Opinion of the European Economic and Social Committee on Radio Frequency Identification (RFID)
Date: 2007-07-11
Institutions: European Economic and Social Committee
Subjects: data protection, electronic component, information technology, labelling, waveband

C 256/66

EN

Official Journal of the European Union

27.10.2007

Opinion of the European Economic and Social Committee on ‘Radio Frequency Identification
(RFID)’

(2007/C 256/13)

In a letter dated 26 February 2007, the European Commission asked the European Economic and Social
Committee, under Article 262 of the Treaty establishing the European Community, to draw up an opinion
on: Radio Frequency Identification (RFID).

The Section for Transport, Energy, Infrastructure and the Information Society, which was responsible for
preparing the Committee's work on the subject, adopted its opinion on 19 June 2007. The rapporteur was
Mr Morgan.

At its 437th plenary session, held on 11 and 12 July 2007 (meeting of 11 July), the European Economic
and Social Committee adopted the following opinion by 138 votes to 1 with 6 abstentions.

1. Conclusions and recommendations

Radio Frequency Identification (RFID)

is a significant
1.1
technology which will become very important over time. Its
present and future applications have the potential to positively
improve a wide range of business processes in both the public
and private sector and to bring significant benefits to both indi-
viduals and enterprises. It also has the potential to stimulate a
massive development in internet applications, making possible
what a UN Agency has described as the ‘Internet of Things’.
However, unless RFID is very carefully controlled, it also has the
potential to violate personal privacy, destroy civil liberties and
threaten the security of individuals and enterprises.

1.2
The full title of this Communication is ‘Radio Frequency
Identification in Europe: steps towards a policy framework’. The
Commission has already held a wide ranging consultation which
provided the basis for the Communication. The EESC is now
invited to provide an exploratory Opinion. On the basis of the
responses to the Communication the Commission will make a
Recommendation to Member States at the end of the year. Any
legislation, which would take longer, will come later. In effect
then, this Opinion should focus on the content of that Recom-
mendation.

To help with the formulation of its Recommendations
1.3
the Commission has decided to establish a Stakeholders Group
as a sounding board. The EESC would welcome an opportunity
to present this Opinion to the Stakeholders Group.

1.4
The EESC endorses the actions proposed by the Commis-
sion in the domains of Radio Spectrum, Standards, Health,
Safety and the Environment. We highlight the urgency of estab-
lishing an effective industrial contribution to the Standards
forum.

to suppose that it will accept the data security and privacy infra-
structure as it is today. In particular, this suggests that the Data
Protection bodies which already exist in each Member State will
become the responsible Authority for RFID privacy and data
protection issues. These issues are the focus of this Opinion.

The threats to privacy and civil liberties posed by RFID

1.6
are profound:

— RFID tags can be embedded into/onto objects and docu-
ments without the knowledge of the individual who obtains
these items. As radio waves travel easily and silently through
fabric, plastic and other materials, it is possible to read RFID
tags sewn into clothing or affixed to objects contained in
purses, shopping bags, suitcases and more.

— Electronic Product Code could enable every object on earth
to have its own unique ID. The use of unique ID numbers
item registration
could lead to the creation of a global
system in which every physical object
is identified and
linked to its purchaser or owner at the point of sale or
transfer.

— RFID deployment requires the creation of massive data bases
containing unique tag data. These records could be linked
with personal
identifying data, especially as computer
memory and processing capacities expand.

— Tags can be read from a distance, not restricted to the line
of sight, by readers that can be incorporated invisibly into
nearly every environment where human beings congregate.
Readers can be embedded into floor
tiles, woven into
carpeting, hidden in doorways and concealed in shelving,
making it virtually impossible for an individual to know
when he or she is being scanned.

1.5
Since the Commission will be publishing its Recommen-
dations to Member States at the end of this year it is reasonable

— If personal identity is linked with unique RFID tag numbers,
individuals can be tracked or profiled without their knowl-
edge or consent.

