Feeds

Shops must use RFID with care

Information Commissioner checks it out

Intelligent flash storage arrays

Shops which use RFID tags and CCTV cameras must tell shoppers every time an RFID tag is used and must tell shoppers how to remove them. The order comes in guidelines produced by the Information Commissioner's Office (ICO). RFID (radio frequency identification) tags are used for inventory management in many shops but are increasingly used on shop shelves to identify products. The ICO said that shops must comply with the Data Protection Act when RFID information is collected alongside personal identifying information, such as CCTV footage.

"Where personal data is collected, generated or disclosed using RFID either directly or indirectly, the Act will apply," says the guidance. "Those collecting personal data with RFID will have to give notice of the presence of RFID tags on products and of readers, and explain the implications. They will have to tell consumers what personal information is being collected, by whom, and for what purpose. It might also be necessary to tell customers how to disable or remove tags, for example if a tag has been left on a product after purchase."

The guidance also tells retailers that whatever data is gathered must be disposed of once it has been used, and that only an amount of data proportionate to the purpose for which it was gathered can be stored.

RFID chips are causing some privacy activists concerns as they enable retailers, state bodies and any other using organisation to gather information about people's product choices, movements and habits. One concern is about the security of the information, once gathered.

The ICO's guidance warns of skimming, cloning and eavesdropping on tags and the transmission of data between tags and readers. "The simplest way of addressing privacy concerns about RFID is to ensure that any tags on individual items are removed or disabled at the point of purchase," it said.

Meanwhile, California is about to introduce laws controlling the data kept on RFID cards. The Identity Information Protection Act has been passed by legislators in the state and awaits the signature of governor Arnold Schwarzenegger to become state law.

That state is using RFID in library cards and driver's licences and the new law will control how government and private organizations are allowed to deal with the information on cards. The Act orders the use of encryption technologies on cards.

"RFID technology is not in and of itself the issue," said Senator Joe Simitian, who proposed the bill. "The issue is whether and under what circumstances the government should be allowed to compel its residents to carry technology that broadcasts their most personal information." The US has recently taken the controversial decision to embed RFID chips in passports, prompting fears about the documents' long term security.

See: The Guidance (7-page / 44KB PDF)

Copyright © 2006, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Secure remote control for conventional and virtual desktops

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.