RFID
(radio frequency identification) tags are used for inventory
management in many shops but are increasingly used on shop shelves
to identify products. The ICO said that shops must comply with the
Data Protection Act when RFID information is collected alongside
personal identifying information, such as CCTV footage.
"Where personal data is collected, generated or disclosed using
RFID either directly or indirectly, the Act will apply," says the
guidance. "Those collecting personal data with RFID will have to
give notice of the presence of RFID tags on products and of
readers, and explain the implications. They will have to tell
consumers what personal information is being collected, by whom,
and for what purpose. It might also be necessary to tell customers
how to disable or remove tags, for example if a tag has been left
on a product after purchase."
The guidance also tells retailers that whatever data is gathered
must be disposed of once it has been used, and that only an amount
of data proportionate to the purpose for which it was gathered can
be stored.
RFID chips are causing some privacy activists concerns as they
enable retailers, state bodies and any other using organisation to
gather information about people's product choices, movements and
habits. One concern is about the security of the information, once
gathered.
The ICO's guidance warns of skimming, cloning and eavesdropping
on tags and the transmission of data between tags and readers. "The
simplest way of addressing privacy concerns about RFID is to ensure
that any tags on individual items are removed or disabled at the
point of purchase," it said.
Meanwhile, California is about to introduce laws controlling the
data kept on RFID cards. The Identity Information Protection Act
has been passed by legislators in the state and awaits the
signature of governor Arnlod Schwarzenegger to become state
law.
That state is using RFID in library cards and driver's licences
and the new law will control how government and private
organisations are allowed to deal with the information on cards.
The Act orders the use of encryption technologies on cards.
"RFID technology is not in and of itself the issue," said
Senator Joe Simitian, who proposed the bill. "The issue is whether
and under what circumstances the government should be allowed to
compel its residents to carry technology that broadcasts their most
personal information."
The US has recently taken the controversial decision to embed
RFID chips in passports, prompting fears about the documents' long
term security.
