Feb 01, 2006For the past 30 years, governments, businesses and privacy advocates have been trying to define what personally identifiable information about individuals could be collected and under what circumstances. A set of generally accepted principles, called the fair information practices, has evolved. These principles are so well known that they are often communicated in shorthand—notice, choice, consent, minimization, access, security and accountability.
Fair information practices have served as a backdrop for discussions about RFID and privacy. While there has not always been agreement about how to apply them, they are always part of the debate. The principles reflect a model of a centralized data collector and a knowledgeable data subject engaged in a dialogue about the "what" and the "why" of the proposed collection. But a number of technological developments suggest that it's time to reexamine how these principles are implemented.
|
|
First are the continuing advances in the gathering, transporting, storing and processing of digital information—all more efficient and cheaper, by orders of magnitude, than when the principles began to emerge in the 1970s. Intelligent devices are becoming smaller, more capable and, due to the Internet, increasingly interconnected.
Then there is the explosion of radio-based technologies such as RFID, which potentially allows every object to communicate; GPS, which allows us to know the location of these objects; and sensor networks, which can capture and broadcast data on everything from the structural integrity of a levee to movements in a building or the presence of weapons of mass destruction.
All told, these radio-based technologies allow us to bring together the physical world and the cyberworld. But they also let us capture data without providing any indication that collection is taking place, and they present an opportunity for interception by unauthorized parties.
|
|
By the year 2015, one forecast predicts, as many as one trillion sensors will be deployed. This is not the world of centralized data collectors politely asking permission from data subjects. It is a seemingly chaotic world with billions of data collectors that may be always on, collecting information without any obvious centralized control or any apparent cues about their collection activities. It is a world where networks do not stand alone but are interconnected, and data is shared among multiple parties and potentially reprocessed for multiple new purposes. It is a world where it will be more difficult to know who is gathering what data, who has access to it, what is being done with it and who should be held responsible for it.
That world is not here yet. But we should begin to think now about how privacy principles will be affected by genuinely pervasive computing. A group such as the Organization for Economic Cooperation and Development (OECD), which played an important role in developing the fair information practices by bringing together governments, businesses and civil society, could play an equally important role in initiating this work.
We must still work hard to address RFID privacy issues today so we can harvest its benefits. But we should also anticipate the future so that we are prepared for tomorrow.
Elliot Maxwell is a fellow of the communications program at The Johns Hopkins University, a distinguished research fellow of the eBusiness Research Center of Pennsylvania State University, and a consultant to various organizations.