Fips and Pets for RFID : Protecting Privacy in the Web of Radio Frequency Identification

Radio Frequency Identification (RFID), like many other technologies, is a two-edged sword. On the one hand, this automatic identification technology would enable entirely unobstructed visibility into the supply chain, and would dramatically cut down on industry's costs. On the other hand, RFID carries less glamorous prospects for the other end of the supply chain, and raises consumer privacy issues both in, and outside of, the retail surroundings. Not only are there extended capabilities of data collection furnished by RFID technology, a new threat of tracking individuals has appeared. Inherent drawbacks in the Privacy Enhancing Technologies (PETs) that were developed in an attempt to address these concerns make it impossible, at least at this stage of development, for the technologies to independently provide a satisfactory response to the privacy concerns. Therefore, in order to achieve adequate privacy protection, industry's behavior should not only be directed by technology, but must also be regulated otherwise. This paper calls to embrace self-regulation measures, and argues that at this point, legislation or other governmental regulation are not yet warranted, as it may deny businesses and consumers of the benefits of the technology. For this purpose, existing Fair Information Practices (FIPs) offer a good baseline, but cannot be adopted as-is to RFID technology. The paper attempts to assess what fair information practices are to be adopted and how some of the existing principles should be adapted and tailored to the distinctive characteristics of RFID technology and its repercussions. The end result is a set of ten RFID-customized principles of fair information practices that could serve as the foundation of a strong privacy policy with respect to the usage of RFID tags, hopefully to be adopted by the industry