WHEN BIG BROTHER PRIVATIZES: COMMERCIAL SURVEILLANCE, THE PRIVACY ACT OF 1974, AND THE FUTURE OF RFID

Abstract

RFID is a powerful new technology that has the potential to allow commercial retailers to undermine individual control over private information. Despite the potential of RFID to undermine personal control over such information, the federal government has not enacted a set of practicable standards to ensure that personal data does not become widely misused by commercial entities. Although some potential privacy abuses could be addressed by modifying RFID technology, this iBrief argues that it would be wise to amend the Privacy Act of 1974 so that corporations would have a statutory obligation to preserve individual anonymity and respect the privacy preferences of consumers.

Introduction

¶          Modern technology is about to dethrone the old adage that 'money makes the world go round.' In some countries, the more apt adage may very well soon turn out to be 'RFID makes the world go round.' RFID, shorthand for "radio frequency identification technology," is already being used as a mandatory substitute for money in some private establishments in Japan.² This simple yet remarkable technology consists of a small microchip, a protective sheath or container, and a miniature embedded antenna; these components taken together are referred to as RFID tags.³ RFID tags are capable of transmitting electronic-product-code (ePC) information to RFID readers--devices designed to store, process and archive tag data.⁴ Since these tags are often quite small--the most technologically sophisticated variants are now just the size of a grain of rice⁵ it is easy to see why they have been heralded as a fantastic replacement for traditional currency: if our currency can be embedded in a tiny RFID tag, it will be both difficult to steal, eminently portable, and easy to replace in the event the tag is lost or destroyed.

¶          In addition to providing one technological solution to the search for a workable form of "digital money," RFID has also been used to monitor everything from commercial purchases⁶ to the physical movements of government officials⁷ to the misadventures of naturally curious children.⁸ In February of 2005 the U.S. State Department revealed a plan to embed RFID chips in every newly issued U.S. passport, thereby broadcasting on demand the names, addresses, and digitized photos of all American citizens to a database--ostensibly⁹ so that borders can be more effectively managed and threats to national security more readily prevented.¹⁰ Data storage and transmission functionality, however, is only the beginning. In addition, DeltaTRAK recently announced that it has developed an RFID-based system for detecting food spoilage during transit by monitoring temperature and humidity fluctuations in food containment units.¹¹ Further, IBM and EPC Global, the most powerful RFID standards-setting organization, recently unveiled a plan to "create a database that contains the life history of a product," thus providing businesses with a new way to streamline business supply chains.¹² All things considered, RFID is a promising technology many of us may soon be using to keep tabs on virtually everything that is important to us--our kids, our finances, our loved ones, and perhaps even our periodically wayward political figures.

¶          Nevertheless, RFID is also a technology that could easily be abused. For instance, if private companies embedded RFID tags in products deemed dangerous or socially harmful, the implementation of a centralized database of consumer purchasing patterns could be justified to allow the government to track such purchases. This could have the unwelcome effect of subjecting all consumers to suspicionless monitoring; however, it should also be noted that for some products--e.g., firearms and chemicals commonly used to make explosives--RFID could also provide just the kind of highly accurate tracking system that would benefit society. In any event, credible evidence that private companies intend to deploy this new technology as widely as possible is mounting.¹³ Moreover, it is also clear from a number of pilot tests in Europe that corporations are eager--without customer consent or authorization--to embed RFID chips in loyalty cards to monitor purchasing habits.¹⁴ 

¶          Under current privacy law, it is unlikely that consumer groups would have the power to prevent private companies from adopting RFID technology for a number of interlocking reasons. First, the Privacy Act of 1974 ("Privacy Act" or "Act")¹⁵--the most comprehensive U.S. law pertaining to privacy--does not apply to private entities, but rather only to government agencies or government-controlled corporations.¹⁶ Thus, private corporations are not bound by the fair information practices, open-access rules, and data-ownership principles embodied in the Act.¹⁷ But even if they were, consumer groups would arguably have a difficult time preventing private companies from gathering data, since the Act does not in principle proscribe data collection but merely proscribes a narrow subset of data misuse.¹⁸ Second, constitutional protections are of little use since the type of data that RFID is capable of collecting is publicly ascertainable, and therefore probably not subject to protection under current Fourth Amendment jurisprudence.¹⁹ Third, even in jurisdictions that recognize the torts of intrusion and the appropriation of private facts in consumer contexts,²⁰ consumers would only be able to recoup damages ex post; tort law is thus of no help in preventing data aggregation per se.²¹ This third feature of our privacy regime is particularly discomfiting given that many of the recent private initiatives designed to mitigate the dangers of data collection through technological solutions have been wholly unsuccessful and fail to embody sound privacy values.²² 

