By Elliot Maxwell

Feb. 1, 2006—For the past 30 years, governments, businesses and privacy advocates have been trying to define what personally identifiable information about individuals could be collected and under what circumstances. A set of generally accepted principles, called the fair information practices, has evolved. These principles are so well known that they are often communicated in shorthand—notice, choice, consent, minimization, access, security and accountability.

Fair information practices have served as a backdrop for discussions about RFID and privacy. While there has not always been agreement about how to apply them, they are always part of the debate. The principles reflect a model of a centralized data collector and a knowledgeable data subject engaged in a dialogue about the "what" and the "why" of the proposed collection. But a number of technological developments suggest that it's time to reexamine how these principles are implemented.


First are the continuing advances in the gathering, transporting, storing and processing of digital information—all more efficient and cheaper, by orders of magnitude, than when the principles began to emerge in the 1970s. Intelligent devices are becoming smaller, more capable and, due to the Internet, increasingly interconnected.