Legislation that would regulate RFID use continues to pop up in a handful of states, likely spurred by one lawmaker’s efforts in California. No state has yet passed and had signed into law legislation that would limit how RFID can be used. But Sen. Debra Bowen, a California Democrat, has had the most success. A watered-down version of her SB 1834 has cleared the Senate. Missouri and Utah have struggled with similar bills, and one Massachusetts legislator has promised a bill late this year. Colorado was faced with legislation banning grocery discount cards, some of which were based on RFID technology, but that bill, too, has gone nowhere.

U.S. Senator Patrick Leahy has weighed in on the issue, saying that there might have to be U.S. hearings held on the technology to determine if a person’s privacy is at stake. Regardless, even if every bill filed so far fails, there is always next year as long as anti-RFID proponents can find a bill sponsor.

California’s SB 1834

Senator Bowen’s bill started out requiring any business or state government agency using an RFID system that can track products and people to tell people they’re using an RFID system that can track and collect information about them; get express consent before tracking and collecting information; and detaching or destroying RFID tags that are attached to a product before the customer leaves the store.

What ended up passing the Senate, however, an amended SB 1834, now says that businesses and libraries that want to use RFID systems can only collect personal information to the extent permitted by law, and then only in regards to items a customer is buying, renting, or borrowing. Information can’t be collected on what the person may have picked up but put back while shopping, on what they’re wearing, what’s in their wallet or purse, or anything else, said Senator Bowen. In actuality, the bill permits stores and libraries to collect the same information they already collect now using bar codes, while at the same time banning the use of the technology to track people as they shop or after they leave the store. Labels announcing RFID use wouldn’t have to be affixed to the products nor would the tags have to be removed or destroyed prior to the product leaving the store.

“When people go through the checkout line, the store can already collect information on what they buy and tie it to their name, but without RFID, the store can’t easily collect information on what products a person picks up in the store but doesn’t buy, what people are wearing or what’s in their wallet or purse,” said Senator Bowen.

“The privacy impact of letting manufacturers and stores put RFID chips in the clothes, groceries, and everything else you buy is enormous,” the senator said when she first filed the bill. “There’s no reason to let RFID sneak up on us when we have the ability to put some privacy protections in place before the genie’s out of the bottle.”

States Consider Legislation

In Missouri, Sen. Maida Coleman, a St. Louis Democrat, earlier this year filed SB 867 that would have required any product that contains a RFID tag or bar code to include a label disclosing that information to the consumer. The Missouri Assembly adjourned at the end of May without acting on this legislation. Rep. David Hogue, a Republican from Riverton, Utah, successfully worked his HB 251 through the lower chamber earlier this year but was unsuccessful in the Senate. That means the bill is dead at least for this year, since the Utah Legislature has adjourned its 2004 session and won’t convene again until next January.

Utah’s House passed Representative Hogue’s Radio Frequency Identification Right to Know Act, 47-23. Had it been approved by the Senate and signed by the governor, the bill would have taken effect May 5, 2005. It required “a product containing a radio frequency identification tag to contain a label describing the radio frequency tag” and to allow the tag to be disabled “prior to the completion of sale unless the consumer chooses to leave it active.” The bill would also have allowed a logo to be placed on packaging to identify that an item contained an RFID tag, as long as an explanation of what the logo meant was placed near the goods in a prominent place, and of sufficient size so that consumers could easily see it.

Representative Hogue, like every other lawmaker who has filed RFID legislation, said he was concerned about privacy. His fear, he said, was that retailers would try to match data gathered by RFID readers with consumers’ personal information.

Massachusetts Considers the Possibilities

An RFID bill will also be forthcoming in Massachusetts. According to an aide to Massachusetts Senator. Jarrett Barrios, the senator plans to file legislation later this year.

“The Senator has not filed a RFID bill yet mostly, due to the fact that our current legislative session ends at the beginning of July,” said Colin Durrant, the senator’s director of communications and public policy. “However, Senator Barrios intends to file a RFID bill in December 2004 for the 2005-06 legislative session,” he added.