¶          There are two broad threats to privacy posed by this new technology. First, under our current privacy regime private companies are at liberty to gather, process, and share customer data without obtaining customer consent to specific data aggregation, archival, and sharing policies and procedures.²³ This feature of our privacy regime is particularly vexing given that we live in an era in which identity theft is particularly common²⁴ and extremely hard to prevent²⁵ thus control over private data is extremely important. Second, the absence of meaningful regulation of new surveillance technologies, particularly RFID, is having a profound effect on the broader social norms that privacy protects. Private facts about consumer preference patterns are currently treated as cost-free commodities for corporate America: companies need not pay for the privilege of aggregating and using data, nor is consumer consent regarded as necessary because consumer surveillance has already been presented as a common practice that is usually in consumers' best interests.²⁶

¶          This iBrief argues that meaningful statutory regulation is necessary for private-and public-sector RFID programs that collect consumer data for purchase forecasting, preference modeling, and risk profiling. The form that effective regulation should take is a matter of dispute, but two models will be explored, a control oriented model and a choice oriented approach.²⁷ Under the control oriented model, the Privacy Act should be amended to embody privacy-protecting principles that preserve the values of anonymity, seclusion, and control over certain types of personal information. Under the choice oriented model, the Privacy Act need only be amended in the most minor way--that is, to require corporations to obtain explicit authorization from consumers before gathering or using their private information. Although both of these approaches toward new regulation could very well involve modifying RFID technology, the status of informational privacy as a public good requires that basic, fundamental control rights be given the imprimatur of law even where technological safeguards serve as part of a meaningful solution.

¶          This iBrief is segmented into three sections. Part I explores the historical development and current capabilities of RFID. Part II considers the implications of this new technology for privacy. This section focuses on the potential for RFID to serve in the near future as the primary tool for tracking physical objects and people; specifically, this section explores the arguments weighing in favor and against the control and choice-oriented approaches to regulating consumer privacy. Part II ultimately advocates a control-oriented model of privacy protection is advocated in this Part, mainly in light of the potential for mass consumer surveillance to become a central feature of commerce in the near future if decisive legislative action is not taken. Finally, Part III proposes an amendment to the Privacy Act of 1974 and explores the advantages and disadvantages of such an amendment.

I. The Capabilities of RFID Technology

¶          The powerful object identification and tracking capabilities of RFID are made possible by a discovery made just before the outbreak of World War II. Scientists at that time discovered that radio waves can be used to identify specific objects in the physical world if those objects are affixed with unique identifying numbers or codes.²⁸ As long as an object has a unique number associated with it, accurate identification would be a very simple affair.²⁹ This discovery proved quite useful in the World War II, since the United Kingdom needed an effective, reliable way to distinguish its own fighter planes from inbound German fighters.³⁰ RFID fit the bill because it allowed for the reliable, remote identification of objects.³¹ 

¶          RFID was never adopted as the standard for object identification. In the 1970s, the bar code--or Universal Product Code (UPC)--became the most widely used method for identifying and tracking objects as they passed through commercial channels.³² UPC labels were never the ideal technology for managing supply chains and monitoring inventory, for three simple reasons: 1) the labels themselves are easy to disfigure or disable, 2) UPCs must be read at a certain angle, slowing down the monitoring process considerably, and 3) UPCs are typically read sequentially--meaning that multiple UPC labels cannot be read simultaneously.³³ 

¶          RFID is a much more robust technology. While RFID tags can be disabled through physical abuse or destruction, they need not be read at an angle and they can be read simultaneously. The typical system includes tags, an antenna, and a reader or scanner.³⁴ Tags, usually miniature silicon chips affixed to micro-antennae, come in two varieties--active and passive.³⁵ Active tags contain a power source that enables them to send data without being prompted by a reader; passive tags cannot transmit data themselves but are merely read by local reading devices.³⁶ Active and passive tags usually have read-write capability, a feature that is extremely appealing given the advent of the electronic product code (ePC). The ePC is a 96-bit numerical code saved onto the RFID tag itself, and is best viewed as an extension of the current UCC-12 protocol for naming and tracking objects globally.³⁷ The advantages of using RFID tags in conjunction with the ePC are numerous: not only can these small, often unnoticeable tags be logged without cumbersome physical manipulation, most RFID systems can read ePC numbers through fog, snow and even paint so long as the tags themselves are within standard read range.³⁸ 

