RFID is a technology that allows automatic identification of objects (or even people or animals) by incorporating a small electronic chip (“smart chip”) in its "host". Data is stored on this chip and can then be read by wireless devices, called RFID readers. On 12 May 2009 the European Commission issued a Recommendation on Radio Frequency Identification (RFID) applications3, particularly in light of an individual's right to privacy and data protection. The Recommendation, which sets out general principles RFID applications should conform to, can be summarised as follows4:
- Consumers should be in control regardless of whether products they buy use RFID technology or not. When consumers buy products with smart chips, these should be deactivated automatically, immediately and free-of-charge at the point of sale, unless the consumer explicitly opts-in by asking to keep the chip operational. Exceptions can be granted to avoid an unnecessary burden on retailers, for example, but only after an assessment of the chip's impact on privacy.
- Companies using smart chips should give consumers clear and simple information so that they understand whether their personal data will be used, the type of data collected (such as name, address or date of birth) and for what purpose these data are collected. They should also provide clear labelling to identify the devices that 'read' the information stored in smart chips and provide a contact point to obtain more information.
- Retail associations and organisations should promote consumer awareness on products containing smart chips by using a common European sign to indicate whenever a smart chip is used by a product.
- Companies should conduct privacy and data protection impact assessments before using smart chips. These assessments, reviewed by national data protection authorities, should ensure that personal data is secure and well protected.
Member States have two years to inform the Commission on the steps they intend to take to ensure that the objectives of the Recommendation are met. Within three years, the Commission will report on the Recommendation's implementation, including an analysis of its impact on companies and public authorities using smart chips as well as its impact on citizens. In the meanwhile, companies using RFID applications, should bear in mind the abovementioned suggestions when using or implementing RFID applications.