8 March, 2007

In response to GS1’s Draft Consumer Privacy Code of Practice on Radio Frequency Identification in Retail

Submission by the Australian Privacy Foundation

About the Australian Privacy Foundation 

1.	The Australian Privacy Foundation is the leading non-governmental organisation dedicated to protecting the privacy rights of Australians. Relying entirely on volunteer effort, the Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 

General comments

2.	The Australian Privacy Foundation welcomes the opportunity to comment on the Draft Consumer Privacy Code of Practice on radio Frequency Identification in Retail (hereinafter “the Code of Practice”). 

The issues
 
7.	In our view, the Code of Practice represents a welcome, timely and well structured initiative. We are particularly pleased to see that the definition of the term “Deactivation” makes clear that, for a RFID tag to be regarded as de-activated for the purpose of the Code, it needs to be in such a condition that it cannot in any way be re-activated in whole or in part. This is an absolute necessity for the adoption of any RFID scheme. 
 
8.	At the same time, we note the need for some significant improvements to be made.

9.	First, the draft Code of Practice is fundamentally flawed in its opt-out approach to de-activation at point of sale (4.4). The default option should be that RFID tags are de-activated at the point of sale, unless the consumer expressly requests that the tag remains active. 

10.	We are also disappointed that the industry has not taken the next logical step of seeking registration of the Code by the Privacy Commissioner so that it becomes binding on signatories.

11.	Apart from the above, our main concern does not relate to what is covered in the Code of Practice, but what is not covered. Clause 3.3.4 expressly excludes the relationship between the retailer and the manufacturer but this leaves a major gap in the effectiveness of the Code. The Code of Practice does not give any indication as to how related third parties, such as manufacturers, may use the RFID technology. While it is comforting for a consumer to know that the retailer from which a particular item was bought will not abuse the information that can be gathered, such a feeling may be one of false security should the tag be left active, and in the event that e.g. the manufacturer of the item or other third parties will be monitoring the tag.

12.	At the very least, the Code of Practice needs to be amended to include (1) a provision to the effect that consumers need to be educated generally regarding third parties’ potential use and abuse where tags are left active after the point of sale; and (2) a provision to the effect that consumers need to be informed specifically about any particular third party potential use that the retailer knows of, or reasonably should have known of, where tags are left active after the point of sale. In practice that means that retailers need to be informed by e.g. manufacturers about how they will use RFID tags left active, so that the retailers can pass on that information to the consumers.  

13.	Indeed, if read literally, this problem may also involve how the retailers use the tags as 4.3.3 merely  requires retailers to provide information policies of usage of RFID “in their store”. This would seem to indicate that retailers do not need to provide any information about their policies on the usage of RFID outside their store, e.g. where a retailer scans for active tags on a busy street or at a sporting event, to create a market profile.  This clause should be amended to make it clear that the requirement applies to ‘any’ use by the retailer.

14.	The Code of Practice makes reference to the Privacy Act 1988 (Cth), and states that “Procedures must comply with the provisions of the Privacy Act 1988 and/or applicable legislation relevant to the handling of personal information.” (3.4.2). This is a good approach. However, it may need some clarification. The “or” seems to indicate that the Privacy Act 1988 (Cth) will not always be applicable. That is unfortunate as the Code of Practice represents a good opportunity to extend the application of the Privacy Act by voluntary means. Ideally, as some of the signatories may fall within the small business exemption of the Privacy Act, the Code of Practice should make clear that, as far as RFID is concerned, the signatories undertake to follow the National Privacy Principles of the  Privacy Act. The Privacy Act allows otherwise exempt small businesses to bind themselves to comply with the Act and submit themselves to the complaint and enforcement mechanisms (section 6EA), and we submit that the Code should require signatories to do so.

15.	Provision 4.3.4 states that “Retailers are not permitted to retain information from tags that are attached to products that have been obtained by consumers from other businesses.” If technically feasible, it would be more suitable to instead state that “Retailers are not permitted to collect information from tags that are attached to products that have been obtained by consumers from other businesses.” If collection can be avoided, the issue of retention will not arise.
 
16.	The language could appropriately be made stronger in some parts. For example, in the context of the need for retailers to give notice, a sentence such as: “Notice may be provided by way of in store signage or other written material provided to consumers upon entry into the store.”, could suitably be strengthened to read “Notice may be provided by way of prominent in store signage or other appropriate written material provided to consumers upon entry into the store.” instead. At the same time, it is noted that these are only minor changes, and that this concern is minimised by the provision in 4.1.2.

17.	We welcome the establishment of a voluntary industry complaints mechanism, while noting that it is ‘second best’ to a statutory scheme such as would be achieved by registering the Code under the Privacy Act, and subject to the following qualifications:
•	The Code processes can only be supplementary to individuals’ statutory rights under the Privacy Act. Complainants must be advised at the outset that they have the option of taking their complaint directly to the Privacy Commissioner.
•	The consumer representative on the complaints committee should be selected in accordance with the draft guidelines of the Commonwealth Consumer Affairs Advisory Council - see http://www.consumersfederation.com/documents/ConsumerRepsPolicyApril04.pdf.  The Consumers Federation of Australia has an established mechanism for nominating consumer representatives, which could be utilised.
•	The only sanction for non-compliance with recommendations of the complaint committee is publicity, and ultimately expulsion from the Code.  The former may not have much effect on a recalcitrant signatory while the latter is a big step which would not be taken lightly.  We submit that a graded series of intermediate sanctions would be appropriate.

18.	We submit that the Code Administration steering committee should have at least one independent consumer member, selected in accordance with the CAAC guidelines

19.	To conclude, the Australian Privacy Foundation supports the adoption of the Code of Practice, but advocates the changes outline in this submission.

For further information contact:

Dr Dan Svantesson, (07) 5595 1418
Board Member
E-mail: enquiries@privacy.org.au
APF Web site: http://www.privacy.org.au