Info.Policy: Tag! Your privacy's it
- By Robert Gellman
- Oct 21, 2003
Technology doesn't invade privacy. People who use and misuse technology invade privacy.
A recent entrant in this struggle goes by the initials RFID, for radio-frequency identification. It stores information on a tiny tag that can be read remotely via radio signals.
An RFID tag on a pallet of merchandise makes it possible to track inventory. Wal-Mart Stores Inc. recently announced plans to require its suppliers to use RFID tags. That sounds benign enough. Pallets don't have privacy interests.
What happens if consumer merchandise bears RFID tags? Say you walk into a store wearing a shirt with an RFID tag sewn invisibly into the label. The store's hidden reader records the brand, size, color and purchase price of the shirt. Would that bother you? How about if all your clothes had tags?
Suppose you buy something in a store using a credit card. Now the store knows who you are and what you bought and can link it to what you're wearing. That's handy information for a customer profile.
What if groups of merchants begin to pool such information? Suddenly, a simple bit of technology has turned into a profiling system that lets anyone with a handheld reader track movements, purchases, clothing and activities. That begins to sound seriously Big Brother-ish.
Are there government applications? The State Department is considering a contactless smart-card chip for embedding in U.S. passports. Other government uses are limited only by the imagination of bureaucrats and contractors.
If nothing here makes you nervous, then your privacy sensitivity needs some readjustment. Whenever information about you can be collected, retained, used and disclosed without your knowledge or consent, privacy alarm bells should be ringing.
The answer is not to kill RFID. Remember that technology is not the problem. We need controls on how people can process personal information, ideally relying on anonymity and fair information practices to protect privacy.
A grass-roots consumer organization called CASPIAN, for Consumers against Supermarket Privacy Invasion and Numbering, is leading the fight to keep RFID tags from sneaking into consumer products. The group began life by battling supermarkets' frequent- shopper programs. You can find out more about RFID and consumer-unfriendly frequent shopping cards by visiting CASPIAN, at www.nocards.org
The RFID industry pays some attention to privacy. The Auto-ID Center, a partnership of dozens of companies and universities, has a Web site with some information about privacy, although you have to dig to find it. Visit autoidcenter.org
RFID technology is global. That means its proponents will have to comply with the European Union's data protection rules. Whether America will operate under EU-style privacy rules for RFID or have weaker ones remains to be seen. Remember, it's how people implement technology that matters. Robert Gellman is a Washington privacy and information policy consultant. E-mail him at firstname.lastname@example.org.