Ann Cavoukian’s five-page report calls for businesses that are considering the use of radio frequency identification (RFID) technology to take several factors into account. Among them are:
- An individual should be appointed to ensure that privacy measures are in place.
- Companies must seek consent from individuals before collecting personal information via RFID technology.
- Collection should be limited to the minimum amount of information necessary.
- Employees that may have access to the personal information be trained in its appropriate use.
- Safeguards should be put in place to prevent the loss or theft of information that is stored on an RFID tag.
Cavoukian’s office prepared the report with the co-operation of EPCglobal Canada, the organization responsible for creating standards around RFID technology in Canada. At the moment, concerns over the privacy implications of the technology are minimized by the fact that its use is limited to high-level aspects of supply chain management, such as tracking cases and pallets of goods.
“There are no individual items marked or RFID-tagged,” said Cavoukian. “It’s (about) moving these big crates and cartons and pallets. There’s no privacy issue there. In fact, there are enormous benefits.”
Item-level RFID a long way away
RFID is often heralded as the successor to bar code technology. Where bar codes require line-of-sight scanning, RFID tags can be read indirectly and from a distance of several feet. Tags are also able to contain a lot more product information than conventional bar codes, potentially creating efficiencies at every point along a supply chain.
“We’re looking at pallet-level opportunities” for RFID, said David Wilkes, senior vice-president of the Canadian Council of Grocery Distributors. Wilkes is also the chairman of the Canadian RFID Centre in Markham, Ont.
“If the privacy commissioner has said that she’s not worried at that level, that provides comfort (to us) because that is the level that we are looking at within this industry,” he said. “I’m not sure that we’ll ever come at the item-level” in grocery stores.
Brian Sterling, director of business development for RFID and product traceability at IBM Canada, agreed that item-level RFID is a long way off. Even for retail operations that are considering tagging individual products, it is probably three to five years away.
Sterling confirmed that IBM is working on several RFID pilot projects in Canada for retail operations in Canada, but still at the case/pallet level.
Cavoukian’s office first issued a report on RFID in 2003. Cavoukian admitted that not much has changed in three years, but her goal is to increase awareness about the technology before it advances to a stage where privacy could be a more pressing concern.
“We’re way ahead of the game,” she said. “Let’s make these ‘Made in Canada’ guidelines to ensure that the public is not concerned about the use of RFID.” When the day arrives that RFID tags are attached to individual consumer items, Cavoukian wants proper safeguards in place to ensure that personal information is not put at risk.
“In the event that there item-level rollouts in Canada, let’s be in a position to apply these guidelines. If I was a business, I would want to lead with privacy-protection measures before I roll out item-level RFID. I have no problem with item-level RFID as long as these protection measures are in place,” she said.