The Law Commission is concerned about the use RFID customer information could be put to, as it is unclear whether the data in radio-frequency identification tags on bought goods constitutes “personal information” as defined under the Privacy Act.
At the moment, the act only covers the use of information attached to a personal identifier, but information contained in these tags could be collated with, say, information a retailer already has about a person who belongs to its loyalty card scheme. The Law Commission is concerned about this possibility and how such information might be used.
The applicability of privacy law, or the need for amendment of the law, “will depend on how RFID data is used and integrated with other data, and whether this results in the collection, use or disclosure of information about an identifiable individual,” the commission says in its report on the state of privacy law.
Attaching RFID tags directly to people could start out quite laudably — for example, tags could be attached to those suffering from Alzheimers disease or other medical conditions to stop them getting lost. But their use could soon enter more questionable territory.
“Critics note… it is conceivable that it will gradually become acceptable for other categories of individuals to be chipped (such as prison inmates, parolees, sex offenders and illegal immigrants) until a substantial portion of the population is tagged for one reason or another,” the commission says, citing a press report from last year.
Two-thirds of respondents to a 2005 US Federal Trade Commission consumer survey said their top concern regarding RFID technology was “the likelihood that RFIDs would lead to data being shared with third parties, more targeted marketing or the tracking of consumers via their product purchases.”
However, in NZ, the commission notes: “A consumer protection code of practice has been developed in advance of the possible introduction of RFID tagging of goods.”
This voluntary code stipulates that consumers should be told of the presence of RFID tags and told how any associated data will be used. It also includes a complaints process. The code is available at: www.gs1nz.org/documents/EPCConsumerCode17MayFinal_000.pdf