[LINK] EU releases RFID Privacy Recommendations.

[Geoffrey Ramadan]

The European Commission today issued an official Recommendation on data 
protection and privacy with respect to RFID. Following are the basic 
principles of the Recommendation, quoted directly from the announcement:

* Consumers should be in control whether products they buy in shops use 
smart chips or not. When consumers buy products with smart chips, these 
should be deactivated automatically, immediately and free-of-charge at 
the point of sale, unless the consumer explicitly opts-in by asking to 
keep the chip operational. Exceptions can be granted to avoid 
unnecessary burden on retailers, for example, but only after an 
assessment of the chip's impact on privacy.

* Companies or public authorities using smart chips should give 
consumers clear and simple information so that they understand if their 
personal data will be used, the type of collected data (such as name, 
address or date of birth) and for what purpose. They should also provide 
clear labelling to identify the devices that 'read' the information 
stored in smart chips, and provide a contact point for citizens to 
obtain more information.

* Retail associations and organisations should promote consumer 
awareness on products containing smart chips through a common European 
sign to indicate whenever a smart chip is used by a product.

* Companies and public authorities should conduct privacy and data 
protection impact assessments before using smart chips. These 
assessments, reviewed by national data protection authorities, should 
ensure that personal data is secure and well protected.

Details:
http://ec.europa.eu/information_society/policy/rfid/documents/recommendationonrfid2009.pdf

Regards
Geoffrey Ramadan