RFID Technologies and Consumers in The Retail Marketplace
RFID Technologies and Consumers in The Retail Marketplace
This update outlines developments relating to radio-frequency identification (RFID) technologies in the marketplace. It discusses the technology in general, and in particular its use with the Electronic Product Code (EPC, the next generation of the bar code). The update also reviews RFID deployment in Canada, and presents results from recent pilot projects. Consumer concerns with RFID technologies, which fall mostly in the area of privacy protection, are also discussed. A number of policy developments, both market-based and government-driven, are then presented and put in the context of a future densely populated with wirelessly interconnected physical objects. As a rapidly evolving high technology field, RFID will require sustained attention from the consumer policy and research community.
Although full-scale deployment of RFID applications in the Canadian marketplace is still a few years away, it is certain that the technology will change the consumer-retailer interaction. Already, media reports have recently linked RFID technologies to a variety of potential retail applications, such as the automatic checkout of a whole cartful of groceries (Wilson 2007). In one RFID application being tested in India, an RFID trigger would send tailored information and promotions to customers' cellphones, as soon as they entered a store (Swedberg 2007).
While consumers will benefit from RFID in various ways, the opportunities for information management provided by the technology will also give rise to consumer privacy issues.
An RFID system has three key components:
- An RFID tag (or transponder), a small piece of material comprising a chip with some degree of memory to store data, and a radio wave antenna to transmit it (Figure 1);
Source: GS1 Canada.
- An RFID reader, a device that communicates with the RFID tag and transforms data transmitted from the tag into digital information that can be stored and used by a computer;
- Software / databases that analyse and act on the information, and convert tag data into usable business inputs, such as inventory tracking or product identification.
RFID technology is not new: it was created and first used during the Second World War to identify friendly aircraft. Since the 1990s, the wireless information processing capabilities of RFID technology have been further exploited in a number of proprietary applications. RFID technology, however, has drawn most attention since its use as the underlying data carrier for the Electronic Product Code (EPC). The EPC is being developed as the next generation of the bar code. In this EPC context, RFID technology "provides an unprecedented view into a product's life, changing the way goods are produced, shipped, marketed and sold" (Industry Canada 2005, 1). It is seen as a transformative technology, going far beyond the bar-code systems currently used for inventory and tracking control.
For example, a traditional bar code can only be read when in direct line of sight with the light-based reader. An RFID tag is read by radio waves. This means that it is readable even if the item tagged is located inside a box, or if the reader is fixed to a wall and not directly pointed towards the tag. This also means that multiple RFID tags can be scanned at once.
Finally, because an RFID tag includes a memory chip and can handle more digits than the traditional 12-digit bar code numbering system, it offers the capability of attributing a distinct identification code to each individual box of a product. When item-level RFID/EPC tagging becomes common, every single unit of a given product on a store shelf can have its own distinct identification code on its tag. Thus, a group of. say, DVD players on display might be identical in model, packaging, price and everything else-but every one of them would have a unique RFID identifier.
To date, RFID proponents have based their case on the benefits of RFID to supply chain management, because it enables more efficient tracking of product inventories.
In general, Canadian businesses have been slower to implement RFID systems than their American counterparts. A number of reasons have been cited to explain this, such as the lack of a large organization driving an adoption strategy, and Canada's overall innovation lag (IDC 2005). As noted below, however, Canadian pilot projects have begun, and RFID system deployment in Canada is expected to grow, in parallel with global developments.
The first pilot test of RFID systems in Canada's grocery sector took place in two stores during the Fall of 2006. Preliminary information gathered from the experience demonstrates how the use of RFID technologies has the potential to improve product availability, through more efficient in-store restocking. RFID data showed the exact date and time that a case of food had been moved from the supplier to the distribution centre to the store, and finally onto shelves:
A case of Red Rose Tea, for instance, sat for six days in the Superstore's back room. Partway through those six days, the data were highlighted in red: "Where it's all red, we ran out of stock on the shelf, but we had a case still sitting in the back room." (Hutchinson 2006)
A similar study conducted in the Canadian office products industry found the average time spent receiving a pallet at the loading dock dropped from 17.75 to 2.75 minutes, due to the use of RFID technology (Hutchinson 2006). Canadian consumers stand to gain from such enhanced business efficiency. More results from pilots in Canada are likely to be available in the near future1. These results will need to be monitored in light of recent concerns about RFID technology's net benefits for retailers and their suppliers (McWilliams 2007).