¶          ODIN Technologies, an RFID systems integrator based in Reston, Virginia, recently released a comprehensive performance study of eight different tag-types.³⁹ The study revealed what many industry analysts had been expecting to hear: the best passive tags can be read from multiple angles and while moving at considerable speed--from 600 to 1200 feet per second.⁴⁰ Yet even though passive tags can be read very quickly, they generally cannot be read from very far away unless they operate on the higher frequencies. High frequency tags can currently be read from up to 3 or 4 meters away,⁴¹ though in the near future technological improvements will make it feasible to read high frequency tags from a greater distance.⁴² RFID is thus an extremely powerful technology that allows for the quick and accurate identification of physical objects--from foodstuffs to clothing to electronic gadgets. To get a sense of just how powerful this technology is, imagine for just a moment a machine that could instantly identify the origin, cost, and properties of every consumer item carried (electronic gadgets, e.g.), worn (clothing, e.g.), or consumed (food and drink, e.g.). That machine is RFID. And the technology to make that machine exists today, right now.

¶          The potential range of uses for RFID technology is hard to predict at this nascent state of development. But there are a number of important uses already underway:

1. GENERAL TRACKING AND SECURITY PURPOSES: Tagging airline baggage, prisoners, cars for tollways,⁴³ and tagging at the pallet level all goods and products destined for delivery to the U.S. Department of Defense.⁴⁴ 
2. ANTI-FRAUD MEASURES: Combating drug counterfeiting in the pharmaceuticals industry.⁴⁵
3. STREAMLINING BUSINESS PROCESSES: Improving inventory control and reducing inefficiencies in the drug industry due to overstocking or expiry.⁴⁶
4. CURRENCY SUBSTITUTES: Providing a substitute for regular money.⁴⁷
5. BORDER SECURITY: Ensuring that low-risk individuals are able to safely traverse major international borders.⁴⁸
6. ENVIRONMENTAL INTEGRITY: Creating new ways of ensuring that toxic substances are not illegally dumped into the environment.⁴⁹ 
7. HUMAN MONITORING: Establishing new methods for track the movements and behavior of children.⁵⁰ 

Each application of RFID has the potential to be beneficial by increasing safety and accountability, as well as the potential to violate forms of privacy worth protecting.

¶          The most recent controversy over RFID emerged when the FDA announced its approval⁵¹ of the VeriChip, an implantable device carrying a unique key that hospitals and other health-care providers could use to instantaneously access medical records in an emergency situation.⁵² Privacy advocates responded to this new development by pointing out a host of potential problems with implanting such a chip: 1) VeriChip is not medically safe⁵³ 2) the potential for unauthorized access to medical records is a serious drawback of the system⁵⁴ and 3) without effective regulation prior to the wide-implementation of these implants, the likelihood of invasive data aggregation, improper violations of anonymity, and other violations of personal privacy is very high.⁵⁵ 

¶          Of course, critics of RFID technology often overlook or intentionally downplay the fact that extremely Orwellian RFID systems would require an integrated network of readers in addition to the ubiquitous affixation of tags. For an individual's personally identifiable information to be transparent, tags must be 1) affixed to physical objects, 2) close enough to readers to transmit whatever information they contain, and 3) not covered by fabric or obscured by other materials that interfere with data transmission. But such critics accurately portray RFID as a technology that in its current and prospective uses represents a way for corporations to keep tabs on its clientele without any pro tanto benefit for ceding personal data.

