The RFID Revolution: Your voice on the Challenges, Opportunities and Threats Online Public Consultation Preliminary Overview of the Results 16 October 2006
Disclaimer: This document is a working document based on a preliminary analysis of the online public consultation on Radio Frequency Identification (RFID) carried out by the European Commission between July and September 2006. It does not constitute an official Commission position and neither the European Commission nor any person acting on its behalf is responsible for the use which might be made of this publication. 2
From 3 July to 30 September 2006, an online public consultation was held via "Your Voice in Europe" (http://ec.europa.eu/yourvoice ) on future RFID policy. In total, 2,190 respondents (citizens, manufacturers, system integrators, academic and scientific institutions, public bodies and regulators, etc.), covering all the European Union Member States and a number of countries from outside the EU) answered questions about: RFID use; Privacy, Data Protection and Security; Standardisation and Interoperability; Frequency Spectrum; Research. The consultation has brought into focus the large interest of European citizens in a debate about the uses of RFID (65 per cent of all answers). Two countries Germany (43 per cent of all respondents) and France (24 per cent) have shown a large interest in this consultation. Belgium, the United Kingdom and Austria come far behind (4-5 per cent of all respondents each), followed by a group comprising Spain, the United States and the Netherlands. Non-EU countries have also taken part in the consultation (6 per cent), with the United States providing 68 responses. General Questions 61 per cent of the respondents said that the information available for interested citizens to come to an informed judgement of RFID pros and cons was not sufficient. However, 52 per cent of the respondents are aware of the efforts conducted by the existing forums to develop "fair information principles" and RFID best practices. Views are evenly split on the potential of RFID, with roughly the same proportion of respondents considering that the application of RFID offers great potential for improving the life of European citizens as those that are sceptical. As regards the current European Union data protection and privacy legislation, two-thirds of the respondents feel that current legislation is inadequate and that existing laws should be modified in order to strengthen the protection of personal data and privacy and introduce proper safeguards. Also awareness raising and consumer education in the context of RFID deployment and its wide implications would be welcome. Pointing out that the deployment of RFID technology might lead to more surveillance many respondents suggest that RFID tags should be clearly and visibly marked and "kill-features" should be introduced. According to the majority of responses, self-regulation/industry guidelines alone are not sufficient. RFID Use and take-up A majority of respondents consider that the European Commission has a role to play in the promotion of the implementation of the technology. Regarding the application areas where stimulation might be beneficial, "Logistics & Goods Transport" comes first (29 per cent), followed by "Healthcare" and "Government Hazardous Materials Management" (22 per cent on average), "Pharmaceuticals", "Supply Chain Management" and "Manufacturing and Processes" (18 per cent on average), and "Public Transport" and "Library Systems" (11 per cent on average). Regarding the use of RFID-based solutions in healthcare environments, views are split with 45 per cent being more positive and 40 per cent being more negative. A large number of respondents have the opinion that actions should be conducted by the European Commission to encourage the use of RFID technology for the purpose of identification and tracing in the areas of "Light weapons and other dangerous products" (48 per cent), "Products that require a high reliability" (45 per cent), and "Pharmaceutical products (to reduce the risk of counterfeit)" (38 per cent). 3
Regarding the idea of pursuing concerted efforts at European level to achieve harmonisation of certain areas, two main areas are mentioned by about 40 per cent of all respondents, which are "Intermodal transport systems, container and shipment tracking systems" and "The identification and tracking requirements of pharmaceutical products in different EU Member States". The open question on counterfeiting was answered by 869 respondents. About half of the respondents have the opinion that the European Commission should support measures to reduce counterfeiting. 13 per cent argue that the question is complex and cannot easily be answered. In conclusion, more informed investigation on the topic is needed. Security, Privacy and Data Protection, and Safety A large majority of all respondents (about two-thirds) have the opinion that the best solution(s) to eliminate or greatly reduce the concerns of security, data protection and privacy, which may arise from deploying applications of RFID technology, are the development of technical solutions allowing to disable RFID tags and/or awareness raising campaigns to educate consumers. More than half of the respondents report that some kind of legislation regulating RFID should be considered. A minority of respondents (14 per cent) mention a preference for self regulation and best practices based on the "fair information principles". Almost half of all respondents have the opinion that privacy-enhancing technologies (PETs) should be made mandatory in RFID applications. A clear majority of respondents (61 per cent) have the opinion that a RFID tag related to a product in a supermarket should be automatically de-activated at the point of sale. Other solutions, i.e. a removable sticker attached to the product itself and a "proximity tag" with a very short reading distance are advocated by 46 per cent and 40 per cent of all respondents, respectively. About half of the respondents regard the concept of limited distance "proximity tags" as a valuable (complementary) solution to preserve privacy. The strong majority of respondents consider a generic reading distance of up to 10 cm as acceptable for proximity tags. Personal data (e.g., e-passports) is generally placed in the shortest reading range. A majority of respondents see the need for appropriate security and privacy mechanisms to be taken by RFID application providers, while a large majority is concerned RFID-enabled monitoring of workers. Standardisation and Interoperability Two-thirds of all the respondents strongly agree (41 per cent) or agree (27 per cent) that the European Commission should stimulate and support initiatives that lead to global harmonisation of RFID standards. 74 per cent of all the respondents have the opinion that the European Commission should take a more active role in setting RFID standards. A large majority of respondents are in favour of being informed about the RFID presence in products and, more specifically, of some sort of marking, making consumers aware of the presence of RFID. Two-thirds of these respondents agree that the CE marking or a similar principle would be an adequate option. 4
Frequency Spectrum 70 per cent of all the respondents have answered the question concerning the proposed EC Decision on UHF spectrum harmonisation. 64 per cent of those who expressed an opinion say that this regulatory action is sufficient to provide a favourable environment for the initial deployment of UHF RFIDs, but not once the technology becomes ubiquitous. Most believe that industry can reasonably operate within the current regulatory environment for a period between 3 and 5 years, with a roughly even split between those that think congestion would happen between 5 and 10 years (30 per cent) and those considering that congestion will be real in less than 3 years. Research A majority of respondents (57 per cent) are of the opinion that the European Commission should support in priority the development of privacy-enhancing technologies such as encryption and authentication. The next preferred option concerns the development of innovative applications and services (31 per cent of all answers). Of the 75 per cent that answered, 54 per cent were in favour of the European Commission supporting SMEs by investing in awareness raising campaigns, in establishing vendor independent competence and training centres, and/or in promoting the development of RFID applications based on identified best practices. On the governance model of the emerging "Internet of Things", 86 per cent felt that the governance model should be built on transparent, fair and non-discriminatory international principles, free of commercial interest. How the consultation has been perceived Despite some worries that the deployment of RFID technology goes too fast with little, if any, consultation of the citizens, a consensus exists for holding a public discussion on privacy and security issues. 65 per cent found that their expectations have been met by the questionnaire. Several respondents mention health and the environment as potential risk areas for citizens in case of large scale RFID deployment. Other issues raised by the respondents include implants, governance, IPR, implementation challenges whether they be cost-related, standards-related, or privacy- and security-related), and open. Overall there was a large number of very interesting additional contributions, which will be considered in the context of the planned Commission communication and further activities. 5