Dec 08, 2003At its final board meeting in late October, the Auto-ID Center, a nonprofit research organization that developed the Electronic Product Code (EPC) and related technologies, adopted policy guidelines aimed at protecting consumer privacy. Those guidelines were passed on to EPCglobal, a joint venture set up by the Uniform Code Council and EAN International to commercialize EPC technology. Jack Grasso, a spokesperson for EPCglobal, said last week that the guidelines would evolve as necessary to protect consumers.
"We view this as an organic document that will change and grow as it needs to to address the concerns of the marketplace and of consumers as the technology nears reality," he says. "We're in the Kitty Hawk stage in the rollout of this technology. A lot of the information that's out there, relative to privacy, speaks of it as if it is in the Supersonic Transport stage."
The broadly stated guidelines cover four main areas:
1. Consumer Notice: Consumers will be clearly notified of the presence of EPC tags on products or in packaging through the use of an EPC logo or identifier on the products.
2. Consumer Choice: Consumers will be informed of their options to discard, disable or remove EPC tags from the products they acquire.
3. Consumer Education: Consumers will have the opportunity to easily obtain accurate information about EPC and its applications, as well as information about advances in the technology.
4. Record Use, Retention and Security: As with conventional bar code technology, companies will use, maintain and protect records generated through EPC in compliance with all applicable laws. Companies will publish, on their Web sites or otherwise, information on their policies regarding the retention, use and protection of any consumer-specific data generated through their operations, either generally or with respect to EPC use.
Right now, no mechanism exists for enforcing these guidelines, which are communicated to all companies that subscribe to EPCglobal and want to use EPC technology to track goods. But Grasso points out that most companies are many years away from using EPC tags on consumer items, so it's premature to implement an enforcement mechanism.
"How the structure may look in terms of enforcing compliance with the guidelines is as yet undefined," he says. "We haven't codified it yet because it's a moot point at this time."
Kevin Ashton, the former executive director of the Auto-ID Center, says the guidelines should be seen as a first step. "It's important to understand that having a principled approach to policy is not the end of the process," he says. "The real value of agreeing to principles is it provides a framework for implementation. The next piece of work that has to be done is to answer the implementation question: Specifically, what is the detail on policy and how do you administer it? And what does the technology have to be able to do to make sure the principles are adhered to?"
To provide it with advice on privacy matters, EPCglobal has decided to keep the International Public Policy Advisory Council established by the Auto-ID Center. In addition, EPCglobal has set up a committee of subscribers to work actively on ensuring that privacy concerns are addressed.
"Nothing we are doing to help implement RFID is more important than the privacy issue," says Grasso. "If the technology is to deliver the promised benefits, it has to be implemented in a responsible way. That's what we are committed to doing."
