Brave New World of Technology - Essay Example

RFID: Brave New World of Technology Introduction Radio Frequency Identification (RFID) the latest surveillance technology rasies new concerns about invasion of pricacy. While RFID has a valid service to provide the manner in which it can be used can be intrusive in situations where individuals have a reasonable expectation of privacy. The primary concern is that existing legislation and common law privacy protection principles may not be sufficient to safeguard against the potentionally intrusive nature of RFID. The discussion that follows examines the law as it is and what measures may be necessary to regulate the use of RFID so as to avoid incidents of invasion of privacy. RFID Corporations and government agencies are increasingly subscribing to the new RFID surveillance technology. The objective is to assign an identifiable number to all manufactured items and track them across international borders while operating remotely on an integrated worldwide network (Albrecht, 2005). RFID chips are microchips (some small as a grain of salt) used to track objects remotely. Currently, RFID chips are purported to be used to track pets, personal identification, and used in packaging (Rockwell, 2006). Developments are underway to use RFID chips for tracking people to improve business processes, according to Health Management Data (Schuerenberg, 2008). An RFID tag is comprised of three components in two combinations: a receiver and antenna combined as an RFID reader. A responder and antenna combined to create an RFID tag. An RFID tag can be read when a reader releases a radio signal to activate the responder, which responds by sending data back to the receiver (Harper, 2004). Privacy Concerns There are two ways in which the use of the RFID technology can constitute an invasion of privacy: a. Via direct monitoring by marketers, manufacturers, retailers, sales agents, government, police, hospitals, and street cameras. For instance, RFID could be used to track a customer's purchases by creating a profile of the customer's shopping habits, returns, interests and desires. b. Via indirect monitoring by third parties such as hackers and criminals. For instance, a hacker breaks and enters into an RFID network and uses existing tags to remotely collect sensitive information with a scanner from hapless, unsuspecting victims (Harper, 2004). An example of identity theft. Deployment of RFID chips could expose sensitive information to global businesses and government agencies. Companies like Wal-Mart, Target, IBM, JPMorgan Chase and Microsoft, Inc. employ the use of RFID technology. Shopping would be a surreal experience on an entirely new level. While RFID tags are attached to clothing, shoes, wallets, purses, and other personal possession with the result that they could alert hidden reader devices of the presence and value of a consumer while entering a retail operation. Readers hidden in doors, counters, security systems, floors, and ceilings would search for RFID tags to ascertain age, sex and preferences of the consumer. RFID chips embedded in credit and debit cards will readily identify the profile of customers as they do banking. The tags will reveal to bank employees, based on account balances, customers in which to extend preferential treatment (Albrecht, 2005). The obvious consequences for the individual is the uncontrolled and unregulated collection of personal data. The Law and Protection of Privacy There are currently two ways in which the US legislatures and courts protect the privacy of the individual. The US Constitution, although it does not specifically speak to privacy, it is construed by the courts in such a way as to guard against intrustions into the privacy of the individual. As will be borne out below, this constitutional right to privacy may not be sufficient to address the capacity of the RFID technology to invade an individual's right to privacy. Data collection in the US is subject to limited protection and again comes back to the question of whether or not there is a reasonable expectation of privacy. Alan Westin describes privacy in the context of data collection as follows: "Privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others." (Westin, 1970) Obviously the use of RFID as intended by corporations and the government usurps the right of the individual or institutions to regulate the manner in which information collected by virtue of RFID devices can be used. The protection of privacy in general in the United States is dependent upon a timeless principle of whether or not the individual has a reasonable expectation of privacy. This is so whether the claim arises from eavesdropping or data collection. The law in general was stated by the US Supreme Court as follows: "Intrusions upon personal privacy do not invariably implicate the Fourth Amendment. Rather, such intrusions cross the constitutional line only if the challenged conduct infringes upon some reasonable expectation of privacy. See Smith v. Maryland, [442 U.S. 735, 740 (1979) ] . To qualify[,] . . . a privacy expectation must meet both subjective and objective criteria : the complainant must have an actual expectation of privacy, and that expectation must be one which society recognizes as reasonable." (Nelson v. Salem State College December 8, 2005 - April 13, 2006) In the context of the new uses proposed by RFID