Canadian Privacy Commissioners React To Radio Frequency Identification Technology

Originally published in Blakes Bulletin on Privacy Law, August 2006

In the first six months of 2006, the Ontario, Québec and Federal privacy commissioners published reports on privacy implications of Radio Frequency Identification (RFID) technology. In addition, the British Columbia Commissioner’s office recently announced its intention to publish a guidance document on RFIDs within the next year. Canadian businesses will want to be aware of these far-reaching comments when considering RFID technology.

RFID tags are tiny pieces of material containing a microchip unit and a radio antenna that can be attached to products. They transmit an identifying number to a reader which, in turn, links to a computer database where information about the item is stored.

According to the Office of the Privacy Commissioner of Canada, many public and private sector organizations are either using or planning to use RFID technology for a multitude of purposes such as supply chain management and product integrity.

The recent publications from the Federal and Québec privacy commissioners outline the general privacy concerns surrounding RFID technology and issues that organizations should consider when choosing to implement such technology. However, the Information and Privacy Commissioner of Ontario (IPC), in particular, published comprehensive RFID Privacy Guidelines (Guidelines) and "tips" for implementing the Guidelines.

According to the IPC, RFID tags deployed in internal supply chain management, where they are not linked to any individual, pose little threat to privacy. Rather, privacy concerns relate to how RFIDs can be deployed to track consumers through the individual items that they purchase, and the potential for continuous surveillance. Even if an RFID tag does not contain any personal information, personally identifiable information may be created if the tag data is linked to a particular individual, such as through the purchase of a "tagged" item made with a credit card.

"I want to ensure that the deployment of RFID tags in the supply chain management process is separated from their use in the consumer space," said Dr. Ann Cavoukian, Ontario’s Information and Privacy Commissioner. "It is only the latter that poses a potential threat to privacy, and that is precisely why we drafted these Guidelines well in advance, to prevent such a privacy threat from arising."

The Guidelines are based on the 10 principles of the Canadian Standards Association Privacy Code, which serve as the basis for Canadian privacy laws across Canada. As such, the Guidelines potentially have relevance for all organizations in Canada.

The Guidelines specify that organizations must effectively identify and communicate to each individual, the purposes for collecting, linking to, or allowing linkage to personal information and that the purposes should be reasonable, specific and limited. Further, organizations must seek individual consent prior to collecting, using or disclosing personal information linked to an RFID tag. Such consent must be based upon an informed understanding of the existence, type, locations, purposes and actions of the RFID technology and the information used by the organization.

According to the Guidelines, automatic deactivation of RFID tags at the point of sale should be the ultimate goal of organizations. In addition, consumers should be able to choose to re-activate them at a later date (for example, to take advantage of warranty services), or otherwise exercise control over the manner in which the tags interact with readers.

The Guidelines state that organizations should protect personal information linked to RFID tags, including ensuring that the tags are not read by unauthorized parties or readers, and that all linkages between the tags and consumer information are minimized and kept secure. Finally, upon demand, organizations must provide the consumer with a full account of all uses and disclosures of RFID-linked personal information.

The use of RFID technology remains controversial and is still in its relative infancy as it relates to consumer information. It remains to be seen whether the Guidelines will further the IPC’s goal of preserving consumer trust and confidence.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.