The EU is conducting a new online consultancy on privacy, data protection and information security principles in RFID applications.

I am happy to see that in Article 5 they begin to address the invisible nature of RFID readers in public space:

“RFID applications can technically operate without any visible or otherwise perceivable action [...]”

They go further to recommend that there be mandated signage for RFID applications:

“Where RFID applications are implemented in public places, RFID application operators should inform individuals on the use of RFID by providing at least a clear sign, accessible by all, that signifies the presence of RFID readers. Information should include, where appropriate, that RFID tags and readers may broadcast information without an individual engaging in any active action, a reference to the policy governing the use of the RFID application and a point of contact for individuals to obtain additional information.”

While this sounds like a lot of information to get across in a sign, there may be ways of creating recognisable levels of security, various levels of private data use, and visible indications of the ways in which that data is stored or used (something along the lines of better food labelling examples). The success of this depends on creating a useful, user-oriented taxonomy of risks.

See also my work on the graphic language for RFID (paper, design brief).

11 March 2008 by Timo