technology it can be argued that a consumer purchasing personal possessions expects that by doing so his personal information will be subject to exposure if that individual uses a credit or debit card. However, the difficulty arises out of the tracking potential. Noone using a credit card expects that he or she can be tracked from the moment they leave the retail operation. Therefore the use of RFID devices can invoke ambiguous applications of existing principles of privacy protection. The RFID device is quite similar to the privacy risks that exist via the internet, although, it can be argued that in general a person using the internet surrenders to a certain extent a reasonable expectation of privacy. Most internet users are aware that when they surf the internet of shop via the internet that they are using a public forum and entering personal data that can be used without their consent or knowledge. Therefore in many ways there can be no reasonable expectation of privacy in the disclosure of personal data on such a public forum. By virtue of US Code Title 42 Chapter 21A 2000aa Federal law makes provision for limited protection of the personal data via the internet. (US Code Title 42 Chapter 21A 2000aa) Title 42 protects individuals from the unauthorized use of information stored on web servers by authorities in the course of criminal investigations. However exceptions are provided for under the act and include circumstances where there is probable cause or where the confiscation of the relevant information will "prevent" serious harm or death. (US Code Title 42 Chapter 21A 2000aa) The Code also makes provision for notice of the intention to seize documentary data on the person affected and also provides an opportunity for the filing of an Affidavit setting out reasonable grounds for the data in question to be excluded from government scrutiny. (US Code Title 42 Chapter 21A 2000aa) The regulation of unsolicited email is not the subject of Federal law protection although specific state law makes provision for privacy protection in respect of commercial email solicitation. At the present time both the EU and the US have data privacy protection laws and regulations that are consistent with the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data which were issued by the Organization for Economic Co-operation and Development in 1980. (Beck) In the US does not have specific data protection legislative provisions but relies on the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data as issued by the Organization for Economic Co-operation and Development which contain the following eight regulations: 1. Personal data can only be collected if it is done so by fair and lawful means and with the prior consent and knowledge of the person against the data is collected. 2. The data collected is required to be relevant for the reasons that it is used and must only be used "to the extent necessary for the those purposes." (Beck) 3. The purpose for the collection of the data must be specified prior to its collection as well as the "subsequent use of such data" (Beck) 4. The personal data collected cannot be used for any purpose outside of the purpose specified and cannot be disclosed outside of its specified purpose unless the individual's consent is obtained or unspecified use is authorized by law. 5. The organization collecting the data is required to protect the data from "unauthorized access, destruction, modification or disclosure." (Beck) 6. The agent to whom control of the data is delegated is required to "make available information concerning the existence, use and nature of personal data." (Beck) 7. The affected individual is at liberty to have errors corrected in relation to the data collected. 8. The person or agent to whom control of the data is delegated is held accountable for compliance with the principles set forth above. (Beck) In other words the use of RFID devices can overcome privacy protection by merely informing the consumer that the item purchased is tagged, or that there is a risk that personal information may be collected by virtue of the tagged item. Any hope that the information collected can not be used without the consumer's consent is truncated by the ruling in Four Navy Seals v. Associated Press 2005 WL 3750156 S.D.Cal which essentially ruled that the disclosure of collected data is subject to scrutiny within the spirit and intent of the Freedom of Information Act 1986. (Four Navy Seals v. Associated Press 2005 WL 3750156 S.D.Cal) Raysman and Brown however, submit that data protection in the US is not subject to sufficient legislative control and protection.