This article was originally published by RFID Update.
January 28, 2009—New York is the latest state to take legislative active to regulate RFID use. Earlier this month Bill A00276, the “Radio Frequency Identification Right to Know Act,” was introduced in the state assembly. The bill would establish several requirements for retailers who carry RFID-tagged merchandise, including informing consumers about the tags and removing them after products are sold, and specifies restrictions on how RFID data can be collected and disclosed.
The bill has been referred to the legislature’s Consumer Affairs and Protection Committee and has not been scheduled for a vote. It is proposed to take effect in January, 2011. The bill was introduced by state assemblywomen RoAnn Destito and Audrey Pheffer.
At least 28 states have passed or introduced legislation to regulate RFID use (see Washington RFID Law Could Pave Way For More). These efforts largely fall into two general categories: retail-oriented regulations like the New York bill that focus on tagged retail products, and identity-protection measures designed to specifically ban skimming information from RFID-enabled driver’s licenses, passports and other identity documents.
Notable provisions in the New York bill include:
- “Mercantile establishments” that sell RFID-tagged merchandise must prominently display signs to inform consumers.
- Packaging of RFID-tagged products must clearly indicate an RFID tag is included in the product or package.
- Upon request, businesses must provide consumers with RFID-related information from their items on request, and give consumers all stored personal information that was gathered by RFID.
- Businesses may not identify consumers by RFID.
- Businesses may not aggregate information collected by RFID with the consumer’s personal information.
- Businesses may not disclose information captured by RFID to third parties.
- RFID tags must be removed or deactivated at the point of sale following a purchase.
- Businesses cannot require customers to keep tags activated to keep products eligible to be returned, exchanged or serviced.
- Tags may not be reactivated without customer permission.
- Consumers do not have to show they were damaged by the lack of disclosure or tag deactivation for retailers to be found in breach of the law.
- Businesses can be fined up to $500 for each violation.
The disclosure requirements essentially match the voluntary Guidelines for EPC on Consumer Products that RFID standards organization EPCglobal established in 2005.
To date there have been no known identity thefts or other consumer privacy breaches related to RFID tagged products. Many legal and technology experts feel existing laws cover such abuses and RFID-specific laws are not necessary.
If passed, New York’s proposal could have unintended consequences. For example, preventing retailers from requiring functioning RFID tags on items presented for return or service could undermine the use of RFID to prevent product counterfeiting, diversion and return fraud. The ban on linking data collected by RFID with personal information about the shopper could limit the effectiveness and popularity of opt-in customer rewards programs, and establishes a restriction that does not exist for bar code scanning at the point of sale. The restrictions on sharing personal information would seem to rule out the use of RFID-enabled loyalty cards.
The New York bill specifically regulates business use of RFID and does not address skimming or identification documents. Last September New York became one of the first states to offer driver’s licenses with optional RFID tags (see RFID Driver’s Licenses Gain Traction in the US).