Shops must use RFID with care
Print storyInformation Commissioner checks it out
Posted in Music and Media, 28th September 2006 08:52 GMT
Join our expert panel in discussing application security
Shops which use RFID tags and CCTV cameras must tell shoppers every time an RFID tag is used and must tell shoppers how to remove them. The order comes in guidelines produced by the Information Commissioner's Office (ICO). RFID (radio frequency identification) tags are used for inventory management in many shops but are increasingly used on shop shelves to identify products. The ICO said that shops must comply with the Data Protection Act when RFID information is collected alongside personal identifying information, such as CCTV footage.
"Where personal data is collected, generated or disclosed using RFID either directly or indirectly, the Act will apply," says the guidance. "Those collecting personal data with RFID will have to give notice of the presence of RFID tags on products and of readers, and explain the implications. They will have to tell consumers what personal information is being collected, by whom, and for what purpose. It might also be necessary to tell customers how to disable or remove tags, for example if a tag has been left on a product after purchase."
The guidance also tells retailers that whatever data is gathered must be disposed of once it has been used, and that only an amount of data proportionate to the purpose for which it was gathered can be stored.
RFID chips are causing some privacy activists concerns as they enable retailers, state bodies and any other using organisation to gather information about people's product choices, movements and habits. One concern is about the security of the information, once gathered.
The ICO's guidance warns of skimming, cloning and eavesdropping on tags and the transmission of data between tags and readers. "The simplest way of addressing privacy concerns about RFID is to ensure that any tags on individual items are removed or disabled at the point of purchase," it said.
Meanwhile, California is about to introduce laws controlling the data kept on RFID cards. The Identity Information Protection Act has been passed by legislators in the state and awaits the signature of governor Arnold Schwarzenegger to become state law.
That state is using RFID in library cards and driver's licences and the new law will control how government and private organizations are allowed to deal with the information on cards. The Act orders the use of encryption technologies on cards.
"RFID technology is not in and of itself the issue," said Senator Joe Simitian, who proposed the bill. "The issue is whether and under what circumstances the government should be allowed to compel its residents to carry technology that broadcasts their most personal information." The US has recently taken the controversial decision to embed RFID chips in passports, prompting fears about the documents' long term security.
See: The Guidance (7-page / 44KB PDF)
Copyright © 2006, OUT-LAW.com
OUT-LAW.COM is part of international law firm Pinsent Masons.
Increase your knowledge of the latest threats to your busines
Can Outsiders Enhance Exchange?
The future of SaaS and IT infrastructure management
Solving on-premise email challenges with on-demand services
The business case for application security
Reducing messaging and web security costs with managed services
Win a Samsung C6625!
Is your cameraphone an oxymoron?
Reg Mobile and Wireless newsletter is go! go! go!
Sign up, sign up for The Register IT security newsletter