New EC Recommendation on Smart Chips Respects Privacy Rights
May 13, 2009 // Published as a news service by IHS
On May 12, the European Commission (EC) adopted a recommendation to ensure that everyone involved in the design or operation of radio frequency identification (RFID) technology respects an individual's fundamental right to privacy and data protection, as contained in the Charter of Fundamental Rights of the European Union proclaimed on Dec. 14, 2007.
According to the EC, Europeans should be able to have control over RFID tags, or smart chips - a worldwide market set to grow five times larger over in the next decade - while still being able to easily use them to make everyday life simpler.
There are already over 6 billion smart chips, microelectronic devices that can be integrated into a variety of everyday objects, ranging from refrigerators to bus passes.
With RFID technology, these chips can process data automatically when brought close to readers that activate them, pick up their radio signal and exchange data with them. Such chips are in the passes used to enter offices and the smart cards that pay highway tolls.
Smart chips can, and already do, have a huge impact on business tasks, public services and consumer products, from more efficient recycling and health care to less time spent at toll booths and waiting for luggage at the airport.
To make sure Europe is ready for these changes, the EC's May 12 recommendation laid out the following principles for protecting privacy and data protection in their use:
- Consumers should be in control whether products they buy in shops use smart chips or not. When consumers buy products with smart chips, these should be deactivated automatically, immediately and free of charge at the point of sale, unless the consumer explicitly opts-in by asking to keep the chip operational. Exceptions can be granted to avoid an unnecessary burden on retailers, for example, but only after an assessment of the chip's impact on privacy.
- Companies or public authorities using smart chips should give consumers clear and simple information so that they understand if their personal data will be used, the type of collected data (such as name, address and date of birth) and for what purpose. They should also provide clear labeling to identify the devices that read the information stored in smart chips, and provide a contact point for citizens to obtain more information.
- Retail associations and organizations should promote consumer awareness on products containing smart chips through a common European sign to indicate whenever a smart chip is used by a product.
- Companies and public authorities should conduct privacy and data protection impact assessments before using smart chips. These assessments, reviewed by national data protection authorities, should ensure that personal data is secure and well protected.
Over two billion RFID tags were sold worldwide in 2008, roughly one-third of these in Europe. The worldwide market value for RFID tags is estimated to be €4 billion in 2008 and to grow to about €20 billion by 2018.
"A promising technology for the future, smart chips can make life simpler in all sorts of ways. We are talking about everyday objects suddenly becoming smart by connecting to a network and exchanging information. Think of smart-fridges that inform you your milk is past its use-by date or smart-food packaging warning parents about possible allergies," said Viviane Reding, EC commissioner for information society and media.
"There is clear economic potential in using small, smart chips to allow communication between objects. But Europeans must never be taken unawares by the new technology. This is why the Commission issued strong recommendations to the industry today. European consumers must be confident that if and when their personal data is involved, their privacy will be impregnable also in a changing technological environment."
"The Commission therefore wants RFID technology to empower consumers to control their data security, which is the best way to make sure it is an economic success. After all, the European share of the global smart chips market will reach 35% in the next eight years," Reding added.
Background
In 2006, the EC launched a public consultation (see IP/06/289) on the development and use of RFID technologies. Based on this, it then adopted a communication in March 2007 (see IP/07/332) showing that further action was expected by the public in terms of privacy and data protection.
The May 12 recommendation - which was written after consulting all stakeholders from both the supplying and using industries, standardization bodies, consumers' organizations, civil society groups, and trade unions - responds to these expectations and seeks to create a level playing field for the European industry while respecting the privacy of individuals.
European Union member states now have two years to inform the EC on the steps they intend to take to make sure that the objectives of the recommendation are met.
Within three years, the EC will report on the recommendation's implementation, including an analysis of its impact on companies and public authorities using smart chips as well as its impact on citizens.
For more information, see the EC's web site on RFID and RFID: Radio Frequency IDentification: Frequently Asked Questions (MEMO/09/232).
Source: European Commission (EC).