p2pnet news view Politics | Freedom:- A Q&A designed to warn people against possible risks attached to RFID tags, sometimes called spy chips, was issued today by EU Commissioner for Information Society Viviane Reding.

People shouldn’t have to carry them in anything, “without being informed precisely what they are used for, with the choice of removing or switching it off at any time,” she says.

“Radio-frequency identification (RFID) is the use of an object (typically referred to as an RFID tag) applied to or incorporated into a product, animal, or person for the purpose of identification and tracking using radio waves,” says the Wikipedia.

Now, “RFID technologies can store complex data and communicate information automatically, while at the same time they can be embedded within products or are so small that they can hardly be seen by the human eye,” says Reding in a Europa statement, continuing

Therefore, if unaware or uninformed of their use by retailers, RFID tags and readers could also be used without the prior consent or knowledge of consumers. Many RFID tags contain unique identification numbers, meaning that two tagged products can be distinguished from one another. If a tag is within the reading distance of a reader, it can be read even if it is hidden from direct view, in a bag or pocket (e.g. through a piece of cloth).

If an object containing an RFID tag is within reading distance of a reader, the tag can be read even if someone is not actively using the object (as opposed to, for example, a debit card being swiped).

Because of these concerns, the commission outlines, “principles for protecting privacy and data protection as RFID tags play a greater role in daily life,” she says.

In its proposals for reform of the EU telecoms, the commission has, “included a clarification that public communications networks supporting RFID and similar devices are covered by the Directive on privacy and electronic communications,” it says, adding, “These include an opt-in approach giving citizens control over RFID”.

It also includes a Q&A which says in part »»»

How can I know if a product that I am buying has a tag?

The Commission recommends that the presence of the tag is indicated through at least a sign. Depending on the characteristics of the product (size, material, intended usage, etc.), the sign can be placed on the product itself, on its packaging, or on the shelf where it is located. The European Standardisation Organisations are currently defining a standard sign that will be used throughout Europe.

What data [sic] is usually stored on tags?

Most tags used for retail trade applications contain a unique number made of three parts: the first indicates the name of the first user of the tag, typically the producer of the product (e.g. Water Company ltd.), the second indicates the type of product (e.g. a 1.5l bottle of sparkling water) and the third is a serial number that identifies a precise product. Following the same example, all the bottles of a six-bottles-pack would have the same first and second part but would differ in the third part.

So, can anyone understand those three numbers?

Associating the first number to the producer is something that many companies can do. Linking the second and third numbers to what they mean would require an agreement with the producer as the information usually lies in their internal computer systems.

How do I know what data is being used or gathered?

The Commission recommends that consumers are informed of the data that is being processed; this includes informing consumers of the data contained on the tag, as well as how it is used and why it is used by retailers. This information should be provided to you by the organisation that is using the tag. In the case of retail products, this would typically be the producers of the product or the retailers themselves.

Should I worry about my privacy when purchasing products with tags?

Organisations responsible for placing the tags should conduct a privacy and data protection impact assessment to understand and act on the possible privacy and data protection threats that the presence of the tag creates. If this is done in the way recommended today by the European Commission, there should be no reason for privacy concerns.

I don’t want the products I purchase to be tagged. Can I ask the retailer to remove them?

Yes. Firstly, if the tag is likely to present a threat for your privacy or your personal data, the Commission recommends that the organisation that placed them should eliminate the threat, remove the tag, or deactivate it. Secondly, if the tag does not present a threat to your privacy or your personal data, and provided the tag was placed by your retailer, the Commission recommends that you can still ask the retailer to remove or deactivate the tags should you wish so.

I have purchased a product that contains a tag. Can I be tracked once I leave the shop?

It would only be possible to ‘track’ consumers if there were interconnected RFID readers everywhere, but for the foreseeable future readers will only be located in a limited number of places (access control doors in companies, on public transport, etc.) and are usually not interconnected (readers from a public transportation company and a supermarket are not on the same system).

Tags that you carry can be ‘read’ by specific devices, but reading the content of a tag and making sense of what it means are two different things. Technical incompatibilities aside, if a retailer’s RFID reader comes close to and “reads” your public transport ticket, the chances are it will not understand it and will simply disregard the captured data.

This development will be kept under constant scrutiny by data protection authorities and by the European Commission.

I use an RFID contact-less card to enter public transportation (or a museum, a stadium, etc). What information does the card contain?

In many cases, your contact-less card will contain personal information. The type of personal information depends on the application of the RFID tag. For example, many public transportation applications include personal data on the card themselves, such as the number of journeys taken and when. This information is gathered for several reasons, including allowing you to claim back a journey charged but not taken. However, if personal data is stored on your transport card, the transportation company should inform you of the data the card contains.

The Commission recommends that consumers are informed of RFID tag use the first time the card is made available and entitled to ask for information at any time. For those cards that are rechargeable, the booth at which you can recharge them usually offers you this service.

I use a RFID electronic access card to enter my employer’s building. Is my employer gathering information such as my arrival dates or how long I work?

The Commission recommends that employers inform their employees on the purposes of the application and the data processed. If applicable, this could include your arrival/departure times and how it is linked to your personal data. Your employer might simply use electronic cards for access control and nothing else.

Follow p2pnet on Twitter.

Europa statement – RFID: Radio Frequency IDentification: Frequently Asked Questions, May 12, 2009