II. Understanding What RFID Means for Consumer Privacy

¶          If RFID were to become pervasive, it would certainly be one of the most powerful single modalities of surveillance. Where video surveillance is hobbled by the current limitations of facial recognition technology, even passive RFID tags could allow for accurate identification of individuals in a reader-rich environment.⁵⁶ Where paying cash for consumer purchases allows one to avoid leaving an electronic trail for interested parties to investigate, RFID may in Europe soon be embedded in currency, leaving no option for the privacy-conscious consumer who wants her purchases to remain anonymous.⁵⁷ And where individual credit card companies are only able to analyze and assess data about the purchases you make with your particular credit card, a well-designed RFID reader-environment could very well assemble a comprehensive picture of your purchasing preferences.⁵⁸ For example, a store equipped with a number of strategically placed RFID readers could assemble a portrait of a particular consumer's preferences by tracking what items she selected while in the store and then making special offers on the basis of that portrait at the checkout counter. Given that RFID readers have recently been miniaturized, it is not difficult to imagine companies--particularly businesses like Target and Walmart--placing RFID readers at store entrances and exists, and at strategic points along store aisles for targeted-advertising purposes.⁵⁹ 

¶          Even without a reader-rich environment, RFID is an especially invasive technology because it threatens to make it extremely easy for companies to gather, archive and utilize private data in three ways. First, embedding RFID tags in consumer goods allows companies to learn precisely what customers are buying by conditioning discounts and special offers upon revealing personal information that a consumer would otherwise want to remain private.⁶⁰ As noted above, such knowledge allows for highly efficient targeted-advertising, which some regard as an annoyance and others as a significant invasion of privacy. Regardless of whether such advertising is regarded as invasive by a particular customer, the lack of privacy protection represents an unfair burden on privacy-conscious consumers: to object to RFID-enabled consumer surveillance, customers would have to forfeit the benefits associated with purchasing items from a particular store or carrying a tagged discount card. In other words, even if RFID readers only appear in department and outlet stores, the perceived and real costs of opting-out will be enough to coerce customers--customers who would otherwise not want their purchasing patterns archived--to accept this new technology on whatever non-negotiated terms retailers offer.

¶          Second, and closely related to the first objection, under extant privacy law companies could offer an opt-out policy but then lawfully shift the costs of opting out of a scheme like RFID to non-consenting consumers. This could be done in a number of ways. For example, companies already offer discount cards to customers that provide personal information. The cost of offering discounts could be offset by customers who opt-out of RFID-enabled discount programs. Alternatively, mathematical forecasting models could predict the expected economic impact of (1) opt-out rates on RFID-card discount programs and (2) item-level tagging on gross revenues to spread the costs--i.e., expected diminution in sales--of adopting RFID by increasing the price of goods.⁶¹ In short, current privacy law allows companies to sidestep consumer resistance to RFID with the help of economic forecasting.

¶          Third, since increased advertising has a marked effect on purchasing patterns,⁶² and advertising generally is subject to protection under the First Amendment, existing privacy law actually subsidizes corporate speech where RFID is utilized as a technique for enhancing marketing efforts. Privacy law subsidizes corporate speech because the technologies of advertising--in this case RFID--are paid for, in one way or another, by customers, and not by the private interests who benefit from those new advertising methods.⁶³ To be sure, privacy law does not have the effect of subsidizing corporate speech (advertising) in cases where the costs of marketing methods is not borne by a company's target market. But in cases where such costs are shouldered by consumers, corporate speech is certainly being subsidized. Put another way, if meaningful legislation giving consumers an opt-in right is not enacted, private companies could, without abrogating any law or legal principle, stealthily cajole consumers into supporting marketing efforts designed, ironically, to induce those very same consumers to spend more money.

¶          This discussion assumes, of course, that the terms offered will be unsavory to the privacy-conscious consumer. In practice, this may not always be the case. However, the argument of this iBrief does not turn on empirical facts about how many private companies are likely to provide a quid pro quo that privacy-conscious consumers find unappealing. Rather, the argument here turns on whether consumers should have to cede even more information to private companies than they already do. Critics of this argument could argue that consumers already give away much private information to private companies through opting-in to discount-card programs at retail outlets. There is some truth to this, and indeed it would be odd to claim that the privacy threats posed by ordinary discount-cards and RFID technology are radically different. Nevertheless, there are two powerful ripostes to this criticism. First, because RFID tags are embedded in objects customers cannot decide in a particular circumstance to retain their privacy--as they surely can with discount-cards by not using them at the cash register. Second, a technological standard for RFID tags is likely to emerge in the near future that would allow retailers to "read" the RFID tags of other retailers, thus learning the consumer preferences of their competitors' customers without the permission of those customers. In short, RFID is a technology that provides retailers a way to avoid ever asking their customers to provide any consent whatsoever to commercial monitoring practices.

