Tag Archives: consent

Transparent RFID policy and consent

In January 2011 the EU document ‘Privacy and Data Protection Impact Assessment Framework for RFID Applications’ was published. The document is an industry-prepared framework for Personal Data and Privacy Impact Assessments of RFID Applications and endorsed by the Article 29 Data Protection Working Party.

RFID Privacy targets include “Compliance with the data subject’s right to object –  It must be ensured that the data subject’s data is no longer processed if he or she objects.” along with one of the concerns of the privacy risks being Invalidation of explicit consentConsent has been obtained under threat of disadvantage.” – see pages 13 and 15.   However, this EU document is only advisory and simply details good practice with no set enforcable regulated code of practice yet in place for RFID tracking people.

In a recent article it came to light that in the UK a 14-19 college, West Cheshire College, are using RFID tags for registration purposes but then oddly state the information the RFID give them will be anonymised.  Quite how they plan to register individual students with anonymised RFID tags is baffling but, more worryingly, the college seems to have adopted a ‘must wear’ attitude.

In order for students to be able to object, as detailed the above EU document, to this level of surveillance, where staff at educational establishments such as West Cheshire College are able to  “look at them in groups, such as peer groups.”, both students and staff tagged need to be fully informed of exactly what the RFID chips they carry are being used for. i.e. how and where people would be tracked and the personal information held.

rfidcctvsignThis communication of the college’s intent of RFID use to register its students and staff, and subsequent consent, presumably would need a little more than a verbal statement.  Indeed, a document detailing the college’s RFID policy and a Privacy Impact Assessment would surely be considered good practice.

Maybe an adoption of the CCTV industry’s code to inform persons of CCTV tracking by signage on walls in areas where surveillance is occurring should be considered where RFID real-time location systems are in operation?

This would go some way to ensure transparency for those choosing to carry RFID tags.

UK students “must wear” RFID tags

In West Cheshire College, Cheshire UK, Students [are] made to carry ‘Orwellian’ locater tags – College staff and students have been issued with compulsory electronic badges that are capable of tracking their movements, leading to criticism of “Orwellian” tactics.”

How exactly does an establishment implement compulsory RFID tagging and still give the persons being tagged an option to consent?
RFIDconsent
If such a RFID tagging scheme can be compulsory and written consent is not gained from students what is to stop colleges and schools issuing RFID tags and not informing students? If a system is compulsory, presumably there is no room for non participants therefore no room for people to be able to make a choice in this matter, i.e. to consent.

Are persons not consenting then to write and ‘opt out’ of the RFID real time location system?  Perhaps we in the UK are to see a repeat of the much criticised line the educational establishments took with taking children’s biometrics without parental consent, deemed to be such bad practice that parental consent is now needed by law for schools to take and process children’s biometrics up to the age of 18.  This law is contained in the recent Protection Of Freedoms Act  2012.  West Cheshire College caters for pupils 14-19 year olds.

Then there is the issue of possible discrimination that could accompany a “must wear” policy the college has for those not wearing RFID tags.

Certainly as a parent I would want to know exactly who was watching my under 18 child at college in real time and why and where would they be monitoring their movements, to the toilet, school showers?   And I would not be happy with any discrimination my child may experience by not being RFID tagged, if indeed the college would enrol or employ a person refusing to wear RFID.

Just what are the college looking at?   In the RFID Journal, Kevin Francis, West Cheshire College’s Building Services Area Manager, states: We can search for individual [students or staff]. And we can look at them in groups, such as peer groups.”  [NB. This RFID Journal article was withdrawn from the RFID Journal’s website w/c 7 Jan 2013.  A Copy of the article (pdf) is here and here is the original article on the Internet Archieve Wayback Machine] Then to the Telegraph: “We do have these tags, but they’re not for the purposes of tracking.”

Erm, yes they are.  RFID tags track.  Why else would West Cheshire College purchase a RFID ‘real time location tracking solution’?  [ NBZebra Technologies withdrew the article from their website late February/early March 2013. A copy of the press release (pdf) is here  and this is the Internet Archive Wayback Machine’s link to the original webpage]

Then comes the sell.  Environmental – “The aim is to use the buildings as efficiently as possible.”  Security – “We are interested in teaching and learning, building use and the security of
students and staff.”… oh yes and here comes safety – “Staff with first aid training can be identified if needed in an emergency.” and not to forget funding – “we use this information for funding purposes”.  There we go.

The use of RFID may be about many issues but the issue surrounding consent, both for pupils, parents and staff, here is the most serious.

How can a compulsory RFID tracking scheme involve consent?

“And we can look at them in groups, such as peer groups.”

According to an article from April 2012 in RFID Journal, [NB. This RFID Journal article was withdrawn from the RFID Journal’s website w/c 7 Jan 2013.  A Copy of the article (pdf) is here and here is the original article on the Internet Archieve Wayback Machine] West Cheshire College are RFID tracking 5,500 full-time students and have been doing so since 2010.

After the opening of its new campus at Ellesmere Port, Liverpool, the college “has successfully implemented Zebra’s real time location tracking solution with the ability to track and increase the visibility of 20,000 students across its two campuses” states Zebra Technologies, the US company who supplies the RFID tracking system.

Kevin Francis, West Cheshire College’s Building Services Area Manager, uses an interesting choice of language on Zebra Technologies website  [ NBZebra Technologies withdrew the article from their website late February/early March 2013. A copy of the press release (pdf) is here  and this is Internet Archive Wayback Machine’s link to the original webpage] to describe the college’s reasons for buying the technology – using the terms “asset tracking”  and  “optimizing our learning resources.” (referring to the students presumably?) with “specialist location solution capabilities” .  Are these phrases we may be hearing more of as other schools follow suit?

This all boils down to funding, states the RFID Journal :

“…the school also plans to utilize the RTLS [Real Time Location System] solution to reliably, quickly and accurately track student attendance, and to document that each student’s attendance record matches the actual number of hours for which the college receives funding (a process that is currently manual and time-consuming).”

It could be argued that an alternative method, other than RFID tagging students, could be found that would not be manual and time consuming.  An alternative, less invasive attendance system could be implemented, one that does not involve the college’s knowledge of each students every move.

The accurate attendance of students and the financial rewards that may reap from RFID tracking pupils is not the college’s only reason for locating the students and staff in real time, as Kevin Francis states to the RFID Journal:

Francis says this software will provide “reports if [students or staff] are leaving early,” stating,
“We can search for individual [students or staff]. And we can look at them in groups, such as peer groups.”  (Why?)

The privacy implications for the use of RFID technology constantly tracking a persons every move are massive, possibly insidious and very much open to abuse.  Clearly, as stated by Kevin Francis in the RFID Journal’s article, West Cheshire College will not just be monitoring attendance levels but will also be looking at individual associations.  The technology will reveal where students are with Real Time Location Systems.

How will this affect student and staff behaviour?  Trips to the toilet – been there too long?  Too many visits to a school nurse?  Student/staff relationship?  Students relationships?  Who has access to this information?

This RFID technology tracking humans in real time certainly raises more questions, than solutions it provides.