(Raysman and Brown, 2007) Be that as it may, there are sufficient principles and mechanisms available via the law to aid an individual with respect to privacy and data collection protection. For instance, Raysman and Brown report that last Ausgust America On Line unwittingly published in excess of twenty million search requests made via its search engine. This data remained available to the public for at least ten days following which America On Line removed the material and apologized for its display. However, one month later several of the users exposed filed a class action against America On Line in the Federal District Court. (Raysman and Brown, 2007) The complainants alleged that America On Line infringed the provisions of the Electronic Communications and Privacy Act as well as a number or California State codes with respect to deceptive business practices and false advertising. The complainants also alleged that America On Line had infringed its own privacy policies. (Raysman and Brown, 2007) Two privacy organizations, namely; the Electronic Frontier Foundation and the World Privacy Forum filed official requests with the Federal Trade Commission asking for relief including damages, audits and injunctions. (Raysman and Brown, 2007) The Electronic Frontier Foundation and the World Privacy Forum also charged that America On Line was in contravention of its privacy policy and conducted what amounted to unfair acts within the meaning of Section 5(a) of the Federal Trade Commission Act. (Raysman and Brown, 2007) To date the case has not reached a conclusion, however the filing of the complaints and the litigation do demonstrate that there are means by which data protection can be enforced within the United States in the absence of specific Federal law. It is possible that the only means for regulating the collection of data and the tracking capacity of the RFID device is under the Electronic Communications Privacy Act. The Electronic Communications Privacy Act was considered in re Doubleclick Inc, Privacy Litigation, 2001, US District Court in New York. In general the question of privacy protection falls back on the question of reasonable expectation of privacy. Once an individual surfs the internet and freely provides personal data he or she cannot substantiate a claim that there was a reasonable expectation of privacy. (re Doubleclick Inc, Privacy Litigation, 2001) Moreover, under the Computer Abuse and Fraud Act the plaintiff must prove that he suffered damages in order to succeed in his claim. (re Doubleclick Inc, Privacy Litigation, 2001) By and large Americans are left to self-regulation as there is no cohesive or strict protection of privacy with respect to information technology. While internet users can take advantage of privacy protection software since the law is scattered and by and large non-responsive, the RFID leaves the consumer almost entirely vulnerable to invasion of privacy, unless of course he is aware of the avenues open to him to challenge the unauthorized use of the data collected by virtue of the RFID devices. This is obviously unfair and requires specific legislative provisions to counter the potential for intrusive use of the device. Obviously laws in respect of privacy protection can only go so far without compromising the commercial advantages of information sharing via electronic transmissions. The approach taken by legislators in both the US however do not take into consideratino the entirely invasive nature of the RFID devices. While ome element of privacy must be sacrificed for the common good of commercial advancement as a result of information sharing, the risk to privacy invasion posed by the RFID has the potential to challenge consumer confidence. As it is the only means by which a consumer can control his or her exposure to RFID devices is to refuse to purchase items tagged with the device. Conclusion As noted by Bygrave, "the protection of privacy serves a large range of other values and interests." (Bygrave, 2001) According to Bygrave these values and interests include "personal autonomy, integrity and dignity." (Bygrave, 2001) The RFID takes away each of these values by leaving the consumer only one option. That option is as stated a refusal to purchase goods that are tagged with the RFID device. This will have serious consequences for the economy since it will impact upon consumer spending. The only means of balancing consumer confidence and using the RFID for the investigative and tracking purposes it purports to serve is to implement laws that restrict the implantation of the device and affords the consumer a choice as to whether or not he or she wishes the device implanted in the item purchased. This way, the consumer consenting to the purchase of an item tagged with the RFID device cannot reasonably argue that he or she had a reasonale expectation of privacy. Works Cited Albrecht, K. & McIntyre L. (2005) Spychips. Tennessee: Nelson Current Beck, Phillip. (n.d.) EU and US Data Protection Law -- And Soon the Twain Shall Meet http://www.legalsitecheck.com/dataprotection.html Viewed March 9, 2008 Bygrave, Lee, A. (2001) The Place Of Privacy In Data Protection Law. UNSWLJ 6 Four Navy Seals v. Associated Press 2005 WL 3750156 S.D.Cal Harper, J. (2004). RFID and Privacy: How Bar Codes on Steroids are Really a 98-lb Weakling : http://www.cei.org/pdf/4080.pdf Retrieved March 9, 2008 Nelson v. Salem State College December 8, 2005 . - April 13, 2006 http://209.85.165.104/search'q=cache:4iFY0qeuWGcJ:www.epic.org/privacy/nelson/nelson_opinion.pdf+Nelson+v.+Salem+State+College&hl=en&ct=clnk&cd=2&gl=us Viewed March 8, 2008 Raysman, Richard and Brown, Peter. (March 2007) "Search Engine Privacy and Data Retention." NY Law Journal vol. 237-NO. 48 re Doubleclick Inc, Privacy Litigation, 2001, US District Court in New York Rockwell, M. (2006). RFID Hits a Bump. Available online at: http://www.wirelessweek.com/article.aspx'id=90698 Retrieved March 9, 2008 Schuerenberg, B. (2008). "Patients Let RFID Get under Their Skin." Health Data Management, 11(2), 39-41 US Code Title 42 Chapter 21A 2000aa Westin, Alan F. (1970) Privacy and Freedom New York: Atheneum Read More