Originally published in Blakes Bulletin on Privacy Law, August 2006
Radio Frequency Identification technology continues to be a hot topic within the Canadian privacy community.
In the first six months of 2006, the Ontario, Québec and Federal privacy commissioners published reports on privacy implications of Radio Frequency Identification (RFID) technology. In addition, the British Columbia Commissioner’s office recently announced its intention to publish a guidance document on RFIDs within the next year. Canadian businesses will want to be aware of these far-reaching comments when considering RFID technology.
RFID and its potential uses
RFID tags are tiny pieces of material containing a microchip unit and a radio antenna that can be attached to products. They transmit an identifying number to a reader which, in turn, links to a computer database where information about the item is stored.
According to the Office of the Privacy Commissioner of Canada, many public and private sector organizations are either using or planning to use RFID technology for a multitude of purposes such as supply chain management and product integrity.
RFID privacy concerns and guidelines
The recent publications from the Federal and Québec privacy commissioners outline the general privacy concerns surrounding RFID technology and issues that organizations should consider when choosing to implement such technology. However, the Information and Privacy Commissioner of Ontario (IPC), in particular, published comprehensive RFID Privacy Guidelines (Guidelines) and "tips" for implementing the Guidelines.
According to the IPC, RFID tags deployed in internal supply chain management, where they are not linked to any individual, pose little threat to privacy. Rather, privacy concerns relate to how RFIDs can be deployed to track consumers through the individual items that they purchase, and the potential for continuous surveillance. Even if an RFID tag does not contain any personal information, personally identifiable information may be created if the tag data is linked to a particular individual, such as through the purchase of a "tagged" item made with a credit card.
"I want to ensure that the deployment of RFID tags in the supply chain management process is separated from their use in the consumer space," said Dr. Ann Cavoukian, Ontario’s Information and Privacy Commissioner. "It is only the latter that poses a potential threat to privacy, and that is precisely why we drafted these Guidelines well in advance, to prevent such a privacy threat from arising."
The Guidelines are based on the 10 principles of the Canadian Standards Association Privacy Code, which serve as the basis for Canadian privacy laws across Canada. As such, the Guidelines potentially have relevance for all organizations in Canada.
The Guidelines specify that organizations must effectively identify and communicate to each individual, the purposes for collecting, linking to, or allowing linkage to personal information and that the purposes should be reasonable, specific and limited. Further, organizations must seek individual consent prior to collecting, using or disclosing personal information linked to an RFID tag. Such consent must be based upon an informed understanding of the existence, type, locations, purposes and actions of the RFID technology and the information used by the organization.
According to the Guidelines, automatic deactivation of RFID tags at the point of sale should be the ultimate goal of organizations. In addition, consumers should be able to choose to re-activate them at a later date (for example, to take advantage of warranty services), or otherwise exercise control over the manner in which the tags interact with readers.
The Guidelines state that organizations should protect personal information linked to RFID tags, including ensuring that the tags are not read by unauthorized parties or readers, and that all linkages between the tags and consumer information are minimized and kept secure. Finally, upon demand, organizations must provide the consumer with a full account of all uses and disclosures of RFID-linked personal information.
The use of RFID technology remains controversial and is still in its relative infancy as it relates to consumer information. It remains to be seen whether the Guidelines will further the IPC’s goal of preserving consumer trust and confidence.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Please join members of the Blakes Commercial Real Estate group as they discuss five key provisions of a commercial real estate purchase agreement that are often the subject of much negotiation but are sometimes misunderstood.
Emotional culture is influenced in great part by the mindset and actions of leadership, although employees also play more of a role than they may realize in creating the culture that exists in the group.
The session will be led by Dr. Robert Brooks, an award-winning author and psychologist. In his presentation, Dr. Brooks will describe the mindset and realistic practices of leaders and staff that help to nurture and sustain a culture characterized by positive emotions, satisfying, respectful relationships, a sense of meaning and ownership for one’s work, and enhanced job performance. Examples will be offered to illustrate strategies for developing a positive emotional culture in an organization.
Join leading lawyers from the Blakes Pensions, Benefits & Executive Compensation group as they discuss recent updates and legal developments in pension and employee benefits law as well as strategies to identify and minimize common risks.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).