Feeds

Shops must use RFID with care

Information Commissioner checks it out

Boost IT visibility and business value

Shops which use RFID tags and CCTV cameras must tell shoppers every time an RFID tag is used and must tell shoppers how to remove them. The order comes in guidelines produced by the Information Commissioner's Office (ICO). RFID (radio frequency identification) tags are used for inventory management in many shops but are increasingly used on shop shelves to identify products. The ICO said that shops must comply with the Data Protection Act when RFID information is collected alongside personal identifying information, such as CCTV footage.

"Where personal data is collected, generated or disclosed using RFID either directly or indirectly, the Act will apply," says the guidance. "Those collecting personal data with RFID will have to give notice of the presence of RFID tags on products and of readers, and explain the implications. They will have to tell consumers what personal information is being collected, by whom, and for what purpose. It might also be necessary to tell customers how to disable or remove tags, for example if a tag has been left on a product after purchase."

The guidance also tells retailers that whatever data is gathered must be disposed of once it has been used, and that only an amount of data proportionate to the purpose for which it was gathered can be stored.

RFID chips are causing some privacy activists concerns as they enable retailers, state bodies and any other using organisation to gather information about people's product choices, movements and habits. One concern is about the security of the information, once gathered.

The ICO's guidance warns of skimming, cloning and eavesdropping on tags and the transmission of data between tags and readers. "The simplest way of addressing privacy concerns about RFID is to ensure that any tags on individual items are removed or disabled at the point of purchase," it said.

Meanwhile, California is about to introduce laws controlling the data kept on RFID cards. The Identity Information Protection Act has been passed by legislators in the state and awaits the signature of governor Arnold Schwarzenegger to become state law.

That state is using RFID in library cards and driver's licences and the new law will control how government and private organizations are allowed to deal with the information on cards. The Act orders the use of encryption technologies on cards.

"RFID technology is not in and of itself the issue," said Senator Joe Simitian, who proposed the bill. "The issue is whether and under what circumstances the government should be allowed to compel its residents to carry technology that broadcasts their most personal information." The US has recently taken the controversial decision to embed RFID chips in passports, prompting fears about the documents' long term security.

See: The Guidance (7-page / 44KB PDF)

Copyright © 2006, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Build a business case: developing custom apps

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Nadella: Apps must run on ALL WINDOWS – PCs, slabs and mobes
Phone egg, meet desktop chicken - your mother
White? Male? You work in tech? Let us guess ... Twitter? We KNEW it!
Grim diversity numbers dumped alongside Facebook earnings
Microsoft: We're making ONE TRUE WINDOWS to rule us all
Enterprise, Windows still power firm's shaky money-maker
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.