Jan 13, 2009The Washington State House of Representatives is reviewing a package of bills this week that would require greater disclosure on the part of RFID technology end users, in order to alert consumers as to when the technology is being used. This is the second time such legislation has made the rounds in that state; similar legislation failed to pass through Washington's senate last year.
In March 2008, however, the state passed the nation's first law, House Bill 1031, targeting criminals who might use an RFID reader to capture information regarding an individual by reading the tags in his or her possession. HB 1031 made it a Class C felony to read data on RFID tags without that individual's knowledge and consent, for the purposes of committing fraud, identity theft or other illegal activity (see Washington State Governor Signs Anti-Skimming Law).
Both last year's bill and the newly introduced legislation were sponsored by Rep. Jeff Morris (D-Mount Vernon). Two of the three 2009 bills, HB 1006 and HB 1011, would require manufacturers and stores to notify consumers whenever RFID chips are embedded in products they purchase—or in the packaging of those items—and to provide consumers who apply for an RFID-enabled loyalty card with a printed notice they would read and sign to indicate they understand there is an RFID chip embedded in that card. A public hearing in the House Committee on Technology, Energy and Communications is scheduled for Wednesday morning.
Much of the language in HB 1006 and HB 1011 was included in an early version of HB 1031 that the House passed in 2008, but that was subsequently rejected by the Senate. Some of the language that led to the bill's rejection—including a requirement that all RFID tags be disabled or removed from products when consumers purchased an item—has been removed from the new legislation, Morris says.
This year, Morris notes, the bills are more likely to pass because the Senate has gained a better understanding of RFID technology since 2008, and will have more time to review the bill before voting.
Specifically, HB 1006 requires all RFID-tagged products to bear a universal, clear and conspicuous label—recognizable by the public—to indicate RFID technology is being utilized. That would not be required if the RFID tag were deactivated or removed at the point of sale.
The second bill, HB 1011, prohibits government agencies or businesses from reading an RFID tag in an individual's possession without first obtaining that person's opt-in consent. This would include the reading of a tag embedded in a loyalty card or other type of ID card that might be scanned by a store for marketing purposes. That consent, the bill stipulates, must be provided either in writing or electronically. In addition, HB 1011 requires the state's attorney general to make annual recommendations to legislators regarding "personally invasive technologies" that might warrant further legislation to protect privacy. The bill makes an exception to this opt-in requirement, however, for the scanning of RFID tags during such medical emergencies as triage or medical care during a disaster.
Finally, HB 1044 directs the Washington State Information Services Board to develop privacy standards for state agencies employing RFID technology. The bill would provide the board with oversight regarding the use of RFID by state agencies. This is especially relevant in Washington because that state's Department of Licensing is already using RFID in enhanced driver's licenses.
The Department of Licensing provides participants with details about the RFID technology being used, both in literature and on its Web site, but is not required to do so. It began issuing enhanced driver's licenses containing passive Gen 2 RFID tags in January 2008 for those looking to utilize the technology for crossing the border into British Columbia. In July 2008, however, the American Civil Liberties Union (ACLU) argued that the licenses posed security risks since they have the potential to be cloned, as well as be to read clandestinely. To reduce such risks, the U.S. Department of State provides RF-shielding sleeves that users can request, in order to block RFID transmissions when the card is not being used at border crossings.
"I think by legislating labeling," Mullen says, "you're creating the potential for a whole set of problems." One problem, he adds, could be the burden such a mandate could have on product suppliers, who would have to label products sold in Washington State, but not in the other 49 states. The concern for Washington consumers and businesses, Mullen indicates, would be that the legislation could discourage vendors from selling products within that state.
"We're not against a universal emblem for RFID," Mullen says, noting that AIM has developed a label that is largely utilized in industrial applications to help RFID users locate a tag's position on an object. However, he adds, the use of an emblem or other labeling should not be mandated.
The opt-in requirement may face some opposition from the cellular phone industry, which is developing phones that incorporate Near Field Communications (NFC) technology. Such phones contain RFID tags and interrogators to enable users to make contactless payments or download information onto their phones. However, Morris says, labeling only products for sale in the state of Washington should not be burdensome. Clear plastic labels, he explains, could be applied to phone packages by cellular phone employees in Washington's phone stores and kiosks.
If the three bills pass the House of Representatives, they will next head to the state Senate for review.
