RFID Regulation

It appears that key members of Congress and officials at the Federal Trade Commission have come to the realization that government attempts to regulate the development, implementation and use of RFID would be misguided and are no-doubt unnecessary.

Clearly, industry self-regulatory initiatives have been recognized and lawmakers and regulators appear to be giving industry a chance to do it themselves, without federally imposed constraints. Some consumer activists who play the privacy card are not happy, but then who does that surprise?

By mid-March, there were two major developments that were encouraging to those who believe in the promise of RFID and its importance to the future of food industry logistics.

The Senate Republican High Tech Task Force, led by Sen. John Ensign (R-NV), issued a list of 40 policy proposals, including protection of "exciting new technologies from premature regulation or legislation in search of a problem." The comment was included in a section dealing with "Protecting Privacy and E-Commerce," and was clearly directed at those who believe RFID must be regulated because of privacy concerns.

"RFID holds tremendous promise for our economy, including military logistics and commercial inventory efficiencies, and should not be saddled prematurely with regulation," the GOP task force said. The comment, and the overall policy statement, was significant since Republicans control both chambers of Congress, and, of course, the White House.

It immediately brought an expression of concern from Katherine Albrecht, founder and director of Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN), who said the platform constituted a "very pro-industry statement."

Also included in the policy objectives by the 14-member task force were proposals to make the Internet tax moratorium permanent, protect consumers from malicious computer activity and update communications laws, among others. Under a section "Supporting E-Health Initiatives," the task force said it wants to "encourage use of the latest technologies available to ensure a safe food supply."

The second development occurred down Constitution Avenue from Capitol Hill where the Federal Trade Commission (FTC) staff issued a new report on RFID in which it said the agency will leave it up to industry and retailers who use RFID to educate consumers and provide adequate protections from privacy abuse.

The report, "Radio Frequency Identification: Applications and Implications for Consumers", was prepared following a June 2004 workshop in which industry and consumers met with FTC staff to discuss RFID and its implications for the future.

"Commission staff agrees that industry initiatives can play an important role in addressing privacy concerns raised by certain RFID applications," the report said. "The staff believes that the goal of such programs should be transparency. For example, when a retailer provides notice to consumers about the presence of RFID tags, the notice should be clear, conspicuous, and accurate. The notice should advise consumers if an RFID tag or reader is present and if the technology is being used to collect personally identifiable information about consumers."

Similarly, the FTC staff report added, "if a company's program provides consumers with the option of removing the RFID tag, the company's practices should make that option easy to exercise by consumers."

However, the staff also acknowledged that given the variation in RFID applications, translating those goals into action may be challenging and "should occur in a way that allows flexibility to develop the best methods to address consumer privacy concerns."

The staff agreed that potential privacy concerns associated with RFID are "inextricably linked to database security," and said that "a company that uses RFID to collect such information must implement reasonable and appropriate measures to protect that data."

The FTC staff said another key element of self-regulatory programs is effective consumer education. "Industry members, privacy advocates and government should develop education tools that inform consumers about RFID technology, how they can expect to encounter it and what choices they have with respect to its usage in particular situations."

"Any industry self-regulatory program should include meaningful accountability provisions to help ensure compliance," the staff declared, adding developments."

During the June workshop, representatives of EPCglobal outlined their "Guidelines on EPC for Consumer Products," which were discussed at length in the FTC staff report. The guidelines call for consumer notice, choice, and education, and also instruct companies to implement certain security practices. While those guidelines undoubtedly were created out of a sense of responsibility by industry participants, they clearly will serve the industry well as it seeks to avoid government regulation and control.