27.10.2007

EN

Official Journal of the European Union

C 256/67

— It is possible to envisage a world where RFID readers form a
pervasive global network. Such a network would not need
readers everywhere. Congestion charging in London can
track all cars entering central London with a relatively few
strategically located cameras. A network of strategically
located RFID tag readers could be constructed in the same
way. It must not be allowed to happen.

(e) The responsible authority should give clear guidance that (c)
and (d) will only be admissible in exceptional circumstances
and with prior formal notification to the Authority.

Certain exceptions

1.9
contemplated when:

to the above guidelines may be

1.7

The implications of these threats are as follows:

— Private individuals exercise the option to keep tags alive for

their personal convenience.

— RFID users must make public their policies and practices
and there should be no secret databases of personal informa-
tion.

— Private individuals give their consent to being tracked in
critical environments such as highly secure public and
private establishments and institutions.

— Individuals have a right to know when items in the retail
environment contain RFID tags or readers. Any tag reading
which takes place in a retail environment must be trans-
parent to all parties.

— Private individuals choose to use applications which will
locate them and identify them in the same way as they are
already located and identified by the use of mobile phones,
ATM cards, internet addresses, etc.

— RFID users must give notice of the purposes for which tags
and readers are used. The collection of information should
be limited to that which is necessary for the purpose in
hand.

— RFID users are responsible for the implementation of the
technology and are responsible for operating within the data
security laws and guidelines. They are also responsible for
the security and integrity of the system and its database.

Ideally, any business

How these principles should be put into practice is a
1.8
moot point.
involved in business-to-
consumer transactions, such as retail, ticketing, access controls
or transport services would give customers a form of guarantee
that these principles will be followed, a type of customer charter.
Conceptually such a charter could incorporate all
the data
protection principles of good practice detailed in paragraph 4.5.
In addition, the EESC proposes the following guidelines:

(a) Merchants should be prohibited from forcing or coercing
tags in the
customers into accepting live or dormant
products they buy. Options could include attaching tags to
packaging or using removable tags analogous to price
tickets.

(b) Customers should be free to remove or disable any tags on

items in their possession.

(c) RFID should not, in principle, be used to track individuals.
for

Human tracking is inappropriate, whether
example, clothing, goods, tickets or other items.

through,

(d) RFID should never be used in a way which could eliminate

or reduce anonymity.

Any such exceptions should be notified to the responsible
authority.

1.10
RFID is not a mature technology so we do not yet
understand its full potential. On one hand it may deliver incon-
ceivable benefits to our technological civilisation, on the other
hand it may be the greatest technological threat yet to privacy
and liberty. The EESC believes that applications of RFID should
be developed according to a strict code of ethics in respect of
privacy, liberty and data security but that, given the necessary
safeguards, application development should continue.

1.11
In conclusion, where RFID applications are permitted,
to everyone
the implementation should be fully transparent
involved. Applications to improve the handling of goods are
generally acceptable. Applications
involving the tagging of
people are generally not acceptable except in transient environ-
ments. Applications which link people to goods may be accep-
table for marketing purposes. Applications which identify
people via the goods they have purchased are generally unaccep-
table. Moreover, some applications are inappropriate in a free
society and should never be permitted. The imperative need to
preserve privacy and anonymity must be the core of the Recom-
mendation by the Commission to the Member States.

2. What is RFID and why does it matter?

2.1
RFID is a technology that allows automatic identification
and data capture by using radio frequencies. The salient features
of this technology are that they permit the attachment of a
unique identifier and other information — using an electronic
tag — to any object, animal or even a person, and to read this
information through a wireless device.

C 256/68

EN

Official Journal of the European Union

27.10.2007

2.2
The tags themselves consist of an electronic circuit which
stores data, and an antenna which communicates the data via
radio waves. A RFID reader interrogates the tags to obtain the
information stored. When the reader broadcasts radio waves, all
the tags within range will communicate. Software is required to
control the reader and collect and filter the information.

