The European Union protects privacy of the individuals (article 7) and data privacy (article 8) in its Charter of Fundamental Rights.

Also of interest, the European Union has a web site dedicated to the Internet of Things (IoT). See also here, and see also the European Commission staff working paper on the Internet of Things.

RFID à Lille

Le projet ‘Lille Métropole ubiquitaire”, qui sera mis en place en janvier 2008, permettra aux consommateurs visitant une rue commerçante et un centre commercial de la ville d’expérimenter la consommation assistée par RFID. Guidés par un téléphone portable spécial, les clients peuvent aller de magasins de magasins, suivant ses indications. Le téléphone pourra également servir à régler les achats.

La CNIL doit suivre le projet. Si ces données sont conservées et croisées à des fins de marketing par data mining, , les dangers sont réels pour la protection de nos données personnelles. A suivre.

No Subcutaneous Implanting of RFID Chips in California

A California bill, SB 362, has been signed into law on October 12. The law, effective January 1st, 2008, adds a section52.7 to the California Civil Code:

52.7. (a) Except as provided in subdivision (g), a person shall not require, coerce, or compel any other individual to undergo the subcutaneous implanting of an identification device.

Parents and guardians still have the right to implant the chips into their kids or dependents:

(g) This section shall not in any way modify existing statutory or case law regarding the rights of parents or guardians, the rights of children or minors, or the rights of dependent adults.

The law will prevents employers to force their employees to accept the implantation of RFID chips, an invasion of the workers's privacy that is particularly concerning.

As professor Paul Roth wrote in this report:

"The collection of data about an individual's movements or transactions over time so as to build up an increasingly accurate profile of that worker's conduct or performance. As tags become more and more common, tags on items carried or worn by an individual can be scanned by a compatible reader for additional information about an individual, such as their tastes, habits, or even medical condition. For example, RFID has been used to track medicines, which would enable an employer to scan for prescription drugs being taken by a worker or job applicant."

RFID Bill, New York State

The Radio Frequency Identification Right To Know Act, New York State bill A00222, seems to stalled... If voted, the act would require that retailers remove or disable all RFID tags before the customer exits the store. Retailers would also have to inform the public about their use of RFID tags by posting a notice.

RFID & Loyalty Cards

I learned reading this article in the RIFD journal that carrying a RFID-tagged loyalty cards would "enabl[e] store staff to know who walks in the door so they can shout out a welcome" to me. Frankly, this does not appeal to me, not that I am not a friendly person, mind you, but because of some pesky privacy concerns. So, the data contained in the card would be personal information. Would my credit card information would also be stored? Could the data be read by any reader, so that any owner of a RFID reader would be able to read my info, including, oh dear, my dress size?

Cartes RFID à Prague

La ville de Prague propose à ses habitants des cartes RFID , qui peuvent servir à la fois de cartes de bibliothèque, de cartes de parking, ou de signature électronique dans leur rapports avec la municipalité. Elles contenaient des données personnelles: ce ne sera plus le cas, elles pouvaient être lues à distance.

Il est en effet relativement facile d’obtenir les données personnelles contenues dans une puce RFID.

The Governance of RFID Identities

Ms. Viviane Reding, member of the European Commission responsible for Information Society and Media, amde a very interesting speech on October 16th about RFID, as part of the EU RFID 2006 Conference in Brussels.

Ms. Reding said: "But, as the “Internet of Things” will also be an "Internet of People", the governance of identities will raise tremendous challenges for sovereignty, individual liberties and economic independence. It will be necessary that citizens keep control of how the information concerning them is utilised and updated and how the tags can be deactivated. "