RFID system deployment in the marketplace has raised consumer concerns
RFID system pilot tests in the retail sector have so far focussed on pallet and case-level monitoring of the supply chain. However, RFID tagging is expected to move to the item level as the tags' cost continues to fall-policy-makers anticipate that this will happen in the next five to ten years (IPC/Ontario 2006). While RFID tags used for supply chain management purposes may only hold harmless product information, the information management systems with which the tags can interact could potentially prove more problematic. At the point of sale, detailed product information could easily become personally identifiable when combined with an electronic payment mechanism or a loyalty card. These concerns are amplified by the potential for an RFID tag to remain activated, and therefore "accessible," post-purchase.
RFID technology has raised concerns among consumer advocates, particularly with respect to privacy:
RFID proponents have described numerous benefits of RFID, from enhancing the shopping experience of consumers to ridding landfills of toxic materials. But RFID is a classic information technology, with respect to its potential downsides. If the technology is implemented irresponsibly, we as a society could experience it not as a wonderful convenience with many social benefits but as a tool for consumer profiling and tracking – in other words, as one part of a larger surveillance infrastructure. (Givens 2006, 432)
More specifically, the Privacy Commissioner of Canada has listed the following concerns with respect to RFID technology:
- It may be used for surreptitious collection of information, given that the tags are small and may be invisibly read from a distance;
- It has the potential to track individuals' movements, if tags are embedded in clothes and cars, and there is a sufficiently dense network of readers;
- Profiling of individuals could take on a significantly wider scope, with all physical objects being individually identified and linked to their purchaser or owner;
- The personal information gathered may lead to secondary uses, such as an insurance company having access to medical prescription history (OPC 2006a).
Similar concerns have been expressed in an RFID position statement from consumer privacy and civil liberties organizations, endorsed by a number of Canadian groups (Privacy Rights Clearinghouse 2003). The issues already recognized by these and other groups may be compounded by the prospect of virus-infected RFID tags (RCMP 2006). Furthermore, in light of the fast-paced development associated with advanced technologies such as RFID, consumer representatives are concerned that "consumer interests may become marginalised in the race to adopt RFID" (TACD 2005, 3).
Stakeholders working to mitigate risks
Industry groups and governments are developing policy initiatives aimed at mitigating possible privacy risks.
The private and research sectors have been particularly active. Technical standards, which notably have impacts on RFID tags' confidentiality and security features, are being discussed in fora such as the International Standards Organization (ISO) and GS1 International / EPCglobal (an international e-commerce standards organization that notably promotes the widespread implementation of RFID technology).2 In Canada, GS1 Canada formed the GS1 Canada Public Policy Forum in the fall of 2006, which includes a working group set up to explore privacy concerns (GS1 Canada 2006). And a recently opened McMaster University RFID lab will focus not only on the technology itself, but also offer a cross-disciplinary look at public policy issues (Arnold 2006).
RFID system suppliers' research and development efforts are also contributing to the exploration of security and privacy options.3 In the United States, representatives from various consumer groups and commercial enterprises have developed guidelines with respect to privacy best practices for the deployment of RFID technology (CDT 2006). This work appears to be in line with the U.S. Federal Trade Commission staff's conclusion, following a 2004 RFID workshop, that industry initiatives can play an important role in addressing privacy concerns (FTC 2005).
A number of governments are also working through the issues raised by RFID technologies. Industry Canada held a preliminary meeting with stakeholders in the summer of 2006, and continues to monitor RFID developments. The application of existing Canadian laws on privacy, disclosure, and market fairness in the RFID context has been the subject of several analyses.4 The Office of the Privacy Commissioner of Canada-which is responsible for the technology-neutral Personal Information Protection and Electronic Documents Act-has published an RFID fact sheet (OPC 2006b) and stated its intention to "develop guidelines to help ensure that, even as RFIDs become more common, they do not erode informational privacy rights" (OPC 2006a). In June 2006, the Ontario Privacy Commissioner issued its own Privacy Guidelines for RFID Information Systems (RFID Privacy Guidelines). These are based on three overarching principles:
- Privacy guidelines need to focus on RFID information systems as a whole, not on any single technology component or function;
- Users of RFID technologies and systems must address privacy and security issues at the design stage, with a particular emphasis on data minimization;
- Individual participation and consent must be maximized, with use of RFID systems being as open and transparent as possible. (IPC/Ontario 2006)
Other provincial privacy commissioners have also started exploring RFID issues.5
Internationally, the Organisation for Economic Co-operation and Development (OECD) has sponsored research on public policy considerations related to RFID technology (OECD 2006a). At a 2005 RFID Forum it organized, the OECD expressed the desire "to analyse these [RFID] issues and to formulate guiding principles" (OECD 2006b, 6). RFID is also expected to be one of the topics for discussion at the 2008 OECD Ministerial on the Future of the Internet Economy.6
The European Commission has similarly encouraged discussion,7 and recently released a Communication on RFID Policy. The EC's proposed policy strategy notably recommends the creation in 2007 of a RFID Stakeholder Group with a balanced representation of stakeholders (including consumer organizations), the publication of a Recommendation by the end of 2007 to set out the principles that public authorities and other stakeholders should apply in respect of security and privacy, and the publication of a Communication at the end of 2008 analyzing the economic and societal effects of expected longer-term RFID developments, as well as assessing related policy options (EC 2007).