2.3
There are different types of RFID systems available. Tags
can be either active or passive. Active tags contain an on board
battery to drive the internal circuitry and to generate radio
waves, they can broadcast even in the absence of a RFID reader.
Passive tags are powered using the energy of the radio wave
transmitted by the reader and do not have their own power
supply. Tags may be ‘read-only’ or ‘read-write’. Read-only tags
are cheaper to produce and are used in most current applica-
tions.

2.4
The range of an RFID system depends on the radio
frequency, the power of the reader and the material between the
tag and the reader. It can be up to a few meters for passive
systems but in excess of 100 meters for active systems.

2.5
RFID is the bottom rung of the wireless technology hier-
archy. Ranked by the distance that the signals travel, the top
position is held by satellite communication systems such as
GPS. This is followed by wide-area mobile phone technologies
such as GSM and GPRS, then shorter range signals within build-
ings such as Wi-Fi, then personal networks such as Bluetooth
and, finally, RFID. Each of these technologies is discrete and self
contained so that,
for example, there is no risk of satellite
systems reading RFID tags. Even so, data can be transferred
between the various systems by devices such as cellular phones.

The following are some examples of the potential bene-

2.6
fits of RFID applications:

— for the individual it can mean safety (e.g. food safety, health
care, anti-counterfeiting), convenience (shorter check-out
improved airport baggage handling, automated
queues,
payment) and improved patient care, especially for chronic
illnesses such as dementia;

— in transport it is expected to improve efficiency, security and

service quality for people and goods;

— in healthcare, RFID has the potential to increase the quality
of care and patient safety, and to improve medication
compliance and logistics. Work is under way to put RFID
tags on individual pills;

— in many industries where counterfeiting is prevalent, the use
of RFID may help pin point where illicit goods enter the
supply chain;

— RFID tagging may also help improve the sorting and recy-
cling of product parts and materials with positive results for
waste management and sustainable development.

2.7 Many aspects of RFID use are illustrated by its applica-
tion to the life cycle of books. The sheer number of books in
print creates a logistical nightmare for publishers, distributors,
libraries and retailers. Apart from the supply chain logistics,
there is a need to track books once they have been shelved so
that they can be both located and replaced. In addition, libraries
need to control the loan cycle while purchasers may have diffi-
culty keeping track of their own books. RFID tags on books
provide a solution to all these problems. The control of lending
library loans will have an analog in any other application where
items are recycled or rented.

2.8
To illustrate the nature of the threats inherent in this
technology, here is the abstract of an IBM patent application
(20020615758) from November 2002. It concerns the identifi-
cation and tracking of persons using RFID tagged items.

‘A method and system for identifying and tracking persons using
RFID-tagged items carried on the persons. Previous purchases
records for each person who shops at a retail store are collected by
point of sale terminals and stored in a transaction data base.
When a person carrying or wearing items having RFID tags
enters the store or other designated area, an RFID tag scanner
located therein scans the RFID tags on that person and reads the
RFID tag information. The RFID tag information collected is
correlated with transaction records stored in the transaction data
base according to known correlation algorithms. Based on the
results of the correlation, the exact identity of the person or certain
characteristics about that person can be determined. This informa-
tion is used to monitor the movement of the person through the
store or other areas.’

American Express patent application number 20050038718 is
along similar lines.

RFID is clearly much more than an electronic bar code.
2.9
In the patent application abstract quoted above the key differ-
ences are that:

— in retail it could help to reduce supply shortages, inventory

levels and theft;

(a) the tag contains not only the item description but also the
discrete item identifier which in turn can identify its
purchaser;

27.10.2007

EN

Official Journal of the European Union

C 256/69

(b) the tag need not be a physical micro chip. The circuits can
be directly printed onto most materials such as a garment;

arm. Slightly larger than a grain of rice and enrobed in glass
and silicone, the chip is used to identify people when they enter
and pay for drinks. It is injected by a nurse under a local anaes-
thetic. In essence, it is an RFID tag.

