RFID: Emerging Policy Issues
- Published: March 31, 2005, By Sheila A. Millar Attorney-at-Law, Keller & Heckman, Washington, DC
Legal Briefs
In a previous article (RFID & EPC Systems)we outlined some of the issues surrounding the use of radio frequency identification (RFID) and electronic product code (EPC) technology for the converting industry. As we indicated, the primary concern surrounding the use of this technology involves privacy and security when personal information becomes associated with RFID tags. Privacy and security were the major focus of a workshop on RFID sponsored by the Federal Trade Commission (FTC) last summer.
The FTC, on March 8, released its report of the workshop, recommending industry self-regulation in lieu of regulation at present. The report, entitled "Radio Frequency Identification: Applications and Implications for Consumers," is useful reading for any business interested in the technology. The report can be found at the following Web site: ftc.gov/os/2005/03/050308rfidrpt.pdf.
Self-regulation, with special attention to privacy and security, will be crucial to the long-term acceptance of the technology. The FTC recommends self-regulation focus on transparency, accountability, and database security.
Industry has been working hard on self-regulatory guidelines for RFID to address privacy and security concerns. In this regard, in early March the International Chamber of Commerce (ICC) issued principles for responsible deployment and operation of electronic product codes. The ICC guidelines reflect what generally are known as "fair information practice principles."
Among the recommendations:
- Consumer products or packages containing EPC tags should be labeled accordingly. If the tag is not contained in discardable packaging, data on the location of the tag should be provided, along with information about whether the consumer has the ability to remove or disable the tag.
- EPC users should make public their policies regarding use and protection of personal data obtained through EPC use. Companies should review their privacy and security policies and consider implications in this regard.
The ICC guidelines also include specific recommendations on data security, including the specification that personally identifiable data should be protected against such risks as loss or unauthorized access, destruction, use, modification, or disclosure.
The ICC guidelines also encourage EPC users to take precautions in linked systems. Under many privacy regimes worldwide, notably under the EU Data Directive, individuals have a right to access data held about them. ICC guidelines recognize access rights and encourage honoring consumer preferences about disclosure of data to third parties.
Privacy and security, however, are not the only issues with RFID. Because it is a wireless technology, regulations administered by the Federal Communications Commission (FCC) in the US and counterpart bodies worldwide come into play.
The FCC held its own workshop on RFID on Oct. 7, 2004. The primary purpose was to hear whether regulatory barriers at the FCC stood in the way of RFID deployment in the US. The explosion of communication technologies (and the privacy/security concerns noted above) will play into decisions about the frequencies at which RFID operates around the world.
Organizations such as the International Standards Organization (ISO) have raised technical questions in this regard. Assuring there is no interference with other telecommunications uses will remain important as the technology expands. The clear view of the FCC, however, is that RFID technology should be encouraged.
One other emerging issue related to the rapidly expanding use of RFID and EPC involves solid waste. Currently, we are seeing a resurgence of regulatory initiatives addressing solid waste. Electronic wastes in particular are generating attention, evidenced by adoption in California of SB 20, the Electronic Waste Recycling Act of 2003. SB 50 further amended this law in 2004. The Act requires a retailer to collect a "covered electronic product" recycling fee from consumers. Though the law is aimed at televisions and computers and defines an electronic product as a video display device with a screen size greater than 4 in., as RFID tags proliferate, expect more attention to waste implications.
At this juncture, implementing self-regulatory policies on privacy and security remains key to successful deployment and consumer acceptance of RFID. Consumer education also will be useful in dispelling misperceptions about its use.
Sheila A. Millar, a partner with Keller and Heckman LLP, counsels both corporate and association clients. Contact her at 202/434-4143; This email address is being protected from spambots. You need JavaScript enabled to view it.; packaginglaw.com.
