Smart chips to respect individual privacy, states EC

A set of strong recommendations have been issued by the European Commission to ensure those involved in the design or operation of technology using smart chips respect the individual’s fundamental right to privacy and data protection.

Smart chips, or radio tags, can, and already do, have a huge impact on business tasks, public services and consumer products making every day life simpler, the EC explained. They are in the passes you use to enter your office and the smart cards that pay highway tolls.

There are already over six billion smart chips, or radio tags, microelectronic devices that can be integrated into a variety of everyday objects from fridges to bus passes. With radio frequency identification (RFID) technology, they can process data automatically when brought close to ‘readers’ that activate them, pick up their radio signal and exchange data with them.

Viviane Reding, EU Commissioner for Information Society and Media, stated: “A promising technology for the future, smart chips can make life simpler in all sorts of ways. We are talking about everyday objects suddenly becoming smart by connecting to a network and exchanging information. Think of smart-fridges that inform you your milk is past its use-by date or smart-food packaging warning parents about possible allergies.”

She continued: “There is clear economic potential in using small, smart chips to allow communication between objects. But Europeans must never be taken unawares by the new technology. This is why the Commission issued strong recommendations to the industry today. European consumers must be confident that if and when their personal data is involved, their privacy will be impregnable also in a changing technological environment. The Commission therefore wants RFID technology to empower consumers to control their data security, which is the best way to make sure it is an economic success.”

The Commission’s principles include that consumers should be in control whether products they buy in shops use smart chips or not. When consumers buy products with smart chips, these should be deactivated automatically, immediately and free of charge at the point of sale, unless the consumer explicitly opts-in by asking to keep the chip operational. Exceptions can be granted to avoid unnecessary burden on retailers, for example, but only after an assessment of the chip’s impact on privacy.

Companies or public authorities using smart chips should give consumers clear and simple information so that they understand if their personal data will be used, the type of collected data (such as name, address or date of birth) and for what purpose, the EC stated. They should also provide clear labelling to identify the devices that ‘read’ the information stored in smart chips, and provide a contact point for citizens to obtain more information.

The principles also state that retail associations and organisations should promote consumer awareness on products containing smart chips through a common European sign to indicate whenever a smart chip is used by a product.

Companies and public authorities should conduct privacy and data protection impact assessments before using smart chips, the EC recommended. These assessments, reviewed by national data protection authorities, should ensure that personal data is secure and well protected.

Some 2.2 billion RFID tags, such as the ones used at toll booths or to identify shipping containers, were sold worldwide in 2008, roughly a third of these in Europe. The worldwide market value for RFID tags is estimated to be of €4 billion in 2008 and to grow to about €20 billion by 2018.

Member states now have two years to inform the Commission on the steps they intend to take to make sure that the objectives of the Recommendation are met. Within three years, the Commission will report on the recommendation’s implementation, including an analysis of its impact on companies and public authorities using smart chips as well as its impact on citizens.