(c) the tag can stay alive after the sale so that it can be continu-

ally re-read;

(d) the tag readers are not just at the point of sale, they can be

anywhere and not just on the premises of the retailer;

3. Gist of the Communication

(e) the correlation via a data base introduces new dimensions

to data collection, privacy and data security.

3.1
RFID is of policy concern because of its potential to
become a new motor of growth and jobs, and thus a powerful
contributor to the Lisbon strategy, if the barriers to innovation
can be overcome.

2.10 Whether a tag should stay alive beyond the retail
checkout is a matter for debate. On the one hand, it is a threat
to privacy. On the other hand, it could benefit the purchaser.
For example, the possibility of RFID readers in the home could
help the organisation of wine cellars, refrigerators, wardrobes
and libraries. Logically, therefore, the choice should rest with the
individual, but the technology and the application must present
him or her with that choice.

2.11
RFID has many more applications than retail product
identification. The EESC identity key card is an RFID device. The
London underground system uses RFID cards extensively for
payment and access. Credit cards will soon incorporate an RFID
device for handling low value transactions without a pin code.
RFID plaques are used for road tolling and driver identification
applications. Access to ski lifts at some European ski resorts is
controlled by RFID plaques carried in a pocket of the ski suit.
Your rapporteur carries three RFID cards and one RFID plaque
on a daily basis. His dog is identified by a sub-cutaneous RFID
chip. Such chips are coming into widespread use world-wide for
animal tagging to provide traceability in the food chain. It could
be just a small step to tagging criminals and problem patients
just like dogs.

2.12
The identity card as used by the EESC is a benign RFID
application. Identity becomes a far more significant challenge
when RFID tags are incorporated into working clothes or
uniforms so that the movements of the uniformed person can
be continually tracked by scanners located at all key points on
the premises. Nevertheless, it must be acknowledged that this
can be in certain cases desirable, e.g. for safety purposes. In any
case, tracking the location of an individual, if not accompanied
by proper safeguards, would be a major invasion of privacy
which needs substantial justification and very careful control.

2.13
As a bizarre harbinger of future applications The Econo-
mist reports that at the Baja Beach Club in Barcelona the entry
ticket into the VIP area is a microchip implanted in the patron's

The Commission carried out a public consultation on
3.2
RFID in 2006, which highlighted the expectations of the tech-
nology based on the results of
the early adopters but also
revealed the concerns of citizens about RFID applications that
involve identification and or tracking of persons.

3.3
Further development and widespread RFID deployment
could further strengthen the role of information and communi-
in driving innovation and promoting
cations
economic growth.

technologies

3.4
A clear and predictable legal and policy framework is
needed to make this new technology acceptable to users. As
RFID technology is inherently trans-border,
this framework
should ensure consistency within the internal market.

3.5 Security, Privacy and Ethics

There are serious concerns that

3.5.1
this pervasive and
enabling technology might endanger privacy: RFID technology
may be used to collect information that is directly or indirectly
linked to an identified or identifiable person and is therefore
deemed to be personal data; RFID tags may store personal data;
RFID technology could be used to track or trace people's move-
ments or to profile people's behaviour. RFID has the potential
to be an intrusive technology. Concerns have been raised about
infringement of fundamental values, privacy and greater surveil-
lance, especially in the work place, resulting in discrimination,
exclusion, victimisation and possible job loss.

3.5.2
It is clear that the application of RFID must be socially
and politically acceptable, ethically admissible and legally allow-
able. RFID will only be able to deliver its numerous economic
and societal benefits if effective guarantees are in place on data
protection, privacy and the associated ethical dimensions that lie
at the heart of the debate on the public acceptance of RFID.

