Tracking products or people?
The simple bar code on products is gradually being replaced by smart tags that use wireless technology, such as WI-FI, Radio Frequency ID, Bluetooth, Global Positioning System Technology and General Packet Radio Service. Product coding, or tagging in the past, was generally restricted to bar coding which was a relatively passive form of tagging since it required the use of bar code readers to interpret data and the data itself said little more than the identity of the product.
More active product tagging, such as RFID has, until recently, been expensive to implement (and indeed is still relatively expensive) but the more sophisticated product coding technology now allows for, not only identification of the product itself but specific confirmation of the precise batch that a product came from and using wireless technology, the ability to track the movement of that product.
Global companies such as Gillette, Phillips, Procter & Gamble, Wal-Mart and others see huge savings to be made from the use of RFID and there are numerous pilot projects underway for which are indicating savings to be made in supply chains as well as the ability to add value to both product owner, product reseller and customer.
Whilst RFID technology and the like will make savings in the supply chain, they may also produce a range of smart solutions, such as refrigerators or waste bins that automatically create shopping lists, products tagged for store returns, reduction of the risk of fraud and theft and smart travel tickets that indicate your location in airports, stations and so on. However, privacy groups and consumer associations have expressed concern that the same technology may have invasive features since, if the technology can track the product, then the same technology can track the product purchaser.
Although currently a number of the new tagging technologies can only be read over short distances there are suggestions that if there are connected sites with suitable readers, it is feasible that the purchaser of an RFID tagged product could be tracked from the points that the product is put into a shopping trolley to the point of payment and indeed beyond. Such tracking enables retailers to build up sophisticated profiles on purchasers but at the same time may, potentially, breach human rights and in particular the Data Protection Act 1998.
The Act defines personal data as “data which relates to a living individual who can be identified either from that data or from that data and other information which is in the possession or is likely to come into the possession of the data controller.” So data from an RFID tagged product, when read in conjunction with the purchaser's loyalty card, swiped at the point of payment, produces a record of product purchase to purchaser and in conjunction with other products purchased at the same time builds a profile. If those tagged products are readable outside a store it is possible that yet more data can be gathered to track and profile the purchasing style of that individual within a locality.
However, it is not the tagging in itself that is potentially a breach of data protection laws but the subsequent collection processing of data derived from the tagged product that causes the problem.
The data protection legislation in the UK requires that individuals are notified of data processing activities and are given sufficient information about the way which such data will be stored and used to be able to give informed consent.
A number of projects under way have been marketing led and often have not perceived compliance for data protection as a fundamental issue.
Whilst there are already a number of technology standard groups looking at codifying tagging technology on a global basis, little investigation has been done into the issues of compliance with data protection laws, although the International Chamber of Commerce has recently established a product coding and tagging group which will address legal and regulatory issues in which Robert Bond is a member.
Robert Bond is a partner based in the London office of Faegre and Benson. He is a Companion of the British Computer Society and a Fellow of the Society of Advanced Legal Study.