Thanks to the power of pocketbook and protest, privacy advocates and concerned consumers are winning their war on RFID tags
On Feb. 28, a small but boisterous band of civil libertarians braved bitter cold and more than a foot of snow to protest outside the Rheinberg, Germany, store of supermarket giant Metro AG. Protestors chanted and waved signs emblazoned with slogans such as "Hands Off Privacy," "1984 Orwell, 2004 Metro", and the one that spelled out the grievance most plainly, "Stop RFID."
Their concern is the radio frequency identification tags hidden in store loyalty cards, shopping carts, and on packages of Kraft's (KFT ) Philadelphia cream cheese, Procter & Gamble's (PG ) Pantene shampoo, and Gillette (G ) razors. Activists fear that the tiny chips, which are equipped with even tinier antennas that beam unique identification information to scanners, could be used to track how they shop and what they buy.
"WE AREN'T THE CIA". The chips are just one of the advanced technologies on display at Metro's Store of the Future, which also offers CD barcodes that cue up music samples when swiped at a kiosk, plus scales with embedded Web cams that first identify fruits and vegetables, and automatically print out price labels. But as Metro is learning, RFID chips are the most controversial.
On Feb. 27, just hours before the protest, Metro announced that it would stop testing RFID loyalty cards and replace the 10,000 that have already been issued with versions using old-fashioned bar codes -- a decision that makes it the latest retailer to accede to consumer concerns about the technology. Last year, after being hounded by Katherine Albrecht, a New Hampshire homemaker turned RFID-detractor-in-chief, Italian fashion chain Benetton (BNG ) and U.S. retail giant Wal-Mart (WMT ) also announced they would, at least for now, use RFID tags in storerooms but keep them out of their stores (see BW Online, 7/21/03, "Playing Tag with Shoppers' Anonymity").
Metro spokesman Albrecht von Truchsess insists that the decision to ditch RFID loyalty cards isn't a reaction to "people like Katherine, but to the emotional outpouring" that erupted after privacy campaigner noticed the RFID loyalty cards on a Jan. 29 tour of the Rheinberg store. "We're working to apply RFID to track and trace goods from the manufacturing plant to the store and onto the shelf. It's about product data, not customer data," says Truchsess, who maintains that the chips were only put in the cards to prevent children under 16 from watching adult-rated movie clips at store kiosks. "We aren't the CIA," he adds.
CREAM-CHEESE CONFIDENTIAL. Whatever the motivation, it's clear that industry is finally getting the message: RFID is fine for pallets of goods in a warehouse, but not for people. In an age of ubiquitous surveillance cameras, government tracking systems, and biometrics, consumers dislike the idea that they can be tracked via packages of cream cheese, razor blades, and shampoo.
State legislators share this dislike, too. On Feb. 24, the Utah House of Representatives passed a bill mandating clear labeling of any product in which an RFID chip is embedded. A bill introduced on Feb. 27 in the California Senate goes further, arguing that retailers should need consumers' permission. "Until Metro, I think the industry was still holding out hope that the opposition to RFID was confined to the U.S.," says Albrecht. "Now, I think they've got it through their heads that this is really not going to work anywhere."
A close look at the bill in California, which is so often the leader on consumer privacy issues, shows what the future of RFID might look like. The proposal is sponsored by Sen. Deborah Bowen (D-Redondo Beach), a long-time privacy activist who authored a crucial bill, now in effect, that forbids organizations from using Social Security numbers as identification (see BW Online, 8/14/03, "Why Your ID Is Such Easy Pickings"). The new bill requires any business or state agency that uses an RFID system to track products and people to follow three rules. First, tell people that RFID is tracking and collecting information about them. Second, get express consent from customers before doing that. Third, detach or destroy tags before the customer leaves the store.
MARKET POWER. Though some retailers may agree in principle with Bowen's proposals, they aren't likely to support regulations governing how they can and can't exploit RFID technology. But Bowen warns that without some sort of legal protection, RFID will be the next privacy bomb to explode: "There's no reason to let RFID sneak up on us," she says, "when we have the ability to put some privacy protections in place before the genie is out of the bottle."
Gaining such high-profile allies as Bowen -- plus the begrudging cooperation of big retailers -- is a giant step forward for anti-RFID groups such as Albrecht's CASPIAN (Consumers Against Supermarket Privacy Invasion & Numbering). But Albrecht warns that despite her recent victories, the battle over RFID is far from over. "We've accepted RFID in the supply chain," she says. "I think they're hitting the point where they will cede that chips must be killed after the point of purchase. The next battle will come over what happens in the store. Who does [the data] belong to? The store or the consumer?"
Legally, it belongs to the store. The U.S. Supreme Court has ruled time and again that individuals have no reasonable expectation of privacy in public venues. That's why RFID detractors such as Albrecht say they're prepared to use their buying power to stop practices, such as covert tracking of shoppers, which they consider anticonsumer. "We're fully grasping the power of the free market," she says. "Our message is: You can do what you want, but we're not going to shop at your stores unless you take our concerns into account."
It's a strategy that has worked well for the anti-RFID lobby so far. From Wal-Mart stores in California to the Metro supermarket in Germany, CASPIAN and others have forced retailers to feel their pain or feel their wrath. Expect further concessions as privacy advocates flex their muscle.
----------------------------------------------------------------------
Black covers privacy issues for BusinessWeek Online in her twice-monthly Privacy Matters column http://www.businessweek.com/bwdaily/list/privacy01.htm
Jane Black
Business Week, 05. März 2004
Original: http://www.businessweek.com/technology/content/mar2004/tc2004035_8506_tc073.htm