C 256/70

EN

Official Journal of the European Union

27.10.2007

3.5.3
The Community legislation framework on data protec-
tion and privacy in Europe was designed to be robust in the
face of innovation. The protection of personal data is covered
by the general Data Protection Directive (1) which is applicable
to all technologies including RFID. The general Data Protection
ePrivacy Directive (2).
Directive
Pursuant to these directives, public authorities in Member States
will have to ensure that the introduction of RFID applications
complies with privacy and data protection legislation. It may
therefore be necessary to provide detailed guidance on the prac-
tical implementation of RFID applications and to draw up asso-
ciated codes of conduct.

complemented by the

is

3.5.4
Concerning security, a joint effort of industry, Member
States and the Commission will be made to deepen the under-
standing of
the systemic issues and related security threats
potentially associated with the massive deployment of RFID
technologies and systems. An important aspect of the response
to the above challenges will be the specification and adoption of
design criteria that avoid risks to privacy and security, not only
at the technological but also at the organisational and business
process levels. Therefore a close examination of the cost and
benefits of specific security and privacy-related risks is needed
prior to the selection of RFID systems and the deployment of
RFID applications.

There are concerns about the openness and neutrality
3.5.5
of the data bases that will register the unique identifiers that lie
at the heart of the RFID system, the storage and handling of the
collected data and its use by third parties. This is an important
issue since RFID will create a new wave of internet development
which will eventually interconnect billions of smart devices and
sophisticated sensor
into a global networked
communication infrastructure. This new phase of internet devel-
opment is the ‘Internet of Things’.

technologies

3.5.6
The system for registering and naming of identities in
this future ‘Internet of Things’ should guard against breakdown
or unintended use that could cause havoc. It should not fall into
the hands of particular interests that could use these data bases
and systems for their own ends. Security, ethics and privacy
requirements
stakeholders,
whether individuals or companies, whose sensitive commercial
information is
contained in the RFID enabled business
processes.

safeguarded for

should be

all

3.5.7
The requirements of both the parties actively involved
in setting up the RFID information system (for example business
organisations, public administrations, hospitals) and the end
users that are subjected to the system (citizens, consumers,
patients, employees)must be considered during the design of the
system. As end users typically are not involved at the design
stage, the Commission will support the development of a set of

(1) Directive 95/46/EC on the protection of individuals with regard to the

processing of personal data.

(2) Directive 2002/58/EC concerning the processing of personal data and
the protection of privacy in the electronic communications sector.

application specific guidelines (code of conduct, good practices)
by a core group of experts representing all parties. By the end
of 2007, the Commission will issue a Recommendation to set
out the principles that public authorities and other stakeholders
should apply in respect of RFID usage.

3.5.8
The Commission will also consider including appro-
priate provisions in the forthcoming proposal for the amend-
ment of the ePrivacy Directive and will, in parallel, take into
account input from the forthcoming RFID Stakeholder Group,
the Article 29 Data Protection Working Party and other relevant
initiatives such as the European Group on Ethics in Science and
New Technologies. On this basis the Commission will assess the
need for further legislative steps to safeguard data protection
and privacy.

closely monitor

The Commission will

3.5.9
the move
towards the ‘Internet of Things’ of which RFID is expected to be
an important element. At the end of 2008 the Commission will
publish a Communication analysing the nature and the effects
of these developments, with particular attention to the issues of
privacy,
It will assess policy options,
including the possibility of further legislative steps to both safe-
guard data protection and privacy and address other public
policy objectives.

trust and governance.

3.5.10
Ethics are given in section 4 of the Opinion.

Observations on the issues of Security, Privacy and

3.6 Other RFID Policy Issues

3.6.1
Apart from the whole field of security, privacy and
ethics, the other policy issues raised by RFID involve the radio
spectrum, standards, health, safety and environmental issues.

