RFID: Legislation - Good News and Not-So-Good News

California SB 768, the Identity Information Protection Act of 2006, passed the State Senate on August 30, 2006.  The Governor has 30 days to sign it.  It has been expected that this legislation would pass in one form or another -- the question was, "which" form.  The good news is that industry representatives and legislators worked together to craft the final wording that was deemed acceptable to both sides. That's also the not-so-good news.

First, it's important to acknowledge that Senator Simitian and his supporters were willing to listen to industry representatives and modify the wording of the legislation to accommodate current and evolving measures to ensure information privacy.

While both sides deserve a vote of appreciation for their tireless efforts (and the many hours they devoted to this issue), it is unfortunate that so much effort was required.

The good news is that SB 768 does not mandate any specific means to ensure privacy.  It allows industry to develop new technologies and techniques to comply with the overall protection policies.

The not-so-good news is that a separate RFID bill was deemed necessary at all.

There are already laws in existence that address unauthorized access to personal information and could, with small additions, include information carried on an RFID tag.

Broad-reaching RFID legislation is, in most cases, a waste of time.  Trying to anticipate all forms of possible applications and any potential threat is a bit like looking at college dorm rooms for a three-year-old.  A lot will change by the time the child's ready for college just as a lot will change in RFID even in the next year.

Any legislation that specifies a particular technique, technology or product to ensure privacy is a bad idea -- and one that SB 768 avoided.  Specifying a solution prevents the use of new and potentially better solutions.  This year alone, several products have been introduced specifically to address privacy concerns -- none of which employ conventional techniques. 

This confirms that the industry takes privacy concerns seriously and will continually develop new products to address those concerns.

At the same time, a common-sense approach by those developing RFID-based systems is needed.  Developers need to carefully evaluate that benefits -- both to the issuing agency and the consumer -- of an RFID-based system, determine what information is actually needed, how it needs to be read, whether it needs to include heightened security, and, if so, how to protect it.

Unfortunately, California SB 768 does put significant limitations on the use of RFID-enabled solutions, rather like preventing that 3-year-old from considering many dormitories -- including some that haven't even been planned yet.

But, back to the good news: it's clear that legislators and industry representatives can work together to craft reasonable privacy policy.  However, possible legislation should be carefully evaluated on a case-by-case basis to determine whether it's really needed at all -- or whether it's more like picking out drapes for that dorm room.