Reding prepares tagging blueprint

Information Society Commissioner Viviane Reding will on 15 March put forward suggestions for how to tackle controversial technology that allows organisations to track individuals or goods.

The ‘big brother’ technology has been the subject of increasing public concern over the past year because of the potential for privacy breaches.

Radio frequency identification (RFID) tags are capable of emitting a serial number over distances of up to 200 metres. The technology, which is particularly useful for monitoring supply chains and tracking stock, has been embraced by supermarket chains, such as Germany’s Metro and the UK’s Tesco.

It is predicted that in future RFID will give rise to an ‘internet of things’ where everyday objects will be interconnected. The practical results of a networked world could include anything from tagged clothing that alerts retailers to marketing opportunities to tagged mobile phones that allow employers to track workers.

Concerns about the technology were expressed during a European Commission consultation, the preliminary results of which were published in October. More than half of respondents thought that legal provisions would be needed to safeguard citizens’ privacy. The Commission will announce its intentions in a communication during the CeBIT telecommunications trade conference in Hanover later this month.

Provisions on privacy contained in the 2002 regulatory framework for e-communications and the 1995 data protection directive are not considered to be sturdy enough. According to Sylvie Rousseau, a lawyer at Linklaters, many applications of RFID fall outside the scope of the two pieces of legislation. "Companies do not feel that they have to comply with data protection rules because they do not fall within the definitions," she said.

RFID has such diverse uses that EU regulators have struggled to pin down appropriate definitions. "The big issue with the communication is the problem of defining the scope of personal data," said Rousseau. "If the definition is too strict, then this could be in industry’s favour, as some forms of data will not be covered."

Cécile Grégoire, adviser on information and communications technology at EuroCommerce, an organisation representing the retail sector, dismissed concerns about the intrusive nature of the technology. "RFID is just a simple technology. We believe there are no concerns for data privacy," she said. "We believe that the Commission and retailers should inform consumers that there is no privacy risk. We don’t believe more regulation is needed."

Some observers believe that clarification of existing laws would provide sufficient safeguards for privacy. "The data protection directive would be sufficient, but its clauses are quite broad," said Georgia Skouma, manager of enterprise risk services at Deloitte Belgium, who co-authored a contribution to the Commission’s consultation.

"A document clarifying how provisions could be used to protect people from RFID abuses could [be drawn up]. It is not necessary to have new legislation, but if there is no explanation of practical rules, abuses will be common."

Information Society Commissioner Viviane Reding will on 15 March put forward suggestions for how to tackle controversial technology that allows organisations to track individuals or goods.