3.6.2
Harmonisation of spectrum usage conditions is impor-
tant to allow easy mobility and low costs. The Commission
recently adopted a decision (2006/808/EC) for RFID frequencies
in the UHF band. This allocation is deemed to be adequate for
the three to ten year horizon but if the need for additional spec-
trum should arise the Commission will act accordingly, using its
powers under the Radio Spectrum Decision (676/2002/EC). The
EESC accepts this position.

for

3.6.3
The streamlined adoption of new ISO international
standards and the harmonisation of regional standards are
essential
the smooth take-up of services. The relevant
European standards bodies — CEN and ETSI — are fully
involved. The Commission is calling on these bodies, together
with industry, to ensure that the developing standards meet
European requirements, with particular
regard to privacy,
security, IPR and licensing issues. Because industry standards

27.10.2007

EN

Official Journal of the European Union

C 256/71

and proprietary patents often advance together the EESC urges
the Commission to do what it can to push industry and the
standards bodies to move fast to prevent European applications
of RFID becoming over dependent on expensive intellectual
property owned elsewhere.

3.6.4
Regarding the environment, RFID devices are fully
covered by the WEEE and RoHS Directives. On health, there is
the potential
issue of electromagnetic fields (EMF) associated
with RFID devices. EMF related to RFID are generally low in
power and so the exposure of workers and the general public is
expected to be well below the current standard limits Neverthe-
less, in the context of the general increase in wireless applica-
tions, the Commission will keep the legal framework under
review. The EESC accepts this position.

4. Observations

4.1
Since the Commission will be publishing its Recommen-
dations to Member States at the end of this year it is reasonable
to suppose that it will accept the data security and privacy infra-
structure as it is today. In particular, this suggests that the Data
Protection bodies which already exist in each Member State will
become the responsible Authority for RFID privacy and data
protection issues.

(d) Tags can be read from a distance, not restricted to the line
of sight, by readers that can be incorporated invisibly into
nearly every environment where human beings congregate.
tiles, woven into
Readers can be embedded into floor
carpeting, hidden in doorways and concealed in shelving,
making it virtually impossible for an individual to know
when he or she is being scanned.

(e) If personal identity is linked with unique RFID tag numbers,
individuals can be tracked or profiled without their knowl-
edge or consent.

(f) It is possible to envisage a world where RFID readers form a
pervasive global network. Such a network would not need
readers everywhere. Congestion charging in London can
track all cars entering central London with a relatively few
strategically located cameras. A network of strategically
located RFID tag readers could be constructed in the same
way. It must not be allowed to happen.

In the 7th R&D Framework programme the Commission
4.4
has already given guidance on the ethical application of tech-
nology as it affects data security and privacy (‘Guide for Appli-
for collaborative projects, p. 54) (3) RFID is a prime
cants’
example of the evolving relationship between technology and
the legal right to, or the public expectation of privacy in the
collection and sharing of data. Privacy problems exist wherever
uniquely identifiable data relating to a person or persons are
collected and stored, in digital form or otherwise. Improper or
non-existent disclosure control can be the root cause for privacy
issues. The most common sources of data that are affected by
data privacy issues are health, criminal justice, finance, genetics
and location. Location is the key issue for RFID.

In its communication the Commission has stated that,
4.2
inter alia,
it will establish and consult a new Stakeholders
Group. The EESC would like to present this Opinion to that
Group.

In its guidance (4) on how to deal with data protection
4.5
and privacy the Commission has laid down eight enforceable
principles of good practice. These are that data must be:

— Fairly and lawfully processed

The threats to privacy and civil liberties posed by RFID

4.3
are profound:

— Processed for limited purposes

(a) RFID tags can be embedded into/onto objects and docu-
ments without the knowledge of the individual who obtains
these items. As radio waves travel easily and silently through
fabric, plastic and other materials, it is possible to read RFID
tags sewn into clothing or affixed to objects contained in
purses, shopping bags, suitcases and more.

(b) Electronic Product Code could enable every object on earth
to have its own unique ID. The use of unique ID numbers
item registration
could lead to the creation of a global
is identified and
system in which every physical object
linked to its purchaser or owner at the point of sale or
transfer.

(c) RFID deployment requires the creation of massive data bases
containing unique tag data. These records could be linked
with personal
identifying data, especially as computer
memory and processing capacities expand.

