Category Archives: EU

A child consenting to be tracked should be given a choice, and what about the parents right to know who is tracking their children?

Against RFID in schools

Tracking capabilities as shown in their supplier’s video ‘Optimizing the Learning Experience with a Zebra Tracking Solution”

When a UK college recently used a RFID real time location system to track students on their campuses in Chester and Ellesmere Port from 2010 – 2013.  Apart from whoever thought this was a good idea somewhere in the tiers of the college management, how did the college manage to persuade the thousands of students it tracked, that this was a good idea too?  How did the students consent to staff being able to “… look at them [students and staff] in groups, such as peer groups.”  Locations being seen in, possibly toilets, showers, school nurse, etc?

In a reply to a Freedom of Information request, this is how the college gained fully informed consent – apparently “Information relating to the RFID tags and their purpose was covered during College induction/ enrolment.”

When pressed further on this consent gaining process the college refuses to answer questions.  Only when the Information Commissioner’s Office intervenes it is revealed quite how the college considers meaningful consent is gained from students to be tracked by an RFID tag ‘bleeping’ it’s whereabouts every second“we can confirm that the induction process is covered verbally with students. It is fair to assume that information about RFID was also communicated verbally to students”.

Erm, is that consent?

The college refused to answer a Freedom of Information request, December 2012, and upon an internal review *still* could not answer one question, which was a simply yes/no answer, as to whether or not staff were RFID tagged – astonishing.  Yet when pressed by the Information Commissioner’s Office, in July 2013 (full report here) the college replied, ‘staff badge tags remained inactive and were not in active use for any purpose. Staff who had a RFID badge for first aid purposes also had inactive badges’  (why would staff carry an inactive RFID for first aid? and why not state that initially?)

RTLS Mapping West Cheshire College

It’s difficult to see what is happening here – either a shocking inability of knowledge or lack of awareness of  responsibility to answer basic questions under the Freedom of Information Act.  But when children are tracked in this manner, literally their every move with the potential to be scrutinized, there should be absolute transparency.

Transparent RFID policy and consent

In January 2011 the EU document ‘Privacy and Data Protection Impact Assessment Framework for RFID Applications’ was published. The document is an industry-prepared framework for Personal Data and Privacy Impact Assessments of RFID Applications and endorsed by the Article 29 Data Protection Working Party.

RFID Privacy targets include “Compliance with the data subject’s right to object –  It must be ensured that the data subject’s data is no longer processed if he or she objects.” along with one of the concerns of the privacy risks being Invalidation of explicit consentConsent has been obtained under threat of disadvantage.” – see pages 13 and 15.   However, this EU document is only advisory and simply details good practice with no set enforcable regulated code of practice yet in place for RFID tracking people.

In a recent article it came to light that in the UK a 14-19 college, West Cheshire College, are using RFID tags for registration purposes but then oddly state the information the RFID give them will be anonymised.  Quite how they plan to register individual students with anonymised RFID tags is baffling but, more worryingly, the college seems to have adopted a ‘must wear’ attitude.

In order for students to be able to object, as detailed the above EU document, to this level of surveillance, where staff at educational establishments such as West Cheshire College are able to  “look at them in groups, such as peer groups.”, both students and staff tagged need to be fully informed of exactly what the RFID chips they carry are being used for. i.e. how and where people would be tracked and the personal information held.

rfidcctvsignThis communication of the college’s intent of RFID use to register its students and staff, and subsequent consent, presumably would need a little more than a verbal statement.  Indeed, a document detailing the college’s RFID policy and a Privacy Impact Assessment would surely be considered good practice.

Maybe an adoption of the CCTV industry’s code to inform persons of CCTV tracking by signage on walls in areas where surveillance is occurring should be considered where RFID real-time location systems are in operation?

This would go some way to ensure transparency for those choosing to carry RFID tags.