¶          Given that (1) consumers are not provided with the choice to opt-in, (2) there are no safeguards in place to prevent companies from passing on the costs of RFID to consumers, and (3) the lack of such safeguards amounts to a mandatory subsidy of commercial speech, a control-oriented approach should be adopted in amending the Act. A control-oriented approach would enhance consumer autonomy by providing an opportunity for consumers to opt out and it would prevent companies from passing on the costs of RFID to consumers in a furtive effort to subsidize commercial marketing efforts. In other words, a well-crafted amendment would address each of the three concerns previously examined.

III. East Coast v. West Coast Code: How Should RFID Be Regulated?

¶          Privacy law scholars familiar with technology have traditionally made a distinction between 'East Coast' code, that is, legal regulations that govern access to personal information, and 'West Coast' code, that is, the body of rules and constraints built directly into a particular technology. Both types of code can be helpful in regulatory contexts, and each has its own virtues and demerits. But even though West Coast code is sometimes helpful in protecting liberal democratic values--including privacy, free speech and personal dignity--in many instances this code will not effectively protect our values if not induced by law, by East Coast code, to do so.⁶⁴

¶          Complicating this picture somewhat is the fact that EPCglobal, (formerly known as the Auto-ID center⁶⁵ a research consortium consisting of 5 major universities and over 100 private companies, has suggested that all RFID devices affixed to consumer goods include a kill switch.⁶⁶ This switch would deactivate the tag immediately after a purchase was completed, thereby making it impossible for companies to learn the origin, price, and unique identification number of clothing items, personal electronic devices, and other objects owned by customers.⁶⁷ Privacy initiatives such as these are certainly well-intentioned, and the technological fixes they suggest are often quite reasonable. But these initiatives share a common weakness: private companies are not bound to abide by principles they voluntarily adopt.

¶          Current privacy law consists of federal laws and regulations--including the Privacy Act of 1974 ("Act"),⁶⁸ the Electronic Communications Privacy Act of 1986⁶⁹ ("ECPA"), the Fair Credit Reporting Act of 1970⁷⁰ ("FCRA") and the Health Insurance Portability and Accountability Act⁷¹ ("HIPPA")--as well as private tort law. Subsection A examines whether existing federal regulations and private tort law are sufficient to address the privacy implications of RFID. Subsection B introduces a proposed amendment to the Privacy Act, and considers how effective such an amendment might be in preventing RFID abuses.

A. The Limits of Extant Privacy Law

¶          Existing privacy law is not flexible enough to cover potential abuses of RFID. Consider first the federal laws and corresponding regulations that constrain data collection. The Act, as mentioned earlier, does not apply until data or information has been collected.⁷² According to the Government Accountability Office, "the Privacy Act is likely to have a limited application to the implementation of RFID technology because the act only applies to the information once it is collected, not to whether or how to collect it."⁷³ The Act provides citizens a right to review private information collected by government agencies,⁷⁴ and a concomitant right to correct misinformation,⁷⁵ but the Act does not currently contemplate the myriad dimensions of data privacy implicated by new surveillance technologies.⁷⁶

¶          The ECPA and the FCRA do not fare any better. The ECPA provides a number of important regulations for electronic communications, including a general bar against peddling personal information culled through electronic transactions.⁷⁷ Unfortunately, "information" under the EPCA only refers to the contents of communications; transactional records can lawfully be disclosed, even sold, so long as the purchaser is not the federal government.⁷⁸ Thus, while RFID systems capable of recording consumer conversations could very well fall under the ECPA, this statute could not readily be used to prevent companies from culling and sharing transactional data.⁷⁹ Similarly, FCRA, would not be of much help. In addition to being designed for a completely unrelated regulatory purpose the FCRA does not even constrain what third-party payment providers can do with sensitive consumer information,⁸⁰and courts have consistently held that such information can be exchanged with impunity as long as a "legitimate business interest" can be identified.⁸¹ 

