Mar 10, 2005The U.S. Federal Trade Commission says it will leave it to retailers and the RFID industry to educate consumers about use of radio frequency identification and data collected using the technology.
The agency's finding are part of a report entitled RFID: Applications and Implications for Consumers, which draws on FTC research and on information presented at the one-day RFID workshop held by the FTC in Washington last June.
The agency says that for now, it will allow companies that make and use RFID technology to regulate themselves regarding consumer privacy. However, the FTC did not rule out the possibility of issuing guidelines in future.
"Our main objective is to monitor what is going on and to ask questions where appropriate. We will also keep an eye on self-regulation and how it is working," says Julie Brof, attorney at the FTC who helped organize the RFID workshop and write the FTC report.
The agency has also concluded that many of the potential privacy issues associated with RFID are inextricably linked to database security. Companies using RFID to collect and augment personal consumer data must therefore adhere to existing FTC guidelines on implementing reasonable and appropriate measures to protect that data.
"There is a realization that what we are talking about is largely database security and not just something specific to RFID," Brof says.
The FTC's hands-off approach drew support from some legal experts, although they worried that other governmental bodies could still potentially impede the deployment of RFID by adopting rules and laws aimed at addressing consumer privacy concerns.
"If [the FTC had issued guidelines] and businesses agreed to honor them, the states might conclude that additional privacy laws are unnecessary, and the rush to introduce them could cease," says Ronald E. Quirk, an attorney at Washington, D.C., office of legal firm Venable LLP.
The June workshop brought together a range of participants, including RFID developers and consultants Philips Semiconductors, Texas Instruments, Intel, Sun Microsystems, Accenture and CapGemini; retail and RFID trade organizations EPCglobal, the Grocery Manufacturers of America and the National Retail Federation; advocacy groups such as the Electronic Frontier Foundation, the Electronic Privacy Information Center and CASPIAN (Consumers Against Supermarket Privacy Invasion and Numbering); and RFID users including Marks & Spencer, Procter & Gamble and Wal-Mart.
Despite calls from the Electronic Privacy Information Center (EPIC) that the FTC issue guidelines for use of RFID devices in the private manufacturing and retail sector, the FTC instead believes that RFID policies and public-education campaigns like those adopted by Marks & Spencer in the U.K. and Wal-Mart in the U.S. can serve as models for how the industry should educate consumers about RFID tags on their purchased items.
For example, in an ongoing trial where selected garments have RFID labels attached, Marks & Spencer does not record which customers purchased which specific items of apparel, and the retailer also gives an informational brochure about RFID tags to each consumer who buys a tagged item. (See U.K. Trial Addresses Privacy Issue).
In the FTC report, the agency says it will encourage industry-led initiatives where retailers and manufacturers provide clear notices for consumers whenever RFID tags are being used and outline what data will be collected and what it will be used for. The FTC also states that any industry self-regulatory program should include meaningful accountability provisions to help ensure compliance.
The FTC says it will continue to monitor the development and deployment of RFID, and that as item-level RFID tagging becomes more prevalent, the agency will work to develop programs that educate consumers about RFID technology.
A copy of the FTC's report, which includes a detailed account of the FTC workshop and other information, can be downloaded from the agency's Web site, www.ftc.gov.
