Rolling out RFID? You could be breaking the law

The EU is consulting on the rights and wrongs of RFID - and has confessed it fears the technology could have a whole host of data protection and civil liberties issues.

The EC has set up a working party to look into the privacy implications of the spread of RFID technology and has already published a consultation document which warns that data collected from the tracking tags could be susceptible to abuse by commercial interests.

The Article 29 working party recently published a report into the protection of individuals as rollouts of RFID in big business become more numerous and increasingly spread to item-level tagging.

"While the advantages related to the use of RFID technology seem obvious, the widespread deployment of the technology does not come without its potential drawbacks," the report said. "Concerns arise about the possibility of businesses and governments to use RFID to pry into the privacy sphere of individuals... the ability to surreptitiously collect a variety of data all related to the same person; track individuals as they walk in public places [for example]."

The working party believes supermarkets and other retailers may use the data from RFID tags to gather information about shoppers; for example, the data from an RFID-tagged purchase could be tied together with a customer's credit card details.

Another possible window for abuse could be in ticketing systems, the EC says. "One should consider the hypothetical case where an organisation decided to implement a contactless ticketing system based on RFID technology for monthly passes where the name and contact details of the holder of the pass is inserted into the tag," enabling individuals' movements to be tracked. While this may seem far-fetched, Transport for London's Oyster card is run on a similar system and travellers' journey details are recorded and stored.

The EC highlights that carrying RFID tags or purchasing items can leave individuals open to unauthorised and unwanted tracking.

"It should be noted that RFID systems are very susceptible to attacks," the report says.

The EC has published a series of guidelines to advise companies on best practice with the use of RFID tags and how to ensure not only that consumers' privacy is not breached but that businesses do not break the law by mishandling data connected with the tags.

Much of the information that may be gathered by retailers could well fall under the Data Protection Act, leaving companies open to legal penalties if they break it and allowing consumers access to their data at all times.

Consumers will also have to be notified if they are being tracked or tagged products are in use. "Under most of the scenarios where RFID technology is used, consent from individuals will be the only legal ground available to data controllers to legitimise the collection of information throught RFID," the report says.

Consumers will also need to be informed how to destroy or disable the tags, the working party said, and who will be able to access their data.

The Working Party believes it is the responsibility of the vendors to privacy-proof the RFID world: "The design of RFID tags, RFID readers as well as RFID applications driven by standardisation initiatives may have a great impact in minimising the collection and use of personal data and also in preventing any unlawful forms of processing by making it technically impossible for unauthorised persons to access personal data."

The consultation will end on 31 March.