Is RFID tracking you?

We used to hear about the RFID issue in IT journals on the technological applications, and also in the political agenda of some activists raising privacy concern. Yesterday, I read from CNN an article on RFID tracking. As RFID becomes an everyday reality, the issue is now news instead of just technological or political discussions. You may wish to browse this article for details.

The article reports on the increasing use of RFID. It is replacing bar code tags and may eventually completely phase out the older technology and standard. This picture of a bunch of bananas with a bar code tag is a strange reminder that even green grocery can be tagged with RFID. I don't know where is the tag placed, as bunch of bananas is often torn apart by supermarket customers. So a tag could be inserted under the skin of each banana, if the cost per tag is very low and the labour is automated. There is a possible scenario that the big brother links up the credit card or Octopus information and obtains information of the purchase. With a powerful remote RFID sensor, other people will know when and where do you eat your banana.

Another striking picture from CNN is this pretty sales lady holding a pair of jeans. The caption says that the garment is tagged with RFID chip. When the pair of jeans is placed near the RFID sensor console, the monitor shows the details of the merchandise, and also other sizes and colours available. The catch is, if you buy it, you will carry the tag with you and the tag can lead to the customer information in the billing database. When you wear the pair of jeans and walk in the street, you may be flashing your identity around. There are promises that the tags will be disabled or its sensitivity reduced. But the advance of technology will also promise the development of more powerful sensor which can detect RFID data from a long distance, and perhaps location information via GPS.

But the present development of the issue is more comforting. The RFID industry is addressing the privacy concern by composing a best-practices manifesto. Participating companies include Microsoft, IBM, Intel, Visa U.S.A. and Proctor & Gamble. The manifesto is meant to assuage consumer fears about how data could be collected, shared and stored. Key parts of the document include an agreement to notify consumers about RFID data collection and give them a choice when it comes to gathering personal information. But the manifesto does not suggest any penalties for not complying. You may recall the handling of the issue on employee surveillance by the Hong Kong Privacy Commissioner. The concern is also addressed by a set of guidelines for employers without any obligation on compliance.

Nevertheless, RFID should not be viewed as something evil. See this CNN photo which shows the German Chancellor Angela Merkel participating in a demonstration on how a shopping cart full of grocery tagged with RFID could facilitate automated supermarket checkout. This is technology tomorrow today. The CNN article also reports on the level of risk on personal data security. On the issue of data leakage, the range of RFID data reception is short. Personal data are now freely available through cell phones and wi-fi connections which pose a greater data security risk than RFID chips. Supporters also say that goods and services transactions using RFID technology would be no more or less secure than they are today. For example, if you pay for goods and services today with a credit card, that information is stored in a database. If RFID is used to record sales, data will also go in the database. Similarly, data read from bar code will also be on the same database. If the government wants access to the the database containing goods and billing information and personal data, the process is essentially the same no matter how the information is collected, by RFID data or the bar code data.