29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS 29e Confrence internationale des commissaires à la protection de la vie prive

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS Consumer Privacy and the RFID threat Katherine Albrecht, Ed.D. CASPIAN Consumer Privacy RFID in products - RFID human implants - Copyright © Katherine Albrecht 2007 All rights reserved

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS RFID Tag: A tiny chip connected to an antenna Hitachi’s 0.3 mm mu chip RFID tags in use at Extra “Future Store” in Rheinberg, Germany Copyright © Katherine Albrecht 2007

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS RFID Reader: Sends a signal to a tag, reads the response Copyright © Katherine Albrecht 2007

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS Tags can be embedded in product packaging (Like Gillette razor blades)

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS 29e Confrence internationale des commissaires à la protection de la vie prive The RFID industry has developed item-level labels to notify consumers

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS 29e Confrence internationale des commissaires à la protection de la vie prive But some companies want hidden tags in consumer items -- like shoes

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS Texas Instruments advises retailers to scan customers’ loyalty cards right through their purses or wallets Source: Copyright © Katherine Albrecht 2007 Doorways, ceilings, and floors could become part of the panopticon

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS 29e Confrence internationale des commissaires à la protection de la vie prive Tracking and surveillance monitors could someday watch people anywhere. Copyright © Katherine Albrecht 2007

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS IBM's Patented “Person Tracking Unit” explains how Copyright © Katherine Albrecht 2007 “When a person carrying or wearing items having RFID tags enters...an RFID tag scanner scans the RFID tags on that person...to determine the exact identity of the person...and the movement of that person is tracked based on these detections.” -IBM US Patent #7,076,441 “Identification and tracking of persons using RFID-tagged items” Issued July 2006

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS IBM suggests using its "Person Tracking Unit" to identify and track people in: "shopping malls, airports, train stations, bus stations, elevators, trains, airplanes, restrooms, sports arenas, libraries, theaters, museums, etc." LibrariesPublic restrooms Copyright © Katherine Albrecht 2007 RFID systems could eliminate privacy. Everywhere.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS "Without having any prior records of individuals and their purchase records, a person carrying RFID-tagged items can be scanned to identify a collection of items that the person is carrying" "A tracking number [is assigned] to that person based on the collected RFID tag information, and...used to track the person's movement." "The exact identity (i.e., name, address, etc.) is not determined, but the person is still tracked based on their association with the collected RFID tag information." - IBM patent #7,076,441 Copyright © Katherine Albrecht "Personally identifiable information" is not needed for tracking.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS Copyright © Katherine Albrecht 2007 Source: The tracking can be quite personal:.. "The wristband contains an RFID chip that alerts the...system to store personal footage as the guests...walk around the park." - Alton Towers Amusement Park, UK

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS 29e Confrence internationale des commissaires à la protection de la vie prive Consumers have no deactivation options at this time. They should.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS 29e Confrence internationale des commissaires à la protection de la vie prive Vendors want RFID tags left "live" for returns and warranties. This should be prohibited.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS “By combining captured pre-consumer [RFID tag] information with post-consumption information, the entire life cycle of an item may be tracked. This information may be useful to…retailers, manufacturers, distributors and the like….The collected and processed data may be helpful to track consumer purchase [and] use patterns.” - US Patent Application # Assigned to BellSouth “System and method for utilizing RF tags to collect data concerning post-consumer resources” Disposable tags are not the solution. Copyright © Katherine Albrecht 2007

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS Nor is government regulation -- if government colludes with industry. Copyright © Katherine Albrecht 2007 Shortly after the “Verichip” implant was approved by the FDA; FDA overseer Tommy Thompson joined the company's board and was compensated with cash and stock options...

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS The bottom line? Consumers don't want tags. Copyright © Katherine Albrecht 2007

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS Copyright © Katherine Albrecht 2007 We don't want them better labeled. We don't want them better protected. We don't want them at all.

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS To learn more: Spychips: How Major Corporations and Government Plan to Track your Every Move with RFID Spooner Award Winner: Best Book on Liberty "The privacy movement needs a book. I nominate Spychips. - Marc Rotenberg, EPIC “Spychips "make[s] a stunningly powerful argument against plans for RFID being mapped out by government agencies, retail and manufacturing companies. - Evan Schuman, CIO Insight

29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY COMMISSIONERS M Katherine Albrecht, Ed.D., CASPIAN (Consumers Against Supermarket Privacy Invasion and Numbering)