¶          Robust opt-in rules, however, have been adopted for healthcare information under HIPAA. In fact, HIPAA's privacy rule⁸² requires health care providers to obtain explicit consent prior to using or disclosing sensitive health information.⁸³ The privacy rule is far from toothless, as HIPAA⁸⁴ provides for stiff civil and criminal penalties for violations of patients' privacy rights.⁸⁵ The privacy rule prohibits the use or disclosure of health information which identifies or can be associated with a particular individual without prior consent, requires that healthcare providers and health-information clearinghouses take reasonable steps to notify individuals of their privacy rights, and requires that a report be made to patients whenever there is an intentional or negligent disclosure of their data.⁸⁶ But unfortunately, HIPAA's privacy rule only covers health-care information; it is not a generally applicable privacy law.⁸⁷ 

¶          Tort law and Supreme Court jurisprudence have proven disappointing as well. Tort law recognizes four different kinds of privacy violations, including (1) intrusion upon seclusion, (2) public disclosure of private facts, (3) appropriation of name or likeness, and (4) publicity that places another in a false light.⁸⁸ Some scholars have argued that the first tort--intrusion upon seclusion--could in theory be actionable without a violation of one's physical space.⁸⁹ This argument would be specious if applied to RFID: absent federal privacy regulations, the prevalence of RFID tags would probably not be regarded as "highly offensive to the reasonable person,"⁹⁰ a requirement for tort liability under the Restatement Second of Torts. In addition, there is no constitutional right to informational privacy, although on one occasion the Supreme Court did come close to endorsing such a right. In Whalen v. Roe,⁹¹ a case about whether a state recordkeeping statute violated privacy, the Court cleverly avoided deciding whether there exists a clear right to privacy under the U.S. Constitution.⁹² While the majority did intimate that under some circumstances the government may have a constitutional obligation to "avoid unwarranted disclosures,"⁹³ the Court did not specify what those circumstances might be nor was it willing to extend such hypothetical privacy protections to contexts in which data is collected by private, non-governmental organizations.⁹⁴ 

¶          There are a number of advantages to Congressional action recognized by scholars in the broader context of protecting private data from unwanted collection and use.⁹⁵ And although privacy consortiums and interest groups periodically resist the efforts of corporations to collect private data, efforts at the federal,⁹⁶ state,⁹⁷ and local⁹⁸ level to adopt opt-in privacy standards for personal data have often failed. The very fact that these efforts have failed evidences not only the political influence that private companies possess, but also the necessity of amending the Act. Congress is, however, aware of the problem. In recent congressional hearings on the privacy implications of RFID, Paula J. Bruening of the Center for Democracy and Technology deftly articulated the importance of enacting sensible privacy protections before RFID becomes ubiquitous:

[I]t is more effective and efficient to begin at the outset of the development process to create a culture of privacy that incorporates sound technical protections for privacy and that establishes the key business and public policy decisions for respecting privacy in RFID use before RFID is deployed, rather than building in privacy after a scandal or controversy erupts publicly.⁹⁹

B. A Privacy Act for the Digital Age

¶          The Act should be amended to explicitly apply a control-oriented privacy approach to the activities of private corporations and providers of consumer services and goods. This iBrief proposes the following amendment to the Act:

Under the Privacy Act of 1974, as hereby amended, corporations have a statutory obligation to (1) minimize the amount of data collected and preserve individual anonymity whenever possible, and (2) in contexts where anonymity cannot for technological or administrative reasons be protected, obtain explicit permission from citizens to use (a) personally identifying information for specific purposes disclosed to the consumer and (b) information that aggregates consumer data in ways that threaten consumer anonymity whenever a new tracking technology is used for a substantially commercial purpose.¹⁰⁰

Under the amended Act, (3) private companies may not discriminate against consumers who refuse to have their personal information collected via RFID or similar technologies. Private companies may not provide differential services, preference programs, or special incentives despite whatever differential costs are associated with selling goods or providing services to non-consenting consumers that are not associated with selling or providing similar goods or services to consumers who consent to have their personal information archived and used for fully disclosed purposes.

¶          Provision (1) is the data-minimization principle, necessary to prevent corporate interests from collecting, archiving, using and selling data in a format that violates anonymity. This is the fundamental rule of the amendment, for it stipulates that consumer anonymity is a more important value than targeted advertising. For instance, this provision, when read in conjunction with provision (2), would make it unlawful for Wal-Mart to associate purchase-related data gathered via RFID with specific customers unless explicit consent had been obtained prior to data collection. Notice also that provision (1), when read in conjunction with (2), prohibits collecting specific types of data for which a company has not already obtained permission.¹⁰¹ 

¶          Provision (2) is the opt-in principle, necessary to prevent companies from collecting data surreptitiously from consumers and then using that data in unauthorized ways. This provision has much in common with standard opt-out principles that have already been proposed or promulgated in connection with informational privacy.¹⁰² The main difference between provision (2) and standard opt-out principles is that companies would have to obtain explicit consent from customers before collecting and using their personal data. It is possible that an opt-in provision would make RFID-enabled data collection more expensive, since the costs of data collection would include the time and resources expended to obtain explicit consent.¹⁰³ But this is a virtue--not a drawback--of this proposed amendment.

