On May 12, 2009, the EU Commission issued a recommendation that shall support the protection of the individual’s basic right to protection of privacy, and to data protection when Radio Frequency Identification (RFID) technologies are used. The recommendation is addressed to public authorities and private companies (Users) that employ RFID for their purposes. The aim of the recommendation is to create equal starting conditions for the European economy and at the same time to enhance protection of the individual’s privacy.
The Commission’s non-binding recommendation contains the following guidelines:
- The Member States shall develop a framework for the evaluation of the influence of RFID technology on privacy and data protection. With the help of this framework, Users of RFID can assess their technologies with regard to their consequences, and in particular how they can be used for the surveillance of individuals. This assessment shall be presented to the national data protection authorities. The result of the assessment is decisive for potential further obligations of the User.
- Users of data protection-relevant RFID technology must ensure that RFID chips are deactivated automatically and free-of-charge in the shop, unless the customer desires to keep them activated (Opt-In).
- Users of data protection-relevant RFID technology shall be obligated to publish information guidelines regarding their use of RFID, containing detailed information on the name of the User, the purpose of use, details on the processed data and on the potential risks for privacy, and on respective possibilities to minimize the risk for the individual.
- A common sign indicating the use of RFID in products and applied to the products shall be created.
- The Member States, together with the industries and relevant stakeholders, shall motivate the introduction and support of the “security and privacy-by-design” principle.
The Member States must inform the Commission of the contemplated measures for implementation of the recommendation within two years of its publication. If the recommendation is not implemented accordingly, shops and manufacturers will face costly changes because of the labeling of RFID technology and respective deactivation in the shops. It should be expected that the Commission will become active if the Member States fail to implement respective measures to introduce the recommendation.