Ottawa U professor raising concerns about privacy and RFID use

TORONTO - Radio frequency identification (RFID) is a maturing technology with a number of emerging opportunities such as enabling mobile payments and reducing counterfeit medications. But its widespread use worries some because of privacy concerns. "Anytime you can use the chip to individuate or identify, it raises the concerns of the prospect of monitoring," said Ian Kerr, who holds the Canada Research Chair in Ethics, Law, and Technology at the University of Ottawa's Faculty of Law. "The purpose of its current use is tracking through a supply chain, which raises the question of privacy. If a chip is in a product, the question is whether the chip should be de-activated at the point of sale."Kerr predicted as RFID is increasingly used, de-activation of the chip would be viewed as a choice that a consumer will make. "The de-activation probably will not happen," he said in an interview with Report on Wireless. " gain the benefits of the information. There will be incentives in the marketplace to leave the chip in. The idea is that information can be gathered by the correlation of various data points with these chips that is more valuable to a company than the product in which the chip was placed."At both a provincial level in Ontario and the federal level in Ottawa, privacy commissioners have issued voluntary guidelines on the use of RFID. Ontario calls for privacy and security to be built into the design of any RFID systems as well as a thorough privacy impact assessment. The federal privacy commissioner says, where possible, RFID systems should aim for informed consent to ensure privacy and security. "If you look at the current documents out of Industry Canada, the focus is on the potential value of RFID," said Kerr. "They want to facilitate the rollout with the least amount of negative implications. The privacy invasiveness of the technology is seen as a side effect rather than a reason against using RFID."At a healthcare technology conference here last month, Nigel Wood, director of industry relations for GS1 Canada and EPCglobal Canada - the industry association that promotes and maintains standards for the identification of goods, services, locations, and related e-commerce communication - said the value of RFID tags will be in minimizing the potential for counterfeit medications, tracking the movement of medicines and supplies from manufacturer to patient, ensuring accurate medications are dispensed to patients, as well as keeping track of medication expiration dates. Overall, RFID will improve patient safety, according to Wood."To me, the supply chain ends at the patient," said Wood. "What is driving changes to bar coding systems is the need to create efficiencies with the supply chain and to mitigate errors with a system like RFID."Wood noted that some pharmaceutical manufacturers are taking the lead in using RFID: pharmaceutical manufacturer Pfizer began to use RFID tags for Viagra in late 2005 to combat growing counterfeit of one of its leading products. Similarly, pharmaceutical manufacturer Purdue began tagging bottles of its OxyContin product using RFID in 2005, a popular painkiller that had been counterfeited. In the US, the Food and Drug Administration has encouraged pharmaceutical manufacturers to find means of preventing against counterfeit. Retailer Wal-Mart has adopted RFID as a bar coding system in the US and has plans to do the same in Canada.In Canadian healthcare, several RFID pilot projects have been launched. Organizations such as the Ontario Pharmacists Association has indicated that it wants to advance the use of RFID technology in the pharmacy to stop counterfeiting of medications as well as curbing the practice of cross-border prescription drug importation from Canada by Americans.Kerr agreed that in the healthcare environment RFID tags have several potential benefits: they can be used to monitor whether patients are taking medications, to keep track of supplies and equipment in a hospital, or to monitor an Alzheimer's patient in a hospital, via an RFID-equipped bracelet. He noted that without sophisticated encryption, counterfeiters will find ways to circumvent basic security and privacy features.However, Kerr suggested that the implications of RFID be part of a more public dialogue before microchips are as commonly implanted under human skin as cosmetic piercings and human autonomy is sacrificed. For instance, using implantable chips in emergency medicine to link patients to their electronic medical records is a scenario that that is too premature to launch on a large scale. Yet nearly 500 hospitals in the US are using the VeriMed patient identification system, where RFID chips are implemented under patient's skin, to provide emergency room staff easy access to medical information, as well as to help avoid costly or serious medical errors."In such an instance, it is an access control mechanism," said Kerr. "You use the RFID as a way of authenticating the identity of a person in case they are unconscious. The particular chip that exists is completely unencrypted and has no security, which is claimed to be a feature rather than a bug."I would suggest that it's far too invasive to implant them," he stressed. "There is no benefit over implanting them than wearing them, and it's not yet clear that wearing them is the best thing to do. Once it is in your body, it is not easy to get out. It is a proprietary substance, and it requires a surgical procedure to get it out."

Ottawa U professor raising concerns about privacy and RFID use

News | 04/17/2007 11:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us