“At this point,” said Mr. Durrant, “the senator is soliciting comment from companies developing RFID technology, businesses using the technology and consumer privacy organizations to ensure that he files a bill that balances the important need to protect consumer privacy while allowing businesses to recognize the potential this emerging technology has to increase efficiency for retailers in specific. Most recently, the senator convened a roundtable discussion of businesses and consumer privacy groups in early June to discuss issues surrounding RFID.”

A fact sheet from the senator’s office, has been developed that, said Mr. Durrant, “lays out the starting point we’re using to develop the legislation. As you’ll see from the bullet points there are some very important consumer privacy concerns we’d like addressed, but at the same time we want to make sure we include businesses in the discussion.”

The “fact sheet,” while admitting that “RFID can be used to bolster business,” also mentions some of the same elements that have been behind the filing of other anti-RFID legislation: That corporations “could hide RFID tags in products to track consumers while they are in contact with a product even after they leave a store. The question of who should be responsible for removing the tags remains unanswered.”

The solution, as mentioned on the fact sheet: “Affirm beneficial RFID uses for business while protecting consumers’ privacy by requiring full-disclosure of RFID use to consumers and allowing them to dismantle the RFID chips upon leaving the store.”
Currently, Senator Barrios’ bill, according to that same fact sheet, would likely require RFID users:

• “To obtain written consent from individuals before they aggregate RFID collected data with personal information such as social security or credit card numbers or before any such information is shared with a third party.”
• “Ensure that collected data is stored securely and cannot be accessed by unauthorized parties.”
• “Ensure that stores notify consumers of the use of RFID and that RFID tags are labeled so consumers know when a product contains such a tag.”
• “Ensure that each tag is destroyed before a consumer leaves a store so it cannot continue to transmit information once a consumer leaves a store.”

Frequent Buyer Card Regulation

A Colorado bill, while not attacking RFID use directly, would prohibit supermarkets from offering discounts tied to a card. Sen. Ken Chlouber believes such a program allows supermarkets to track what people buy, if they participate in the program.

Insight in Washington

At the federal level, Vermont’s Senator Leahy told a conference on video surveillance at Georgetown University Law Center in March that “The RFID train is beginning to leave the station, and now is the right time to begin a national discussion about where, if at all, any lines will be drawn to protect privacy rights.”

He said it is possible “that Congress may decide that enacting general (RFID) parameters would be constructive. It is important that we let RFID technology reach its potential without unnecessary constraints. But it is equally important that we ensure protections against privacy invasions and other abuses.”

He also said he believes that RFID technology, which is far less expensive than video surveillance, has the potential of being much more pervasive. Then, taking a line from Senator Bowen, added that he wants “to begin the process of encouraging public dialogue in both the commercial and public sectors before the RFID genie is let fully out of its bottle.” He offered the possibility of “constructive, bipartisan congressional hearings” on RFID. “The earlier we begin this discussion, the greater the prospects for success in reaching consensus on a set of guiding principles.”

Business Fights Back

Probably one of the best defenses for RFID use came from a joint letter to Senator Bowen from the National Retail Federation and the California Retailers Association during public hearings Senator Bowen held last year prior to filing her RFID legislation. The letter urged her and legislators to consider four areas:

• “Education: Consumers need to be educated on the benefits of RFID, such as the ability to make returns without a receipt, to aid law enforcement in the recovery of stolen property, or to aid in the recall of defective or contaminated products.”
• “Notice: To gain consumer trust and confidence, standards for RFID must provide notice to consumers about RFID’s uses; how information collected via RFID will be maintained or used; the choices and benefits available to consumers; and the impact that consumer choices will have.”
• “Choice: Policymakers must address options for consumers on whether RFID tags can be turned off after a purchase and how the information they help gather can be used.”
• “Value: The wide range of benefits of RFID must actually be delivered to consumers, and retailers need to be able to deploy the technology cost-effectively.”

Conclusion
Though none of these specific pieces of legislation have passed their respective legislative bodies to become law, it should certainly be expected that some restrictive bills will pass in the future. People on both sides of the issue are passionate and capable of effecting change. The important thing for both sides is to keep the public good in focus and find acceptable compromises that can protect personal privacy while still capitalizing on the benefits of RFID.