(Dieser Artikel ist auch in deutscher Sprache verfügbar)

The European Commission published the Draft Recommendation on RFID Privacy and Security on the Your Voice in Europe-Platform for public consultation.

After a public consultation on RFID Privacy Issues in 2006, some conferences and workshops and various discussions on the topic within the RFID Expert Group, this publication finally represents the measures that the Commission recommends to the member states and stakeholders, in order to achieve a high level of privacy and data protection in the context of RFID applications.

EDRi welcomes this Draft Recommendation, which contains various important measures, like the recommendation that RFID reading areas as well as RFID tagged object should be marked with a clear sign indicating the presence of RFID tags or readers. Also the recommendation to conduct a Privacy Impact Assessment before the deployment of RFID applications and to provide information on the policy governing the use of this particular application are important measures to inform individuals of the presence and the purpose of a given RFID application.

Regarding RFID use in the retail environment, the Commission addresses two scenarios:

a.When a RFID application processes personal data or when it is likely that personal data will be created, the retailer should deactivate the tag unless the consumer requests otherwise.

b.When the application does not process personal data and it is unlikely that personal data will be generated through the application, the retailer must only provide facilities to deactivate or remove the tag.

As already expressed in our contributions to the RFID Expert Group, EDRi strongly asks for an opt-in regime unless there are sufficient mechanisms in place to grant the individual full control over the RFID tags in his or her possession and the data stored on them.

The problems with the two retail-scenarios differentiated by the Commission are, that on the one hand the privacy risks not only stem from the RFID application in question but from the unique identifier stored on the tag as well as from the fact that this identifier can be utilised by any RFID application looking for a unique identifier for a person. This problem will not necessarily show up in the privacy risk assessment conducted for the RFID application in question.

On the other hand, experience shows that industry representatives and application operators often have problems with identifying privacy and data protection threats. Especially the concept of personal data is often not properly understood. Therefore it is not unlikely that application operators will not recognize privacy and data protection problems and leave the consumers with the burden to ask for deactivation or removal of the tags.

EDRi will therefore continue to argue for the implementation of binding policy requiring the deactivation or removal of RFID tags unless sufficient technical measures are in place to give individuals full control over the RFID tags in their possession.

The discussion on RFID, privacy and security will certainly continue, not only in the RFID Expert Group, but also amongst the public and the stakeholders. But not only discussions, also improvements are requested, as the Commission clearly states that it will evaluate the implementation of the Recommendation in three years time, in particular with a focus on systems "providing automatic deactivation at the point of sale on all items except where consumers specifically opted in to the RFID application."

For now, it is important that the general public provides the Commission with its opinions on the Draft Recommendation. Both approval and criticism are equally welcome.

Draft Recommendation on the implementation of privacy, data protection and information security principles in applications supported by Radio Frequency Identification (RFID): your opinion matters!
http://ec.europa.eu/yourvoice/ipm/forms/dispatch?form=RFIDRec

RFID and Informed Consent - Using and removing of RFID functionality (5.12.2007)
http://www.edri.org/edrigram/number5.23/rfid-informed-consent

European Data Protection Supervisor's opinion on RFID (16.01.2008)
http://www.edri.org/edrigram/number6.1/edps-opinion-rfid

Article 29 Working Party: Opinion no. 4/2007 on the concept of personal data (20.06.2007)
http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2007/wp136_en...

(contribution from Andreas Krisch - EDRI-member VIBE! - Austria)