RFID and consumer policy challenges in a highly connected future
Analysts of RFID systems' potential use, benefits and concerns are now turning their attention to a future that includes such things as item-level tagging and broadly deployed RFID systems. Advances in four related fields-RFID, sensors, embedded intelligence, and nanotechnology-are seen as opening the prospect for an "Internet of things:"
Early forms of ubiquitous information and communication networks are evident in the widespread use of mobile phones …. Today, developments are rapidly underway to take this phenomenon an important step further, by embedding short-range mobile transceivers into a wide array of additional gadgets and everyday items, enabling new forms of communication between people and things, and between things themselves. A new dimension has been added to the world of information and communication technologies (ICTs): from anytime, any place connectivity for anyone, we will now have connectivity for anything. (ITU 2005b, 2)
Such a degree of connectivity, encompassing not only computers, but also many other common personal and household items, has the potential to generate many beneficial applications to facilitate consumers' everyday activities (one often cited example being the "smart" fridge that could alert a consumer when a product is no longer in stock, or an item's expiry date has passed). It also underscores, however, the complexity of the privacy issues posed by technologies such as RFID. As highlighted in a report prepared for the Office of the Privacy Commissioner of Canada, these expected technological developments may have an effect on the privacy concept itself:
Assuming that RFID technology will become ubiquitous and that many RFIDs will remain activated, our ability to use this advancing technology will reduce our expectations of privacy. It will enable increasing, systematic and covert localization of individuals on a much wider scale. This substantially impacts people's traditional reasonable expectations of privacy in movement: they may have been visible at a certain time at a certain place, but much less traceable for a longer period of time. The overall result is that more of our lives, in more places, is exposed. The reasonableness of our privacy expectations in movement is diminished the more localization becomes a common side-effect of technology. It is not difficult to reduce reasonable privacy expectations by first eliminating the privacy, then the expectation of that privacy and, last, the reasonableness of that privacy. (Scassa et al., 2005, 48)
The European Commission has cautioned governments as to the work that will consequently be required over the coming years:
Public entities need to be made aware that the pervasive networking concepts pose new challenges in terms of personal privacy. [They] should carefully check the robustness of their privacy policies and frameworks to the new challenges implied by the emergence of an "Internet of things", where the resulting object identity may eventually be linked to user identity, profiles and consumption habits. (EC 2006, 4)
It is expected that sustained public policy attention to the deployment of this important technology will contribute to both consumers and retailers enjoying its potential benefits in an appropriate manner.
This update outlined recent developments in the evolution and deployment of RFID technologies in the marketplace, related consumer policy discussions, and sketched some market-based and government-driven initiatives seeking to address relevant issues. Further updates on marketplace trends of interest to consumers will be published as new research becomes available and consumer protection policy evolves.
Arnold, Steve. 2006. "A Lab With a Conscience – Mac's Newest Venture Asks 'Should We' About Electronic Tracking, Not Just 'Can We?,'" The Hamilton Spectator (November 9, 2006).
Cahouu, Tri. 2006. "RFID Technology and Usage," Journal of Technology and Business (October 2006).
CDT, Centre for Democracy & Technology. 2006. CDT Working Group on RFID: Privacy Best Practices for Deployment of RFID Technology – Interim Draft (May 1, 2006).
Collins, Jonathan. 2004. "Lost and Found in Legoland," RFID Journal (April 28, 2004).
Commission d'accès à l'information du Québec. 2006. Radiofrequency identification technology (RFID): is there reason to mistrust it? (May 2006).
Deloitte Consulting. 2003. Combating Gridlock: How Pricing Road Use Can Ease Congestion.
EC, European Commission. 2006. From RFID to The Internet of Things: Pervasive Networked Systems – Conference Organised by DG Information Society and Media, Networks and Communication Technologies Directorate, Final Report.
2007. Radio Frequency Identification (RFID) in Europe: Steps Towards a Policy Framework (March 15, 2007).
Espiner, Tom. "Nike+iPod Raises RFID Privacy Concerns," News.Com (December 14, 2006).
FTC, Federal Trade Commission. 2005. Radio Frequency Identification: Applications and Implications for Consumers – A Workshop Report from the Staff of the Federal Trade Commission (March 2005).
Givens, Beth. 2006. "Activists: Communicating With Consumers, Speaking Truth to Policy Makers," in RFID Applications, Security and Privacy, edited by Simson Garfinkel and Beth Rosenbert.
