EU issues privacy guidance for RFID

The European Union has issued new recommendations covering the future use of bar codes and radio frequency identification devices (RFID) to ensure they respect privacy.

The directive says Europeans should be able to have control over smart chips, a worldwide market predicted to rapidly grow in the next decade, while still being able to easily use them to make everyday life simpler.

There are already over 6 billion smart chips, microelectronic devices that can be integrated into a variety of everyday objects from fridges to bus passes. With Radio Frequency Identification (RFID) technology, they can process data automatically when brought close to ‘readers’ that activate them, pick up their radio signal and exchange data with them.

The worldwide market value for RFID tags, estimated to be €4 billion in 2008, is projected to grow to about €20 billion by 2018.

RFID-style devices have a potentially big role to play in healthcare where they are being used to track patients or valuable items of equipment. They are also beginning to be used by some providers to track drugs or blood products, or even surgical swabs, offering significant benefits to patient safety.

The new recommendations adopted by the European Commission are said to try and ensure everyone in the design or operation of technology using smart chips respects the individual’s fundamental right to privacy and data protection, in line with the Charter of Fundamental Rights of the European Union.

"A promising technology for the future, smart chips can make life simpler in all sorts of ways. We are talking about everyday objects suddenly becoming smart by connecting to a network and exchanging information,” said Viviane Reding, EU Commissioner for Information Society and Media.

"There is clear economic potential in using small, smart chips to allow communication between objects. But Europeans must never be taken unawares by the new technology.”

She said European consumers must be confident that if and when their personal data is involved, their privacy will be safe. “The Commission therefore wants RFID technology to empower consumers to control their data security, which is the best way to make sure it is an economic success."

The key points of the recommendation are:

• Consumers should be in control whether products they buy in shops use smart chips or not. When consumers buy products with smart chips, these should be deactivated automatically, immediately and free-of-charge at the point of sale.
• Companies or public authorities using smart chips should give consumers clear and simple information so that they understand if their personal data will be used, the type of collected data (such as name, address or date of birth) and for what purpose. They should also provide clear labelling to identify the devices that ‘read’ the information stored in smart chips, and provide a contact point for citizens to obtain more information.
• Retail associations and organisations should promote consumer awareness on products containing smart chips through a common European sign to indicate whenever a smart chip is used by a product.
• Companies and public authorities should conduct privacy and data protection impact assessments before using smart chips. These assessments, reviewed by national data protection authorities.

Link

The Recommendation can be found here.