Many civil rights advocates are concerned about the privacy implications of RFID technology. They envisage a world where companies track what their customers buy, where they go, what other goods and services they purchase and build up a comprehensive database on all aspects of the individual's life. Although it is not viable for companies to do this at the moment, the general consensus among the concerned parties is that guidelines should be put in place before such moves are undertaken.
Malcolm Crompton, Australia's Privacy Commissioner, said there was a great potential for concern if RFID technology was implemented wrongly. The use of RFID tags along the supply chain to the retail point of sale was not a problem, according to Crompton, but after the retail point of sale, use of the technology raises several issues.
"Barcodes label at the product line level," said Crompton. "RFID tags put an individual number on each product unit." This, coupled with the ability to read the tag in a contactless way, raised issues over the control consumers have. In this case the Privacy Act may come into play.
"The Privacy Act only deals with personal information," said Crompton. "If a name is attached to a tag [or the name can be deduced from the information linked to the tag] then the Privacy Act comes into play."
"Privacy Principle One requires you to tell people you are collecting information, and what you are going to do with it," said Crompton. "Privacy Principle Two [requires you to] deliver on that promise." Privacy Principle Eight requires organisations to allow customer to deal with them anonymously if it is practical.
"Immediately the Privacy Act gives you a framework for deploying RFID technology," said Crompton. "A lot of the reason for the Privacy Act is to leave the person in control."
Crompton said RFID technology was not inherently bad and promised some significant benefits if it is implemented in a considered way. He said there were individuals and companies in the United States considering collecting data after the point of sale, which was a problem.
"There's not a lot of data in an RFID tag, just a unique number," said Crompton. "When you link it up with other data it becomes interesting. There are arguments about whether [tracking people and building a database on them using RFID technology] is even possible. The point is that before some clever person does that let's think it through."
"Clearly it serves no purpose from a retail perspective...for privacy not to be absolutely secure"
-- Neil McKay, Sun
The subject was discussed at the recent 25th International Conference of Data Protection and Privacy Commissioners, which was hosted by Australia. The conference passed a Resolution on Radio Frequency Identification, and Crompton is in dialogue with Elliot Maxwell, the director of public policy at the Auto-ID centre, to ensure the resolution was passed on and is being implemented.
Will Duckworth, IBM's wireless expert, recommended that companies implemented RFID technology appropriately by adopting standards and consulting with privacy groups.
"Marks and Spencer in the UK worked with the top five privacy organisations and managed to implement a similar solution as Benetton but without the backlash.
Many people did not think the privacy concerns would be that big an issue, with Scott Dawes, industry director manufacturing, retail and distribution for Oracle Australia & New Zealand, claiming that people today had released en masse their insistence on privacy - although he added this was most likely a temporary situation.
Neil McKay, director Sun's Retail and CPG Industry group for Sun in Asia Pacific told ZDNet Australia "there has been a lot of people jumping at a lot of shadows".
"Clearly it serves no purpose from a retail perspective, a manufacturing perspective, a government perspective and so on for privacy not to be absolutely secure," said McKay. "I think we'll find the people will find the benefits outweigh the problem with any privacy issues."
"No industry is going to completely reject customers as the technology is rolled out," said McKay. "It will be done in such a way that the customer will always come first."
Bjarne Munch, senior research analyst at Meta Group, pointed out that individuals have already shown they are prepared to forego privacy if they get a benefit, as evidenced by the success of reward schemes and loyalty programs.
"With mobile phones you have tracking down to about one metre anyway," said Munch. "[In terms of possible privacy infringements] the mobile phone industry is probably moving at higher speed than RFID at the moment."