— Adequate, relevant and not excessive

— Accurate

— Not kept longer than necessary

— Processed in accordance with the data subject's rights

— Secure

— Not transferred to countries without adequate protection

These guidelines are wholly appropriate to the privacy and data
security issues involved with applications of RFID.

(3) http://cordis.europa.eu/fp7/dc/index.cfm?fuseaction=UserSite.Coop-

erationDetailsCallPage&call_id=11.

(4) Data Protection Directive 95/46/EC Article 6.

C 256/72

EN

Official Journal of the European Union

27.10.2007

In the opinion of the EESC, the basic principles of good

4.6
practice are as follows:

— RFID users must make public their policies and practices
and there should be no secret databases of personal informa-
tion.

— Individuals have a right to know when items in the retail
environment contain RFID tags or readers. Any tag reading
which takes place in a retail environment must be trans-
parent to all parties.

— RFID users must give notice of the purposes for which tags
and readers are used. The collection of information should
be limited to that which is necessary for the purpose in
hand.

— RFID users are responsible for the implementation of the
technology and are responsible for operating within the data
security laws and guidelines. They are also responsible for
the security and integrity of the system and its databases.

Ideally, any business

How these principles should be put into practice is a
4.7
moot point.
involved in business-to-
consumer transactions, such as retail, ticketing, access controls
or transport services would give customers a form of guarantee
that
these principles will be followed, a type of customer
charter. Conceptually such a charter could incorporate all the
data protection principles of good practice detailed in paragraph
4.5. In addition, the EESC proposes the following guidelines:

(a) Merchants should be prohibited from forcing or coercing
customers into accepting live or dormant
tags in the
products they buy. Options could include attaching tags to
packaging or using removable tags analogous to price
tickets.

(b) Customers should be free to remove or disable any tags on

items in their possession.

(c) RFID should not, in principle, be used to track individuals.
for

Human tracking is inappropriate, whether
example, clothing, goods, tickets or other items.

through,

(d) RFID should never be used in a way which could eliminate

or reduce anonymity.

(e) The responsible authority should give clear guidance that (c)
and (d) will only be admissible in exceptional circumstances
and with prior formal notification to the Authority.

Certain exceptions to the above guidelines may be

4.8
contemplated when

Brussels, 11 July 2007.

— Private individuals exercise the option to keep tags alive for

their personal convenience.

— Private individuals give their consent to being tracked in
critical environments such as highly secure public and
private establishments and institutions.

— Private individuals choose to use applications which will
locate them and identify them in the same way as they are
already located and identified by the use of mobile phones,
ATM cards, internet addresses, etc.

Any such exceptions should be notified to the responsible
authority.

4.9
A class of applications which could be given general
exemption is the tracking of people or goods in transient envir-
onments. In the air transport environment baggage could be
tagged at check in to improve the security and certainty of
baggage handling while passengers might be tagged to improve
and accelerate on time plane movements and faster security
processes. Another application could be the tracking of patients
after admission to hospital for operations. The key to accept-
ability for this class of application would be the certain eradica-
tion of the tags at the end of the transient experience.

4.10
RFID is not a mature technology so we do not yet
understand its full potential. On one hand it may deliver incon-
ceivable benefits to our technological civilization, on the other
hand it may be the greatest technological threat yet to privacy
and liberty. The EESC believes that applications of RFID should
be developed according to a strict code of ethics in respect of
privacy, liberty and data security but that, given the necessary
safeguards, application development should continue.

In conclusion, where RFID applications are permitted,
4.11
the implementation should be fully transparent
to everyone
involved. Applications to improve the handling of goods are
generally acceptable. Applications
involving the tagging of
people are generally not acceptable except in transient environ-
ments. Applications which link people to goods may be accep-
table for marketing purposes. Applications which identify
people via the goods they have purchased are generally unaccep-
table. Moreover, some applications are inappropriate in a free
society and should never be permitted. The imperative need to
preserve privacy and anonymity must be the core of the Recom-
mendation by the Commission to the Member States.

The President

of the European Economic and Social Committee

Dimitris DIMITRIADIS