By Ann C. Logue

At lunchtime on July 16, 2003, a confused driver plowed his car into California's Santa Monica Farmers' Market. He stepped on the accelerator instead of the brake, killing 10 people and injuring more than 50. The market is a few blocks from RAND Corp.'s headquarters and is a popular lunch spot for RAND staffers. As employees received news of the accident, they wondered if any of their colleagues were hurt. Using data collected through RFID employee access cards, managers were able to determine who had left the building before noon but had not returned. Then, they were able to go to those people's departments and find out why they were absent.

Fortunately, no one from RAND was injured; the folks who had not returned were scheduled to be out of the office that afternoon. But there was a surprising side effect to the incident. RAND is a nonprofit research organization that has many classified and other government projects, and employees were aware that for security purposes their access cards tracked their comings and goings from the building. Each RFID access card has a unique identifier that is associated with an employee.

While RFID access cards can be used to infringe on employees' privacy, they also provide faster and easier access to facilities because employees just have to flash the card by an interrogator.

What they hadn't realized was how the time and entry/exit data their RFID access cards generated could be used. RAND had never disclosed its data usage policies to employees, and after the incident, employees found there was not a policy document to guide RFID data use.