November 3, 2004

RFID Rights

Continued from page 1

By Simson Garfinkel

Things get worse. Instead of giving consumers a right to know what the RFID information is being used for, as I argued they should, EPCglobal’s policy simply calls for companies using EPC chips to publish their policies regarding “Record Use, Retention and Security” on their websites. A company could publish a policy saying that every RFID chip serial number is recorded, kept forever, and that this information is shared with the company’s business partners and government officials. Without actually explaining what the RFID information is used for, a company could nevertheless, be in full compliance with EPCglobal’s policy.

Meanwhile, the nation’s largest retailer, Wal-Mart, is moving full speed ahead with its plans to incorporate RFID into its business process. Last year, Wal-Mart announced that its top 100 suppliers would be required to put an RFID tracking device inside every pallet or case delivered to a Wal-Mart warehouse by January 2005. In theory, the RFID chip will let Wal-Mart track inventory as it moves through the supply chain. If 15 HP printers intended for a store in Pennsylvania accidentally get put on a truck bound for New York, Wal-Mart will know it and can either ship the printers back or update its inventory system with their new location. And if those 15 printers don’t get off the truck, Wal-Mart will have all the data that it needs to start an investigation.

Last November, Wal-Mart detailed its plans for RFID deployment at a meeting of its top 100 suppliers. Wal-Mart chief information officer Linda Dillman said that the company was working with two suppliers, wanted to expand quickly to 12 suppliers, and wanted to have a 100 percent read rate of items coming through its dock doors, according to an article in the RFID Journal.

In April 2004, Wal-Mart announced that its initial deployments of RFID were well underway. Eight early adopters—Gillette, Hewlett-Packard, Johnson & Johnson, Kimberly-Clark, Kraft, Nestle Purina PetCare, Procter & Gamble, and Unilever—were delivering a total of 21 products with RFID tags to the Wal-Mart regional distribution center in Sanger, TX. Test readers are also installed at seven pilot stores in the Dallas-Fort Worth area.

Wal-Mart has said that right now its tags are for internal use, not the checkout aisle. But three of the items in the test—two HP Photosmart photo printers and an HP ScanJet scanner—will have RFID tags built into product boxes. And this is potentially a problem, because these cases may be sent to stores that are not in the trial—a point that’s made clear in the company’s press release.

Wal-Mart has promised that the “outer packaging will be marked with an EPCglobal symbol” so that customers understand that the product they are purchasing contains an RFID tag. But stores that are not in the trial probably won’t have signs or handouts explaining what these symbols mean.

Should consumers be worried? Katherine Albrecht, founder and director of Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN), is one of the privacy activists leading the charge against RFID. In November 2003 Albrecht received international media attention when she revealed that Wal-Mart and Procter & Gamble had conducted a test of RFID-tagged Max Factor Lipfinity lipstick at a Wal-Mart store in Broken Arrow, OK. Albrecht and others claimed that, despite the company’s promises, consumers had not been properly notified that the lipstick boxes contained RFID tags. And earlier that year, Wal-Mart had canceled plans to test Gillette’s RFID-enabled “smart shelf” in Brockton, MA, after Albrecht had publicized the retailing giant’s plans.