Brussels, 21/02/2008 (Agence Europe) - Given the importance of the subject, the European Commission has decided to submit its proposal for a recommendation on Radio Frequency Identification (RFID) to public consultation. The recommendation is to be adopted by summer 2008. It focuses on the questions of respect of private life, data protection and the security of information relating to the deployment of RFID technology. It does not cover the other major political aspects that were tackled in the communication entitled “RFID in Europe: steps towards a policy framework” (see EUROPE 9387).
In its main lines, the recommendation stipulates that RFID cannot be implemented without an impact assessment being carried out beforehand, in order to determine the consequences that it would have on respect of privacy and the protection of personal data, and to assess whether application can be used to follow up a person. Furthermore, commercial associations that apply RFID technology must establish in agreement with the civil society (trade unions, consumer associations) specific codes of conduct for the different uses of RFID. These codes of conduct must integrate measures aimed at informing consumers concerned of applications that concern them and of their right to refuse RFID application. In the same manner, when RFID applications are used in public areas, operators must inform individuals that the technology is in use by providing a clear signal of such use, accessible to all, indicating the presence of RFID equipment, and giving the precise purpose of RFID use. Where a RFID application processes personal data or the privacy impact assessment shows significant likelihood of personal data being generated from the use of the application, the retailer has to follow the criteria to make the processing legitimate and deactivate the RFID tag at the point of sale unless the consumer chooses to keep the tag operational.
The Commission opened a first consultation on RFID in 2006 for the development of its communication. It had promised, after the consultation, to take into account the observations made on risks raised by the use of this technology for private life, data protection and security by adopting a recommendation, subject beforehand to another consultation procedure. The latter will be completed on 25 April 2008. (I.L.)