California’s state senate passed a measure on Thursday to set limits on the use of RFID technology by libraries, retailers and other private entities. In three other states, legislators have announced plans to draft bills or conduct studies to address the impact of RFID technology on consumer privacy.
Sponsored by Senator Debra Bowen (D-Redondo Beach), the California bill passed the state’s senate on a 22-9 vote. Known as SB1834, the bill would prohibit businesses and libraries in California from using RFID tags attached to consumer products or using an RFID reader that could be used to identify an individual, unless they comply with certain conditions: The information collected via RFID can only be in regard to items customers actually are buying, renting or borrowing. Information can’t be collected on what customers may have picked up but put back prior to a transaction, on what they’re wearing or on items they are carrying in a wallet or purse.
A previous version of the bill also called on businesses to detach or destroy any RFID tags that are attached to a product purchased by a customer before that customer leaves the store, and also required that businesses obtain written consent from an individual before any personally identifiable information is attached to data collected via RFID. But those requirements, along with several others, were deleted from the amended version of the bill that passed the senate. According to a Bowen office spokesperson, the current bill does not mandate that tags be disabled after purchase of an item. The California bill is now headed for the Assembly Policy Committee in June, before going to the assembly floor.
Meanwhile, other state legislators are taken steps to clarify the ways RFID technology can be used. Maryland’s House of Delegates is establishing a task force to study the use of RFID tags by retailers and manufacturers. On Tuesday, Massachusetts State Senator Jarrett Barrios (D-Cambridge) announced he is drafting legislation that would regulate the use of RFID, according to Information Week. The magazine reported that the bill would likely require stores to notify consumers when RFID technology is being used on items they are purchasing, give consumers the chance to opt out of using the technology at the point of sale, and allow consumers to have the RFID tags disabled prior to a purchase.
On May 26, the Virginia Joint Commission on Technology and Science (JCOTS) will consider whether to study “invasive technologies,” including RFID. At the request of Virginia Delegate L. Scott Lingamfelter (R-31st District), JCOTS agreed to consider the issue as part of its proposed work plan for 2004 and, if approved by the JCOTS members, carry out the study. For the purposes of the study, invasive technologies are defined as those that have the potential to infringe on the civil rights of individuals. JCOTS, which consists of 12 legislators from the Virginia General Assembly (7 delegates and 5 senators), would look at a number of other technologies, including facial recognition systems, hidden cameras, spyware and Internet wiretaps.
“The focus of this study is to come up with rational guidelines that legislators can refer to,” Lingamfelter says. “I have asked them [JCOTS members] to show legislators the kinds of things they need to use as a guideline,” he says. The goal of those guidelines is provide enough information about specific invasive technologies so that Virginia lawmakers could make appropriate legislative decisions about them. Lingamfelter says the study will include details on what benefits the technologies can offer to law enforcement, as well as what disadvantages they pose, such as violation of privacy. The delegate’s primary concern is in ensuring law enforcement has access to technologies it needs, without violating civil rights.
Lingamfelter has sponsored a bill (HB 1304), which will be considered by the house in the 2005 session, that will require any state public body to conduct a privacy-impact analysis of any new invasive technology before authorizing or prohibiting its use. Lingamfelter hopes that, assuming that JCOTS decides to undertake the study, JCOTS will issue a report by the beginning of the 2005 session, when the legislature considers HB1304.
“The confusion [about whether existing technologies violate individuals’ civil liberties] is already there,” he says. “I would hope we would have guidelines soon.”
The bill evolved from another bill, sponsored by Delegate H. Morgan Griffith (R-8th District) but defeated in 2002 and 2003 in the state senate, that would control the use of facial recognition technology. Griffith joined Lingamfelter to sponsor HB1304, a broader bill that includes all invasive technologies.
“I have great concerns,” Griffith says, about the impact on civil liberties of the technologies being studied.