Stoddart pegs RFID as potential hazard to personal information privacy

In her annual report to Parliament, Canada’s Privacy Commissioner Jennifer Stoddart takes aim at RFID tags as representing a possible mechanism for collecting personal information without consumer’s knowledge. Below is an excerpt from the section on RFID. The full report from the Office of the Privacy Commissioner can be found at http://www.privcom.gc.ca/information/ar/200506/2005_pipeda_e.asp. This year, the Audit and Review Branch conducted a study of a technology that is causing considerable concern from a privacy perspective – radio frequency identification devices, or RFIDs. RFIDs form a subset of a group of technologies, often referred to as automatic identification that are used to help machines identify objects. An RFID tag can be placed in just about anything that is sold to, or used by, people. This includes bank cards, credit cards, money, passports, luggage, badges and wrist bands, clothing, vehicles and vehicle parts, appliances, phones, drugs, and food packaging. RFIDs can be implanted in livestock, and at least one company is advertising them for implanting in humans. Perhaps of greatest significance, RFIDs are capable of uniquely identifying a product. The small size of the tags and their ability to uniquely identify an object may pose various threats to individual privacy, including the following:Surreptitious collection of information: RFID tags are small and can be embedded into/onto objects and documents without the knowledge of the individual who obtains those items. Tags can be read from a distance by readers that can be incorporated invisibly into nearly any environment. Without clear notification, it may not be readily apparent that RFID technology is in use, making it virtually impossible for a person to know when or if he or she is being scanned. Tracking an individual’s movements: If RFID tags are embedded in clothing or vehicles, for example, and if there is a sufficiently dense network of readers in place, it becomes possible to track those tags in time and space. Applications to do just this, using a combination of RFID and GPS technology, are being proposed by RFID vendors. If the tags can then be associated with an individual, then by that association the individual’s movements can be tracked. Profiling of individuals: When using bar codes, one bottle of water has the same barcode as all other bottles of water of that particular brand. RFID technology potentially enables every object on earth to have its own unique ID (i.e., each bottle of water would have a unique identifier). There is, perhaps, the risk that the use of unique ID numbers could lead to the creation of a global item registration system in which physical objects are identified and linked to its purchaser or owner at the point of sale or transfer. Secondary use (particularly in the sense of limiting or controlling such use): The revelation of personal information such as medical prescription or personal health histories could have an impact on insurance or employment. RFIDs in CanadaEarly in 2005 we wrote to 14 corporations in Canada asking them to help us understand the emerging use of RFIDs in Canada: 12 responded to the survey we sent them. The survey was not intended as a statistically representative sample of Canadian businesses as a whole. Instead, the focus was on larger corporations whose business activities were most likely to use RFID technology. The organizations included those in manufacturing, retailing, transportation, and distribution, as well as those directly involved in manufacturing RFIDs. A standard survey letter was sent to each organization asking for information about current or planned RFID use. We learned that one central player in the RFID industry sets standards to enable and support RFID use. It also requires subscribers to respect certain privacy principles. For example, consumers must be notified of the presence of an RFID tag in an item and be given the choice to end the tag’s function ("kill" the tag) after purchasing the item. As well, the tags are not to contain personal information. We are encouraged by this attention to privacy, and we call for similarly responsible practices by all those in Canada who may use RFIDs. The only key government application for RFID of which we are now aware is its planned use in Canadian passports. We are monitoring this. As well, a group in Industry Canada is supporting and facilitating the development of commercial RFID technology. Need for RFID Awareness and GuidanceEven at this early stage, RFID has expanded beyond simply tracking materials. RFIDs are already being linked to personal information, and are sometimes used to track people. Comprehensive privacy risk management for RFIDs does not yet seem to be firmly in place. Perhaps this is because RFIDs use is only beginning, with companies merely considering their business case for RFIDs, while RFID manufacturers are still focused on technical matters such as common standards to ensure security, compatibility and interoperability. Greater public and political awareness of the potentially intrusive nature of RFID technology is essential now. The OPC will develop guidelines to help ensure that, even as RFIDs become more common, they do not erode informational privacy rights.

Stoddart pegs RFID as potential hazard to personal information privacy

News | June 15, 2006

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us