Canadian RFID Guidelines Aimed at Protecting Privacy Released

June 23, 2006

Ontario's Information and Privacy Commissioner Dr. Ann Cavoukian released Privacy Guidelines for Radio Frequency Identification Systems (RFID) Information Systems. These guidelines flow from her earlier work in 2003 when the commissioner identified the potential privacy concerns raised by RFID technology.

"I have always found it beneficial to assist those working on emerging technologies and to be proactive whenever possible - to develop effective guidelines and codes before any problems arise," said Cavoukian. "These made-in-Canada guidelines provide guidance and solutions regarding item-level consumer RFID applications and uses."

EPCglobal Canada is collaborating with the Association Connecting Electronics Industries (IPC) in the development of these guidelines and will be seeking board approval by its member companies to signify the association's endorsement of the guidelines.

RFID tags may be read from a distance, making them valuable for managing inventory but pose potential risks to privacy if linked to personal identifiers. Although RFID technology deployed in the supply chain management process poses little threat to privacy, item-level use of RFID tags in the retail sector, when linked to personally identifiable information, can facilitate the tracking and surveillance of individuals. The goal of these guidelines is to alleviate concerns about the potential threat to privacy posed by this technology and to enhance openness and transparency about item-level use of RFID systems by retailers.

The guidelines are based on three principles that include:

• Focus on RFID information systems, not technologies: The problem does not lie with RFID technologies, but the way in which they are deployed that can have privacy implications. The guidelines should be applied to RFID information systems as a whole, rather than to any single technology component or function.
• Build in privacy and security from the design stage: Privacy and technological concerns must be identified in a broad and systemic manner. A thorough privacy impact assessment is critical. Users of RFID technologies and information systems should address the privacy and security issues in the design stages, with an emphasis on data minimization. Efforts should be made to minimize the identifiability, observability and linkability of RFID data.
• Maximize individual participation and consent: Use of RFID information systems should be open and transparent and afford individuals with an opportunity to participate and make informed decisions.

A companion piece to the guidelines - Practical Tips for Implementing RFID Privacy Guidelines - is also being released to help organizations put the guidelines into practice.

Source: Office of the Information and Privacy Commissioner/Ontario.