Legal Implications of Using RFID Highlighted

The U.S. Department of Homeland Security (DHS) will use RFID chips on a trial basis to track the arrival and return of visitors from abroad. The testing phase, which will begin this spring and is expected to last one year, will occur at selected points of entry across the U.S., and it will complement the current U.S.-VISIT scheme.

The U.S.-VISIT scheme, which entails fingerprinting visitors, has encountered criticism, and to date more than 400 people have been refused entry or arrested as a result of this scheme.

Although the exact way that the RFID chips will be implemented is not yet known, they will be used to track pedestrians and vehicles entering the U.S. This move by the DHS is yet anther example of the growing use of RFID technology.

Business Issues Related to Using RFID

The key business implications related to the implementation of RFID technology relate to (i) cost of implementation; (ii) supply chain management; and (iii) improvements in consumer service.

Despite the fact that the cost of RFID tags is declining, and will continue to decline due to economies of scale, the cost of the tags only represents a very small fraction of the overall cost to implement an RFID system. Currently the cost of passive RFID tags is approximately 40 cents, and if the tags are active, the cost per tag might increase to a few dollars.

The major cost in implementing an RFID system for a business consists of the expenditures related to the data management system and software. A business implementing such a system might end up spending anywhere from 50 percent to 80 percent of the total implementation budget on these costs.

One reason, among others, why the data management expenditures are quite high is that organizations will have to re-engineer their business processes so as to align and configure their existing systems to incorporate the RFID system. System integration from the front to back end will be necessary to achieve the full benefits of RFID technology.

Given that there are significant capital costs in implementing a RFID system, it is easy to see why large retailers such as Wal-Mart, Albertson or Home Depot are leading the initiative.

Supply Chain Efficiency

For those businesses that implement RFID systems, it is expected that these high upfront capital costs will be offset and eventually result in gains due to improvements in the supply chain management system. Businesses incorporating RFID technology expect to achieve significant reductions in costs by having, among other things, a more efficient inventory management system, tracking system and reduced theft or loss.

Aside from the benefit to the consumer of reducing business costs (assuming that these savings will be passed down to consumers to some extent), RFID-enabled businesses, especially those in the retail sector, will be able to provide improved consumer service. This improved service will come in the form of being able to identify consumers’ preferences by tracking the types of purchases individual consumers make.

RFID technology, when implemented at the individual item level, provides an enormous amount of data collection. This information can be used in effective ways to identify market and individual purchasing trends. It can also be used to execute very effective and tailored marketing practices and campaigns.

Legal Implications of Using RFID

The most important legal aspect of using RFID technology relates to the infringement of individual privacy rights. RFID systems have the potential to track individuals in an unprecedented manner. If tags are placed on bags, clothing, cosmetic products, or any single retail item for that matter, information about the item can be linked to the purchaser to provide a more complete consumer profile.

For example, when a RFID tag is read, information from the tag could be linked to a purchaser’s financial information if the product was purchased with a credit card or loyalty card. Moreover, it is possible for a reader to read tags covertly without the consumer’s knowledge. It is also possible that a reader can be set up to read tags from other stores. This means that a reader might be able to determine the contents in a consumer’s purse or bag without the consumer even being aware.

Further and aside from the possibility of tracking consumers in the marketplace at anytime or anyplace, which in itself raises significant privacy concerns, RFID tags can be used to track “sensitive-type” items such as pharmaceutical products or even currency. If tags are left active, government and industry can track how you use your money, and what kinds of pharmaceuticals you take.

This presents significant legal problems as our health, financial and other types of “sensitive” information is not normally allowed to be collected, used or disclosed without our consent.

Children’s Privacy

Another privacy concern in using RFID tags relates to children. As most companies such as retailers are aware, children represent a significant segment of the consumer market, even if they are not the ultimate purchaser of products. However, tracking and profiling children raises significant legal problems since different rules regarding the collection, use and disclosure of information apply to children.

Although the issue of tracking and profiling consumers is frequently mentioned when discussing RFID technology, this technology also has enormous legal implications in the area of employee privacy. A RFID system could potentially track the whereabouts of an employee in the workplace at all times. This presents significant concerns as employee privacy might be significantly eroded with the onset of this technology.

In many jurisdictions including most of, if not all of, the jurisdictions in Canada and the U.S., the collection, use and disclosure of RFID data will have to comply with existing privacy laws.

Therefore, when a company amasses data through the use of RFID, it will have to do so in accordance with these laws, which means that they will have to obtain the appropriate consent depending on their local legal requirements for the various kinds of personal information they are collecting using RFID. It also means that these companies will have to take the appropriate safeguards to protect such personal information.

Based on the foregoing, any organization contemplating the use of RFID should start by ensuring that it is aware of its privacy obligations under different laws before it starts accumulating data that can come back to haunt it later if it has not been collected in accordance with legal requirements.