Who Owns and Controls the Data Stored on a Tag or Collected in Information Systems?

And what laws govern tag information ownership?

—Mark

———

Mark,

I was forwarded your question. I am unsure what laws or regulations, if any, govern ownership of the data on a tag, or in the RFID information systems in different jurisdictions, but let me try to answer the question by breaking it into two parts.

Who owns or controls the data stored on a tag?
In most cases, the company that applies an RFID tag to an item controls what is on that tag, and it might own some of the stored data as well. If you belong to GS1 and are using the Electronic Product Code (EPC) prefixes assigned to your company by that organization, then you own the serial number on the tag. If you write some information about a particular product to the tag, then you would own that as well.

A company commissioning EPC tags generally has control over the information on them (and on some other types of RFID tags as well), because memory can be locked when a tag is commissioned, or a business might decide to allow partners to use some of the tag's memory for their use. For example, a firm might write information to the memory about the retail DC to which an item should be shipped, so its shipping department could read the tags and direct the items to the proper DC. A company might also opt to let its retail partner write the particular store to which an item should go in the chip's on-board memory bank.

In the aerospace industry, companies are using high-memory tags to store parts histories. So an aerospace parts manufacture would affix a tag to a part and sell it to an aircraft manufacturer, which would then write details regarding when that part was installed on an airplane and when that plane was put into service. When the plane was sold to an airline, the airline would have control of the tag. The airline might hire a third-party maintenance company to maintain its aircraft. That company might remove a part, perform maintenance and reinstall it. Information about this procedure would be written to the tag by the maintenance company, but I believe the airline would own the data since it owns the plane and the maintenance company works for the airline.

Who owns the data that is collected on the tag?
That is a less clear-cut question. I would say the company that collects the data owns the data. So if Company A were to put tags on items and ship them to Company B, when Company B began reading the tags, it would own that data. It might or might not choose to share that information with Company A. Items might go through multiple owners while moving through the supply chain, or multiple service providers, with each owner capturing data.

I believe that if a company takes ownership of an item—say, if it buys it from a manufacturer in Asia and ships it to the United States to be resold—then it owns the data. If it is a service provider that a company hires, then the company can likely request information collected by that service provider. That could be part of the service agreement—that Company A would read the tags and hand the data over to Company B.

RFID is still a relatively new technology, and not very issue has yet been worked out. But so far, data ownership has not become an issue.

—Mark Roberti, Founder and Editor, RFID Journal