EC Publishes RFID Privacy Policy Draft

What's more, Board notes, the policy currently fails to make a distinction between RFID tags that are permanently attached to products—and, in some cases, could be used in the product's operation—versus those attached to hangtags or packaging that will be removed from the product.

Gérald Santucci, head of the Information and Communication Technology (ICT) for Enterprise Networking unit of the Information Society and Media Directorate-General, says that in writing the draft policy, the Directorate-General worked closely with a group of RFID experts. These included EPCglobal members, Santucci says, as well as technology vendors, privacy law experts and advocates.

"I can tell you that in the more than six months of debate, the question of whether making [the deactivation of RFID tags] an opt-in or an opt-out scenario was a contentious matter," Santucci states. "People have different points of view on this; some have economic interests and others have social considerations, and you need time to work it out."

Today, Santucci adds, with few retailers in the EU using RFID tags at the item level, and no significant use of the technology at the point of sale, the scenario described in Article 7.3, in which retailers may need to deactivate the tag at the point of sale, is unlikely. Still, he says, the recommended policy is the means by which the commission believes it can remain in line with the EU's existing privacy laws regarding the electronic sharing of personal information.

In addition, Santucci says, an important element of the draft is Article 7.5, which states: "Within three years after the entry into force of this recommendation, the European Commission will review these provisions in order to assess the effectiveness and efficiency of systems to remove or deactivate tags with a view to providing automatic deactivation at the point of sale on all items except where the consumer has specifically opted-in to the RFID application." The background to this statement, according to Santucci, is that the EC is also funding research to develop RFID tags that can be deactivated and reactivated, so that consumers and retailers will no longer need to choose one scenario over the other.

"In Europe, there is a visible lack of trust in new technologies," Santucci says. "That is a fact. So we need to demonstrate the benefits of RFID and its uses. But where [the technology] shows any risk to privacy, we need to offer means of self-regulation." This, Santucci adds, is a preferred course to enacting laws.