Canadian Provinces New RFID Privacy Guidelines Could Have the Wrong Effect (
Page 1 of 2 )
Updated: Opinion: Warning consumers about anything presupposes that there is something bad about that item, something that should be avoided. This might be a self-fulfilling prophecy.The commissioner for Information and Privacy in Ontario unveiled June 19 a
series of tips and guidelines for using RFID within her part of Canada.
First of all, the fact that a major Canadian province even has an information and privacy commissioner makes me look longingly to the North.
But I believe bacon should be served in long, narrow strips, so were probably even.
The guidelines themselves certainly need to be examined seriously, because North American products can ill afford to accommodate two different standards, and besides, neither Mexico nor the United States has any material privacy RFID rules at the moment.
Current U.S. views on RFID privacy pretty much come down to a modified monetary laissez-faire policy ("leave campaign contributors alone and the market will take care of itself"), while Mexicos position is closer to "You can capture anything about our citizens that you want as long as you pay a living wage. OK, one-fourth a living wage, but we want a break after 18 hours of work."
The Ontario approach is a bit different. One example: "Organizations should only collect, use or disclose RFID-linked personal information for purposes that a reasonable person would consider appropriate in the circumstances."
It then lists two things that Ontario believes would be unreasonable: "price discrimination" and "tracking and profiling individuals without their informed, written consent."
Both sound frightening for retailers and consumer goods manufacturers—and with good reason.
The "price discrimination" is aimed at applications that will charge lower prices to customers they want to attract and higher prices for those they want to repel, such as aggressive bargain hunters.
There have been unsubstantiated allegations about this on some Web sites, but those allegations involved cookies, not RFID.
Still, the potential exists for RFID to enable the same kind of capability. But isnt this simply a continuation of the time-honored discounts for those with a frequent shopper loyalty card?
Arent those card programs offering discriminatory pricing, in the sense that some customers are being charged different prices than others?
That gets into that second reference: " tracking and profiling individuals without their informed, written consent."
Is this to be interpreted to mean that such tracking/profiling is permitted in Ontario, as long as it doesnt involve RFID?
It would seem silly to permit it for CRM programs as long as they used barcodes, but to somehow find the privacy invasion reprehensible if it involves RFID.
Tracking and profiling are fighting words. Is it profiling to offer discounts on one brand of peanut butter only for people who regularly purchase a particular competing brand?
Is it tracking to note that one consumer spends more than $900 per month typically and then to send them e-mail invitations to some event?
The wording in the Canadian material doesnt exclude aggregate data, but isnt that based on tracking individuals? Is that prohibited as well?
For retailers, Ontario has rolled out a series of "notice" guidelines: "organizations should notify consumers if products contain an RFID tag, through clear and conspicuous labeling on the product itself"; "Organizations should notify consumers of RFID readers on their premises, using clearly written signage, prominently displayed at the perimeters"; "signs at the perimeter should identify someone who can answer questions about the RFID system, and include their contact information"; and "consumers should always know when, where, and why an RFID tag is being read. Visual or audio indicators should be built into the operation of the RFID system for these purposes."
Somehow, I think the immediately prior draft wanted skull and crossbones on those signs and perhaps some imagery representing Satan (I guess for P&G, their old logo would suffice.)
Those are quite subtle notification suggestions. My favorite is the part about identifying someone who can answers about the RFID system. I can see Wal-Mart directing people to an 800 number and instructing them to hit #Sand.
Next Page: Why bad notifications can be worse than no notification.
Enterprise Applications 