¶          Provision (3) is the anti-discrimination principle, a provision indispensable to protect consumers from shouldering the cost of opting-out of a data-collection scheme like RFID. For instance, this provision would have the welcome effect of preventing, at least in some cases, companies from offering wildly differential pricing to customers who decided to opt-out of an RFID-discount card program. This is perhaps the most politically controversial aspect of the proposed amendment, because industry advocacy groups would certainly view this provision as a way to stifle completely the "right" of private companies to provide incentives for customers to willingly reveal personal information.

Conclusion

¶          The proposal outlined in this iBrief is modest, pragmatic, and most importantly, proportional to the threat that RFID represents to informational privacy. Nonetheless, it is a proposal that is clearly out of line with our current practices. We are all to ready to disclose private aspects of our lives to commercial entities, too eager to give up forms of anonymity that we would do better to insist upon.¹⁰⁴ Recent trends to trade away privacy protections are often predicated upon misplaced, erroneous notions that technological progress is an unqualified good, a claim grounded in the unchallenged assumption that the technology industry itself is committed to antigovernment libertarianism.¹⁰⁵ Corporations, whether they are steeped in new technology or firmly grounded in the world of bricks-and-mortar, have never been committed as a matter of principle to something as heady and theoretical as libertarianism. Even well-intentioned private efforts, such as EPCglobal's suggestion that RFID tags be disabled once purchases are made, can be voluntarily disregarded and do not carry the force and legitimacy of law.

¶          Early international norms governing privacy also failed to take seriously the threat posed by corporate stalking. For instance, in 1950 Article 8 of the Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms ("Convention") was adopted, declaring that "everyone has a right to respect for his private and family life" and that "there shall be no interference by a public authority with the exercise of this right except as in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of a country."¹⁰⁶ Fortunately, international treaties and agreements ratified since the Convention have not echoed its curious assumption that privacy can only be violated by governmental agencies.¹⁰⁷ 

¶           But international privacy norms have been no match for the "wait and see" attitude that businesses benefiting from RFID technology have been selling to the public and legislators alike. For example, a recent California bill¹⁰⁸ designed to set basic and reasonable standards for RFID systems was steamrolled when Hewlett Packard, the American Electronics Association, and the California Grocers Association argued that "premature" regulation would "have unintended consequences" although "[these industry groups] did not elaborate on those consequences."¹⁰⁹ This "wait and see" attitude encourages Congress and the citizenry at large to accept the truly fantastic idea that private corporations will self-regulate a $900 million-dollar market--expected to reach $2.3 billion by 2010--to protect consumer privacy.¹¹⁰ As one particularly astute citizen recently explained, the public is often hoodwinked into dubious new technology because during its development the associated social costs are either ignored completely or cleverly minimized by private companies:

In our society, technology advances in a vacuum--the morality and actual usefulness of a product is never considered while a technology is under development; once it is developed, [corporations] assume they have a right that supercedes the rights of all others to make money off a product, regardless of how it affects other people. Marketing merely steps into that vacuum . . . and markets technology without a thought as to its adverse effects.¹¹¹

¶          This critique exaggerates somewhat the notion that RFID has been developed and marketed 'without a thought as to its adverse effects.' Many RFID applications will undoubtedly have a direct, positive impact on human health and safety. For example, Applied Digital's VeriChip technology will one allow doctors in emergency contexts to access medical records instantly. Nevertheless, it is worth remembering that new technologies are often embraced not because they are genuinely useful or necessary--but rather because they are already available and ready-to-hand. The amendment proposed in this iBrief has the virtue of allowing consumers a choice: it gives consumers the power to reflectively endorse RFID, instead of merely accepting the ubiquity of this technology after large, politically powerful companies have decided that a radio frequency future is the only future.

Footnotes