02/27/2004: Technologica
Lawmakers Alarmed by RFID Spying
from Wired
Lawmakers in several states this week are preparing rules to prevent Wal-Mart and other companies from using radio-frequency identification tags to spy on their customers.
In statehouses in Utah and California, and at the Federal Reserve Bank of Boston, legislators and regulators discussed how retailers and government spies might use the data gathered from RFID tags to monitor consumers.
Utah's House of Representatives passed the first-ever RFID privacy bill this week, 47-23. Utah state Rep. David Hogue said that without laws to ensure consumer privacy, retailers will be tempted to match the data gathered by RFID readers with consumers' personal information.
"The RFID industry will carry the technology as far as they can," said Hogue, sponsor of the Radio Frequency Identification Right to Know Act. "Marketing people especially are going to love this kind of stuff."
Utah's Right to Know Act is based on federal legislation drafted by the consumer privacy group Consumers Against Supermarket Privacy Invasion and Numbering, or CASPIAN. It requires all goods bearing functioning RFID tags in stores to be labeled as such. The bill will take effect May 5, 2005, if it is approved by the Utah state Senate and Utah Gov. Olene S. Walker.
More
California state Sen. Debra Bowen also introduced a bill intended to keep the data from RFID tags separate from consumers' personal information.And officials at the Federal Reserve Bank of Boston this week met with consumer advocates to learn how the information gathered from RFID tags might be used to monitor shoppers' movements and buying behavior.
By matching an RFID tag's unique electronic product code to a customer's loyalty card or credit card, a retailer could track a shopper's movements, and tailor its marketing pitches to whatever the customer is wearing or to the items in his or her cart.
CASPIAN director Katherine Albrecht also warned officials at the Federal Reserve that spies may want to track citizens with ubiquitous RFID readers embedded in public spaces. The readers could recognize tags that have been hidden inside shoes and other garments by manufacturers, she said.
Some lawmakers now say that RFID tags in retail items may further erode consumers' privacy. "There is clearly an upside for the industry," said Massachusetts state Sen. Jarrett Barrios, "but underlying that is a burden borne by the consumers. It's unnerving to me that the companies have no incentive to protect consumer privacy."
Barrios, who sponsored an aggressive antispam bill that passed the Massachusetts Senate last year, said he is concerned by any technology that threatens consumers' privacy. "And if the past is any indication," he said, "it will again (in the case of RFID tags) be up to legislators to protect consumers' personal information."
Wal-Mart, Procter & Gamble and Gillette want to use RFID tags to track every bottle of shampoo or packet of razor blades from the factory floor to the store shelf. RFID readers on so-called smart shelves in Wal-Mart will tally the shelves' contents continually, and make more-precise requests for inventory from the retailer's suppliers.
Retailers will have fewer empty shelves, and suppliers will eliminate wasteful overproduction of their goods, say proponents of RFID.
But shoppers are wary of RFID tags since Wal-Mart was caught secretly experimenting with the tags in its stores in Brockton, Massachusetts, and Broken Arrow, Oklahoma, last year. "Some companies naively thought that privacy would not be an issue for consumers," said Mark Roberti, editor of RFID Journal, an RFID trade publication.
None of the retail tests of RFID tags invaded the privacy of shoppers in the Wal-Mart stores, Roberti said. He also said that RFID chips in building security passes and toll-booth tags have never been used to invade a citizen's privacy.
EPCglobal, which sets the technology standards for RFID tags in retail and in the supply chain, is promoting its own privacy policy and appointing a full-time policy executive to oversee privacy issues.
But privacy advocates do not trust retailers and suppliers to police themselves.
RFID technology is a surveillance tool that clearly can be misused, said Barry Steinhardt, director of the Technology and Liberty Program at the American Civil Liberties Union. "To protect consumers, we need laws, not unenforceable policies," he said.
3 Annotations Submitted
Friday the 27th of February, awiggins noted:
Match the shopping data gathered with consumers' personal information. Isn't that what they are doing with your Stop and Shop card? The only difference is that the supermarket card programs are voluntary whereas the RFID schemes would not be.
Friday the 27th of February, prof noted:
that's a big difference
Friday the 27th of February, santo26 noted:
I refuse to get a CVS card because I don't want a consumer database to know what kind of pharmecutical products I buy. I do, however, have a Stop & Shop card, so someone is aware of what I eat. What information is more intimate? Since I need to continually buy food, I feel I need the Stop & Shop card because if I did not, I would pay $5- 10 more per shopping trip. So why are those who refuse to "play along" with these stores forced to pay more than those who do? What a horrible scam.