In January 2011 the EU document ‘Privacy and Data Protection Impact Assessment Framework for RFID Applications’ was published. The document is an industry-prepared framework for Personal Data and Privacy Impact Assessments of RFID Applications and endorsed by the Article 29 Data Protection Working Party.
RFID Privacy targets include “Compliance with the data subject’s right to object – It must be ensured that the data subject’s data is no longer processed if he or she objects.” along with one of the concerns of the privacy risks being “Invalidation of explicit consent – Consent has been obtained under threat of disadvantage.” – see pages 13 and 15. However, this EU document is only advisory and simply details good practice with no set enforcable regulated code of practice yet in place for RFID tracking people.
In a recent article it came to light that in the UK a 14-19 college, West Cheshire College, are using RFID tags for registration purposes but then oddly state the information the RFID give them will be anonymised. Quite how they plan to register individual students with anonymised RFID tags is baffling but, more worryingly, the college seems to have adopted a ‘must wear’ attitude.
In order for students to be able to object, as detailed the above EU document, to this level of surveillance, where staff at educational establishments such as West Cheshire College are able to “look at them in groups, such as peer groups.”, both students and staff tagged need to be fully informed of exactly what the RFID chips they carry are being used for. i.e. how and where people would be tracked and the personal information held.
This communication of the college’s intent of RFID use to register its students and staff, and subsequent consent, presumably would need a little more than a verbal statement. Indeed, a document detailing the college’s RFID policy and a Privacy Impact Assessment would surely be considered good practice.
Maybe an adoption of the CCTV industry’s code to inform persons of CCTV tracking by signage on walls in areas where surveillance is occurring should be considered where RFID real-time location systems are in operation?
This would go some way to ensure transparency for those choosing to carry RFID tags.
Against RFID in schools 