# Presentation: 498962

## RFID and Privacy in Pharmaceutical Applications FDA Anti-Counterfeit Drug Initiative Workshop

- Paula J. Bruening
- Center for Democracy & Technology
- February 8, 2006

## Introduction

- The Center for Democracy and Technology is a public-interest Internet civil liberties group dedicated to pursuing *pragmatic policy outcomes* by working with policymakers,  industry, and technology developers.

## Privacy and Trust

- Privacy is a critical enabler of trust.
- Unless people believe their privacy and security will be protected, they will be wary of new technologies that enable information collection and will be less inclined to allow information collected about them to be used.

**Notes:**
The Internet promises to promote free expression, electronic commerce, economic growth, and democratic values.
We will not realize that promise unless people trust the network. 
Privacy and security are essential elements of that trust.
People are worried about their privacy:
Survey Data: Business Week/Harris Poll
Systems Experiences: Lexis P-Trak, SSA, DEA, CVS
Legal obligations to protect data
Contractual obligations
Statutory restrictions
Foreign law
Other obligations (attorney-client privilege, etc.)
Consumer trust
Legal, technical, and marketplace forces are changing the Internet and may jeopardize the features that make it so attractive and successful.

## A Challenging Environment for RFID and Privacy

-   Heightened public concern about data security
-     and data breach
-   Increased public awareness of government
-     surveillance
-   Failure to adequately address privacy in
-    certain other applications

## What’s Different About RFID?

- New technologies prompt re-examination of privacy issues.
- RFID is invisible.
- Collection of information is passive to the consumer.
- RFID raises concerns about tracking of individuals.
- FDA application implicates sensitive information.

**Notes:**
Business use:
Increasing value is collection, integration, use
Cheap storage
Short-term incentives
Bad actors

Government:
- total information 

## Fair Information Practices Provide Framework for Privacy

-   Provide guidance for responsible data
-     collection
-   Form the basis for state and national laws,
-     international agreements, and industry best
-     practices on data protection and privacy

## Fair Information Practices Provide Framework for Privacy

- Give individuals control over their personal information
- Limit data collection
- Place responsibilities on data collectors

**Notes:**
Business use:
Increasing value is collection, integration, use
Cheap storage
Short-term incentives
Bad actors

Government:
- total information 

## Fair Information Practices

- Notice
- Choice
- Use Limitation
- Accuracy
- Security
- Access
- Accountability

## Fair Information Practices

-   RFID technology presents practical
-     challenges to application of fair
-     information practices.
-   Industry must work with
-     stakeholders to arrive at practical
-     advice about how to make fair
-     information practices.

## Build Privacy In at the Beginning

- Individuals want to learn about new information technologies and new information collection
- More effective and efficient to develop a culture of privacy
- Sound technical protections
- Key business and public policy decisions
- Avoids scandal or controversy and enhances public relations

**Notes:**
Business use:
Increasing value is collection, integration, use
Cheap storage
Short-term incentives
Bad actors

Government:
- total information 

## Conclusion

- For RFID to be optimally effective, privacy issues about its use must be addressed at the outset.
- Fair information practices provide the appropriate framework for addressing privacy.
- Industry must  grapple with how fair information practices are practically and effectively applied.
- For more information, please visit:
- 					http://www.cdt.org

## Paula J. Bruening

- Staff Counsel
*pbruening@cdt.org*
- 202-637-9800