Washington State House Gives Nod to Privacy Bill

By Claire Swedberg

Feb. 15, 2008—A revised version of legislation intended to protect the privacy of individuals using RFID tags with "unique personal identifier numbers" passed the Washington State House of Representatives on Wednesday. House Bill (HB) 1031—intended to limit collection of personal information from an RFID tag without the tag holder's knowledge or consent—passed with 69 to 27 votes. The bill is now headed for the State Senate and, if approved, to the office of Governor Christine Gregoire.

This is the second round for HB 1031. An earlier version failed to pass a House vote in March 2007 (see Washington's RFID Bill Halted). In its original form, HB 1031 was rejected because of its broad scope, says the bill's primary sponsor, State Representative Jeff Morris (D-Mount Vernon). Known at that time as the "Electronic Bill of Rights," the first version did not offer exemptions for a host of users, including emergency responders, university researchers and service providers such as cable companies. The revised bill also has eliminated mention of a labeling requirement ("A person shall not sell, use, or distribute an item that contains an electronic communication device without labeling such item with a notice stating that such item contains an electronic device capable of engaging in electronic communication"). Such a requirement was opposed by business associations and technology vendors, who argue that they already have labeling conduct codes in place through organizations such as EPCglobal.

Wash. State Representative Jeff Morris

The revised bill would make it a Class C felony to intentionally read the data encoded to an RFID tag in possession of a person without that individual's knowledge and consent, for the purpose of fraud, identity theft or some other illegal or unapproved purpose—a process known as "skimming." With this bill, skimming refers to capturing personal data about a tag's holder, such as the details on a loyalty card, driver's license or other identity card. It does not refer to capturing data from EPC RFID tags attached to products that do not hold the consumer's data. Class C felony in Washington State has a maximum penalty of five years in prison and a $10,000 fine. If the bill is signed into law, it would be the first legislation on the state level to make skimming a felony, says Morris.

On the other hand, use of data for marketing purposes, by a retailer would be a civil offense with a fine of up to $10,000 for each violation at the attorney general's discretion.

If, for example, a consumer holding an RFID-enabled loyalty card from one store enters a second store, that second store could not make use of the data stored on the loyalty card under the bill. Also, when a consumer applies for a loyalty card or other identification card containing an RFID tag, the application process must inform the consumer about the use of RFID technology and the user would need to sign that notification to indicate acceptance.