Glass Packaging Institute. 2006. "RFID Tags and Glass Recycling," Inside Glass Recycling (Winter 2006).
GS1 Canada. 2006. Industry Leaders Gather for Launch of GS1 Canada Public Policy Forum, press release (September 29, 2006).
Himmelsbach, Vawn. 2005. "Canada's Cattle Go High-Tech Using RFID," Technology in Government, Vol. 12 No. 2 (March 2005).
Hutchinson, Alex. 2006. "RFID Revolution," The Ottawa Citizen (November 30, 2006).
IDC. 2005. Tag! You're (Almost) IT: RFID Adoption in Canada, Doc # CA208CINT (April 2005).
Industry Canada. 2005. Radio Frequency Identification (RFID) – Beyond Customer Mandate (March 2005).
IPC/Ontario, Information and Privacy Commissioner/Ontario. 2006. Commissioner Cavoukian Issues RFID Guidelines Aimed at Protecting Privacy.
ITU, International Telecommunications Union. 2005a. Ubiquitous Network Societies: The Case of Radio Frequency Identification (April 2005).
2005b. ITU Internet Reports 2005: The Internet of Things – Executive Summary (November 2005).
Kageyama, Yuri. 2007. "Hitachi Shows Off World's Smallest RFID Chip – No Larger Than a Speck of Powder," The Canadian Press (February 22, 2007).
Larkin, Erik. 2007. "New Credit Cards Can Broadcast Your Personal Information," PCWorld.com (February 16, 2007).
Logistics Today. 2006. Talkin' Trash About RFID (May 5, 2006).
Marshall, Trevor. 2004. "Tagging the Material World," Backbone Magazine (August 2, 2004).
McCue, Andy. 2006. "Football Club Tags Fans With RFID tickets," silicon.com (November 15, 2006).
McWilliams, Gary. 2007. "Wal-Mart's Radio-Tracked Inventory Hits Static," Wall Street Journal (February 15, 2007).
Microsoft Corporation. 2006. RFID: An Introduction (June 2006).
Murray Long & Associates Inc. 2006. "Special Edition on RFIDs and Privacy," Privacy Scan (March 3, 2006).
OECD, Organisation for Economic co-operation and Development. 2006a. Radio-Frequency Identification (RFID): Drivers, Challenges and Public Policy Considerations, Directorate for Science, Technology and Industry (March 2006).
2006b. Foresight Forum "Radio Frequency Identification (RFID): Applications and Public Policy Considerations" – Proceedings (February 7, 2006).
Office of the Information and Privacy Commissioner for British Columbia. 2006. 2005-2006 Annual Report (June 2006).
OPC, Office of the Privacy Commissioner of Canada. 2006a. Annual Report to Parliament 2005 – Report on the Personal Information Protection and Electronic Documents Act (May 2006).
2006b. RFID Technology – Fact Sheet (February 2006).
PIAC, Public Interest Advocacy Centre. 2006. Radio Frequency Identification and Privacy: Shopping Into Surveillance (February 2006).
Privacy Rights Clearinghouse. 2003. RFID Position Statement of Consumer Privacy and Civil Liberties Organizations (November 20, 2003).
RCMP, Royal Canadian Mounted Police. 2006. Future Trends in Malicious Code - 2006 Report, Information Technology Security Report R2-002 (August 2006).
RFID Journal. 2002. Libraries Adopt RFID By The Book (September 2, 2002).
RFID Update. 2006. Pro-Privacy TearableRFID Tag Becomes a Reality (November 8, 2006).
Scassa, Dr. Terera, Dr. Theodore Chiasson, Professor Michael Deturbide and Anne Uteck. 2005. An Analysis of Legal and Technological Privacy Implications of Radio Frequency Identification Technologies, prepared for the Office of the Privacy Commissioner of Canada (April 28, 2005).
Sullivan, Laurie. 2006. "RFID Pays Way, Opens Doors At Resort," TechWeb Technology News (March 22, 2006).
Swedberg, Claire. 2007. "RFID System Helps Retailers Send Tailored Messages to Customers," RFID Journal (February 6, 2007).
TACD, Trans-Atlantic Consumer Dialogue. 2005. Resolution on Radio-Frequency Identification (RFID), DOC NO. INTERNET-31-05 (April 2005).
Wilson, Peter. 2007. "Instant Checkout: Scanner Can Price a Cart of Groceries," The Vancouver Sun (February 20, 2007).
4 A number of authors have discussed how Canada's privacy law, and its key principles (e.g., identifying purposes, consent, openness, etc.) might be applied to marketplace use of RFIDs. See, for example, Perrin 2006, Scassa et al. 2005, PIAC 2006 and, for a synthesis of the preceding reports, Murray Long & Associates Inc. 2006. Back to text
- Date modified: