RFID, here's what to expect
by Guido Villa (Lidis.it) – The world of industry and commerce is increasingly looking at radio chips as a solution with significant advantages. Consumers also benefit from these advantages. If they know and are aware of them,
01/04/05 – Comments – Rome – With a press release dated March 25th, the Italian Data Protection Authority announced the adoption of a general provision on the so-called “Labels ”Intelligent“. In a previous press release (dated 31 December 2004), the Privacy Guarantor had called for a public consultation on four of the most burning issues regarding personal data and new technologies: ”loyalty“ cards (or ”loyalty” cards), satellite and interactive television, videophones and, precisely, Radio Frequency Identification (RFID) techniques: so-called smart labels.
Much has already been said about the technical aspects of RFID technology, so here we will focus on the issues related to personal data protection. Indeed, there is no doubt that this is the most sensitive and debated aspect of "smart tag" technology.
Maximum attention is being paid, especially to the applications RFID technology may be put to in the near future. While until a few months ago, a Google search for "RFID" (among Italian sites) returned very little information, today there are hundreds of information pages and websites of companies specializing in providing "smart labeling" solutions.
Following the public consultation, the Italian Data Protection Authority itself stated that certain uses of RFID technology may constitute a violation of the right to personal data protection and have serious repercussions on the integrity and dignity of the individual. This is also because, due to the small size and location of the so-called "smart tags" and their readers, the processing of personal data via RFID can be carried out without the data subject's knowledge.
In certain cases, such processing may constitute a violation of the right to personal data protection and lead to forms of control over individuals: the use of RFID could, in fact, collect innumerable data on consumer habits for profiling purposes or be able to track their routes, monitor their geographic location, or verify which products they use, wear, or carry.
Let's now look at the main provisions contained in the general provision of the Guarantor. First, in compliance with the principle of necessity of processing pursuant to Article 3 of Legislative Decree 196/03 (the so-called Privacy Code), RFID systems must be configured to avoid the use of personal data or, depending on the case, the identifiability of data subjects, when this is not strictly necessary for the intended purpose. The data contained in the RFID TAG, therefore, may be associated with a natural or legal person only when strictly necessary for the operation of the system.
Secondly, in addition to complying with the principles of lawfulness, purpose, and proportionality common to other processing operations, the data controller, when providing data subjects with the required information, will be required to indicate the presence of RFID tags and specify that, through the connected systems, it will be possible to collect personal data without the data subject's activation and/or awareness. The existence of readers capable of interacting with the RFID tag must also be indicated in the information. The methods for removing and/or deactivating the tag, or otherwise interrupting the operation of the RFID system, must also be clearly highlighted.
As regards specific applications, the provision of the Guarantor Authority focused on those which, to date, appear to be the applications which will most closely concern a large number of people, and in particular:
– with regard to the use of RFID techniques in commercial establishments, it has been clarified that there is no need to request consent to the processing of data, only if the system does not lead to any traceability of the products to identified or identifiable purchasers;
– however, if RFID techniques are associated with identified buyers, e.g., with the use of customer loyalty cards for commercial profiling purposes, the data protection principles (with specific reference to information, consent, necessity, and proportionality of processing) set out by the Italian Data Protection Authority in its provision of February 24, 2005 ("Loyalty cards and consumer guarantees. The Italian Data Protection Authority's rules for loyalty programs") also apply;
– The tags must be deactivated after passing through the checkout: it is generally not permitted to install RFID tags that remain active beyond the checkout barrier of the retail establishment where they are used. However, if such use were hypothetically deemed lawful, the interested party's consent would still be required.
– with regard to the use of RFID systems to verify access to certain locations, it is necessary to take into account the following: if the technology is used to verify access to workplaces (or in any case to the workplace), the Workers' Statute prohibits the use of systems and equipment for the purpose of remotely monitoring workers' activities and, if their use is necessary for other purposes, prescribes certain guarantees (Article 4 of Law No. 300 of 20 May 1970; Article 114 of the Code); however, if RFID technology is used to monitor the occasional access of third parties to certain locations (e.g., museums, discos, swimming pools, etc.), the data controller must in any case prepare alternative systems to be used in the event that the data subject refuses to use the "electronic tagging" system.
A final mention should be made regarding the possibility of obtaining the deactivation of "smart labels": the Guarantor Authority has in fact established that the interested party must obtain, free of charge and easily, the removal or deactivation of the RFID labels at the time of purchase of the product, and that the labels must be positioned in such a way as to be easily removable, without damaging or limiting the functionality of the product.
Guido Villa
(Sarzana & Partners Law Firm)
Lidis.it
English 
Italian 