RFID: What Congress Needs to Know

RFID: What Does Congress Need to Know?

RFID is a technology that lends itself to a wide variety uses. An RFID tag is attached to an item like a barcode is printed on an item, however the information on the tag can be read whether the tag is visible or not. The distance at which the tag can be read varies from a few inches to many yards, depending on the design of the tag and the strength of the reading device. The amount of information that a tag can contain also varies based on the design, with the less expensive tags holding a short identifier similar to a bar code, to tags that can carry detailed information such as a name, address, and date of birth. Because this is an area of active technology development, we can expect that in the near future tags will be developed that are more powerful and more information rich.

Any new technology has social consequences. These are usually seen as side-effects to the actual goals of the technology, and may not be visible for many years after the deployment of the technology. When the social impact of the technology is recognized late in the life-cycle of the technology, it is difficult and costly to make the changes that will mitigate these negative effects. It is therefore preferable to anticipate the social impacts and build safeguards into products early in the development thus saving money and development time.

A primary social concern regarding the use of RFID technology is that of privacy. As RFID tags are added to consumer goods or to items that will be associated with individuals such as identify cards or records, RFID has the potential to allow the tracking of the location and activity of individuals, and the creation of records of this tracking in databases, all without the individual's knowledge. Yet because RFID is a young technology, there is today a window of opportunity to design privacy protections into the technology and into the social institutions that will make use of RFID.

There are two general areas where work needs to be done to assure that RFID can be employed without having a negative impact on individual privacy. The first is in the development of the technology itself. With privacy protection as a stated goal, engineering decisions can fulfill that goal. Techniques like encryption, system security, and the ability to easily turn off or "kill" an RFID tag can be made part of the RFID standard. All of these are possible today, but some are considered to be extra features rather than basic capabilities.

The second area is in business practices. Engineering alone cannot solve social problems; ethical practices and education of employees and consumers are effective tools when dealing with the impact of technology on society. Prior to the implementation of any RFID system that may be associated with individuals, a business must study all areas where such an implementation could have an effect on privacy. Relevant laws and statues must be considered, as well as industry or company policies. A statement of principles relating to privacy, the use of RFID, and the use of any databases of consumer information associated with the ID system can both guide industry and provide an opening dialogue with consumers. This work has begun in some areas: the American Association of Publishers has adopted a privacy statement on RFID in coordination with the American Library Association; the Federal Drug Administration's Compliance Guide for RFID use in pharmaceuticals contains requirements relating to privacy. These early efforts will inform others. The essential message is that now is the time to address the privacy issues related to RFID, before the technology matures, before systems and applications are developed, and before business practices are in place. With early planning and the development of industry-wide best practices, RFID can create efficiencies in the supply chain and gain consumer confidence.

Computer Professionals for Social Responsibility
P.O. Box 717
Palo Alto, California 94302 USA
http://www.cpsr.org
contact: Susan Evoy +1 650 322 3778