[LINK] Washington State passes RFID privacy law

[Roger Clarke]

Washington State passes RFID privacy law; where's Uncle Sam?
By David Chartier | Published: March 28, 2008 - 11:04AM CT
http://arstechnica.com/news.ars/post/20080328-washington-state-passes-rfid-privacy-law-wheres-uncle-sam.html

RFID tags are increasingly making their way into consumer electronics 
and goods, sometimes without our consent or knowledge. As security 
and privacy concerns increase about this "leaky" technology, some 
states have taken some initiative to set boundaries around the 
technology. California made some progress last year, and a new law 
just passed in Washington will offer some more protections to 
residents of the Evergreen State.

The Washington legislation outlaws the use of RFID "spy technologies" 
to collect consumer information without the owner's consent. The only 
problem is, heavy corporate lobbying narrowed the scope of the law 
(before Governor Gregoire signed it) to cover only criminal acts such 
as fraud, identity theft, or "some other illegal purpose" (making it 
a Class C felony to do so). Collecting information from consumer RFID 
chips for marketing purposes in Washington-with or without the 
owner's consent or even knowledge-is still fair game.

Sponsored by Rep. Jeff Morris (D). Washington's new law goes into 
effect in July. In a press release announcing the passage of the 
bill, some of RFID's advantages are acknowledged, while many of the 
concerns that RFID security and privacy advocates have been 
expressing for some time are also echoed. In one 
"not-too-distant-future scenario," the release reads, "law 
enforcement attempting to squelch an unruly mob could gather the 
identity of everyone in the vicinity-guilty parties and passersby 
alike-with the click of a chip reader."

"The only way to stay ahead of the technology," said Morris, "is to 
begin staking out our individual privacy rights now before it's too 
late."
We've got RFID passports in the US, and, considering the speed at 
which businesses are pushing RFID into the consumer space for every 
marketing and tracking use one can imagine, it's slightly reassuring 
to hear a politician speak forcefully about the issue. That said, the 
reach of state legislation is obviously limited. Federal legislation 
is needed to navigate the RFID maze, as states will mostly likely 
succeed only in creating a complex and possibly contradictory web of 
laws and regulations when they go it alone.

Major national retailers like Wal-Mart, who want to use RFID for 
inventory management and tracking, are the largest pushers of RFID 
into the consumer space, and they won't be pleased if different state 
laws have different implications for how they integrate RFID into 
their inventory. For instance, what if one state stipulates that RFID 
tags cannot be read by contactless readers, while another sets the 
reading distance at four inches? Or what if one state requires that 
RFID-carrying products be prominently labeled as such? Given this 
reality, retailers will have their own motivations for shaping 
federal regulation. And considering how much money is at stake in the 
budding industry of targeted marketing in the real world, you can bet 
that consumer privacy won't be at the top of these retailers' lists.

-- 
Roger Clarke                  http://www.anu.edu.au/people/Roger.Clarke/

Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
                    Tel: +61 2 6288 1472, and 6288 6916
mailto:Roger.Clarke at xamax.com.au                http://www.xamax.com.au/

Visiting Professor in Info Science & Eng  Australian National University
Visiting Professor in the eCommerce Program      University of Hong Kong
Visiting Professor in the Cyberspace Law & Policy Centre      Uni of NSW