EU issues smart chip privacy guidelines

This month the European Commission adopted a set of recommendations to ensure that players in the smartcard industry respects the individual’s fundamental right to privacy – an entitlement set out in the European Union charter of fundamental rights. The decision will be welcomed by consumers across Europe who will now be able to have control over their smart chips, a global market set to skyrocket 500% in the next decade. Already there are over 6 billion microelectronic devices that can be integrated into everyday objects such as travel cards, passports and payment cards. The majority of these smart chips use Radio Frequency Identification (RFID) technology, a process which uses a ‘reader’ to pick up a radio signal and exchange data automatically. The worldwide market value for RFID tags is estimated at around £4 billion, and that figure is predicted to increase to £20 billion by 2018.

The recommendation by the European Commission is by no means a snap decision. As early as 2006, officials launched a public consultation on the development and use of smart chips. Based on these findings the Commission announced that further action was expected by the public in terms of privacy and data protection. The latest announcement on May 12 responded to these expectations. After taking advice from suppliers and users, standardization bodies, consumer organizations and trade unions, the new proposal seeks to create a level-playing field for the European industry while maintaining respect for the individual’s right to privacy.

Viviane Reding, EU Commissioner for Information Society and Media was positive about the changes saying, “Europeans must never be taken unawares by the new technology. This is why the Commission issued strong recommendations to the industry today. European consumers must be confident that if and when their personal data is involved, their privacy will be impregnable also in a changing technological environment. The Commission therefore wants RFID technology to empower consumers to control their data security, which is the best way to make sure it is an economic success.”

The European industry had better brace itself for some changes. The commission laid out the following principles for protecting privacy and data protection. Retailers should automatically disable tags, free-of-charge, at the point of purchase unless specifically asked otherwise. The same retailers should also promote consumer awareness through a recognizable European sign on products containing a smart chip. Private firms and government departments that employ smart chips, such as the passport and identity agencies, should tell consumers exactly what data they collect, the purpose and how that data will be used. The Commission also advised that card readers be clearly labelled and an information contact point be provided for citizens.

Viviane Reding suggested companies and organizations should “conduct privacy and data protection impact assessments before using smart chips”. The assessments, which would be reviewed by national data protection authorities, would make sure personal data was secure. However, some experts are still concerned with the risks of skimming and identity fraud that RFID technology carries but any claims of security flaws were strongly rebuffed by the Smartcard Association. EU member states now have two years to inform the Commission on the steps they intend to take to meet the objectives of the Recommendation. Within three years, the Commission will report on the success of the implementation, including an analysis of its impact on companies, public authorities, and citizens.

(Smartcard News Ltd, 2009)