The Information and Privacy Commissioner of Ontario Monday introduced RFID guidelines to separate fact from fiction and prepare consumers for the day when they may have to deal with the technology on a daily basis.
Ann Cavoukian’s five-page report calls for businesses that are considering the use of radio frequency identification (RFID) technology to take several factors into account. Among them are:
• An individual at the company should be appointed to ensure that privacy measures are in place
• Companies must seek consent from individuals before collecting personal information via RFID technology
• Collection should be limited to the minimum amount of information necessary
• Employees that may have access to the personal information be trained in its appropriate use
• Safeguards should be put in place to prevent the loss or theft of information that is stored on an RFID tag
Cavoukian’s office prepared the report with the co-operation of EPCglobal Canada, the organization responsible for creating standards around RFID technology in Canada. At the moment, concerns over the privacy implications of the technology are minimized by the fact that its use is limited to high-level aspects of supply chain management, like tracking cases and pallets of goods.
“There’s are no individual items marked or RFID-tagged,” said Cavoukian. “It’s (about) moving these big crates and cartons and pallets. There’s no privacy issue there. In fact, there are enormous benefits.”
RFID is often heralded as the successor to bar code technology. Where bar codes require line-of-sight scanning (such as a bar code reader one might see in a grocery store checkout), RFID tags can be read indirectly and from a distance of several feet. Tags are also able to contain a lot more product information than conventional bar codes, potentially creating efficiencies at every point along a supply chain.
“We’re looking at pallet-level opportunities” for RFID, said David Wilkes, senior vice-president of the Canadian Council of Grocery Distributors. Wilkes is also the chairman of the Canadian RFID Centre in Markham, Ont.
“If the privacy commissioner has said that she’s not worried at that level, that provides comfort (to us) because that is the level that we are looking at within this industry,” he said. “I’m not sure that will ever come at the item-level within grocery.”
Brian Sterling, director of business development for RFID and product traceability at IBM Canada, agreed that item-level RFID is a long way off. Even for retail operations that are considering tagging individual products, it is probably three to five years away.
Sterling confirmed that IBM is working on several RFID pilot projects in Canada for retail operations in Canada, but still at the case/pallet level.
Cavoukian’s office first issued a report on RFID in 2003. Cavoukian admitted that not much has changed in three years, but her goal is to increase awareness about the technology before it advances to a stage where privacy could be a more pressing concern.
“We’re way ahead of the game,” she said. “Let’s make these ‘Made in Canada’ guidelines to ensure that the public is not concerned about the use of RFID.” When the day arrives that RFID tags are attached to individual consumer items, Cavoukian said she wants to ensure that the proper safeguards are in place to ensure that personal information is not put at risk.
“In the event that there item-level rollouts in Canada, let’s be in a position to apply these guidelines. If I was a business, I would want to lead with privacy-protection measures before I roll out item-level RFID. I have no problem with item-level RFID as long as these protection measures are in place,” she said.
Even though the technology is still in its infancy, retailers involved in beta-level projects are cognizant of privacy concerns, said Sterling. “We do like to make sure that consumer privacy and security concerns are addressed adequately up front,” he said. “That way, any kind of issues that may or may not come to the attention of people as we’re going through it can be addressed proactively.”
The current generation of RFID tags (Gen 2) already contain the means to turn them on and off through an encrypted password, said Art Smith, president of EPCglobal Canada. “There are positive benefits that can be derived” from consumers bringing RFID tags into their homes, he said. A tag on a bottle of pills could one day be synchronized with a “smart” medicine cabinet equipped with an RFID reader to provide the consumer with easy access to information about the medication.
At the moment, tags are still too expensive to allow them to be used at the retail item-level, said Smith, but EPCGlobal Canada continues to evaluate other applications “where moving to item-level tagging makes sense or not.”
Ontario isn’t the only Canadian jurisdiction that is casting a serious eye on the benefits or possible abuse of RFID. Last month, the federal privacy commissioner Jennifer Stoddart issued a report that outlined concerns about the technology and plans to increase funding to investigate its potential.
Comment: [email protected]
