RFID Law Blog

European Commission lays down the law on RFIDs

As she promised, the redoubtable Viviane Reding, the European Union's Commissioner of the Information Society and the Media, has acted swiftly to publish a list of recommendations designed to protect EU citizens from possible, indeed probable, breaches of their right to privacy that may be occasioned by the use of RFID chips, writes Martyn Warwick.

As Radio Frequency Identification microprocessors become increasingly commonplace the European Commission is asking EU member states to ensure that privacy issues are fully considered in relation to the proliferation of the devices. Ms. Reding is particularly concerned to ensure that the chips are deactivated when a consumer leaves a shop or venue wearing or carrying (usually all unwittingly) one or more of the devices. This is to stop organisations and companies from tracking individuals and compromising their privacy.

In a statement the Commissioner says, "European consumers must be confident that if and when their personal data is involved, their privacy will be impregnable in a changing technological environment. The Commission wants RFID technology to empower consumers to control their data security."

She also wants binding rules to be imposed on companies initiating RFID projects and to ensure that consumers are provided with "clear and simple information" on how, when, where and for what purposes the chips are used and the provision of copper-bottomed guarantees on the safety and confidentiality of personal data gleaned trough the use of the tags.

She also proposed that retail organisations be required to foot the bill for consumer awareness campaigns on RFIDs and wants to make it mandatory that any group running an RFID project should carry out a privacy and data protection impact assessment beforehand.

Viviane Reding says, "A promising technology for the future, smart chips can make life simpler in all sorts of ways. We are talking about everyday objects suddenly becoming smart by connecting to a network and exchanging information. Think of smart-fridges that inform you your milk is past its use-by date or smart-food packaging warning parents about possible allergies. There is clear economic potential in using small, smart chips to allow communication between objects. But Europeans must never be taken unawares by the new technology. This is why the Commission issued strong recommendations to the industry today. European consumers must be confident that if and when their personal data is involved, their privacy will be impregnable also in a changing technological environment.

The Commission therefore wants RFID technology to empower consumers to control their data security, which is the best way to make sure it is an economic success. After all, the European share of the global smart chips market will reach 35 per cent in the next eight years."

At the moment RFIDs are used  to a much greater extent in North America than they are in Europe (currently by a ratio of 3:1) but the latest figures forecast that their usage will quintruple by 2015. The devices can be integrated into a huge variety of objects and products from transport tickets to household fridges and from packets of razor blades to items of clothing.

There are already in excess of six billion of the chips out there and retailers particularly love them because they process data automatically when in proximity to the 'readers' that activate them, access their radio signal and exchange data with them.

Details of the EC's principles for protecting privacy and data protection in the use of RFIDs include provisions requiring that consumers must be able to determine whether products they buy in shops are fited with radio tags or not. Furthermore, when consumers buy products with embedded RFIDs,the radio tags must deactivated automatically, immediately and free-of-charge at the point of sale, unless the consumer explicitly opts-in by asking to keep the chip operational.

Other provisions are that commercial companies and public authorities using smart chips should give people clear and simple information so that they understand if their personal data will be used, the type of collected data that is being and for what purpose. They should also provide clear labelling to identify the devices that 'read' the information stored in smart chips, and provide a contact point for citizens to obtain more information.

All the above provisions are designed to bolster and secure the individual's fundamental right to privacy and data protection as defined and enshrined in the Charter of Fundamental Rights of the European Union proclaimed on 14 December 2007.