list of contributors - GALA

When: March 2005
Where: Italy
What Happened: The local independent Authority (i.e. the Privacy Commissioner), competent
on supervising proper domestic enforcement of the general principles
established by the EU-Directives on protection of personal data, recently has
come to focus its attention on two ‘hot topics’.
(i) The Authority felt necessary to deal with issues and problems linked to
Radio Frequency Identification – RFID technology and particularly to socalled
‘intelligent labels/packaging’.
Specific guidelines have been issued in order to grant sufficient protection to
personal data handled with the process of application of such technology.
The basic principles set by the Commissioner’s guidelines require that
processing of personal data through RFID technology involves:
- adequate information to subjects who’s data are handled,
- possibility for those subjects to express specific consent for the processing of
their data,
- possibility to disable the chips allowing such processing.
In detail the guidelines establish that:
- the public has to be made clearly aware of the fact that RFID technology is
applied and that devices able to track “intelligent labels/packaging” are in
place (such alert must be provided on products’ packaging as well as in
locations – e.g. shops – where such technology is in use),
- private subjects may apply RFID technology only after obtaining specific
and explicit consent from the targeted public and such consent may not be
achieved through improper pressure or conditioning,
- ‘intelligent labels’ have to be placed in a way that allows customers to
disable them easily after the product’s purchase (basically RFID chips should
not remain active after the cashier barrier; finally such chips may not be
placed in a way that they interact with the product’s functionality)
- RFID technology applied to control access to restricted areas has to consider
and respect employee’s rights and liberties,
- subcutaneous chips (to be previously approved by the competent authority
as to their technical function) may be placed only in exceptional cases and for
justified purposes of health care/protection (the implantation of such devices
has to be kept strictly confidential and the interested subjects may ask for
removal at any time),
- the use of RFID technology has to be proportionate to the purposes aimed
at and the data collected may be stored only for a reasonable period of time,
- whoever applies such technology, has to grant proper safety measures in
order to reduce the risks of destruction or loss of the collected data as well as
of undue access to or mishandling of them,
- the collection of data, performed through means of electronic
communication, allowing to locate a person/product geographically or
aimed at data subject’s ‘profiling’, have to be notified to the Privacy
Commissioner prior to the start of such procedure.
(ii) Acknowledging the widespread use of so-called ‘fidelity cards’ in areas
such as retail, transportation, financial, phone and publishing services, the
local Privacy Commissioner also considered it necessary to set some basic
principles for the processing of personal data (sometimes even of sensitive
data) performed in this particular context.