You may have seen RFID tags referred to in the press as ways in which supermarkets can track goods. Concern has been expressed about the use of these tags to track people’s movements.
What are RFID tags?
Radio Frequency IDentification tags are used to identify and locate items using radio signals. They consist of a microchip and an antenna which transmit a signal to a ‘reader’. RFID tags have been suggested as replacements for barcodes in some areas: because they use radio waves, RFID tags can be ‘read’ out of the line of sight and at distances ranging from a few centimetres to over 100 metres. They also enable individual items to be given a unique identification number, rather than just a product code.
How are they used?
RFID tags are currently used in a wide range of applications, including in prepaid smartcards, for monitoring livestock, keeping track of passenger baggage at airports, and in pharmaceuticals and event tickets as an anti-counterfeiting measure. However, the most widespread usage is by retailers and wholesalers, who use RFID to track pallets of goods between stores and warehouses. Some retailers have also used these tags on individual items, to make sure stores are alerted to dwindling stock levels.
How is my personal information involved?
In most of the current applications there is no personal information involved. The tags used in stock monitoring carry only an electronic product code (EPC), whose numbers represent the manufacturer, product and individual item.
One current use of RFID involving personal information is in prepaid smartcards, used especially for travel purposes. These systems will typically store account information and personal details, either on the card itself or in an associated database, as well as records of journeys made using the card.
RFID chips storing personal information including a digital photograph are embedded in new electronic passports.
Should I be told about them?
Where personal information is stored on RFID tags or on the databases to which they refer, it must be used fairly. This means that you should be informed by any party who collects or stores your personal information using RFID. For example, if a supermarket wanted to record information about individual customers’ purchases using RFID tags on products, they would have to tell their customers why they were doing so. Personal information stored using RFID should also be accurate, up to date, and not kept for longer than is necessary.
Who can scan them?
In theory, anyone with a suitable reader can scan an RFID tag. It will be the responsibility of those collecting any personal information to make sure it is kept secure. This might be achieved by technological measures, including electronic passwords to safeguard access. RFID chips that remain in use indefinitely can be surrounded by radio frequency shielding material. A barrier layer of this sort will be used in new US passports to prevent biometric information being read unless the passport is opened.
In many cases, an RFID tag will merely carry a reference to an external database in which information is stored. This makes the information more secure because someone would need to access the database as well as the information on the tag.
Can they be removed?
Yes. Some stores have made clear that their labels containing RFID tags can be simply thrown away and have given customers the opportunity to have the tags removed at the checkout.
Another option is to disable or ‘kill’ tags. A reader sends a ‘kill’ signal to the tag, shutting it down permanently. This is incorporated as standard in many of the RFID tags currently in production. Other means of temporarily deactivating tags are currently being developed.
Could I be tracked using RFID?
RFID tags do not enable continuous monitoring of people’s whereabouts. An Oystercard, for example, will record that the holder got on the tube at Euston and exited at Waterloo, where the card is scanned, but will not enable anyone to watch your movements during the journey.
In theory it would be possible to track an individual’s movements with RFID, but in many respects this is problematic. A large network of readers would be needed to pick up a meaningful series of signals, and could be adversely affected by environmental conditions. For people to be tracked without their knowledge, functional RFID tags would also have to be routinely found on clothes or other consumer items. However, this scenario is not likely in the immediate future and many doubt whether it will ever arrive. In the event of both readers and tags becoming so widespread, public knowledge of the possibility of tracking by RFID would be difficult to prevent.
If tags on everyday items such as clothes were to be used to track people, the read range of the tags would need to be greatly increased. At the moment the tags used in retail cannot be read by standard equipment from more than a metre away. Even the most powerful readers can currently extend this only a short distance.