Radio Frequency Identification (RFID) tags are finding their way into a broad range of new applications that have raised concerns about privacy that demonstrate how emerging information technologies can upset the balance of privacy, personal benefits, and public safety and security. Although proposed retail uses are new, RFID tags have been used to control access in the workplace for over a decade. The authors conducted a case study of six enterprises to understand their policies for collecting, retaining, and using personally identifiable records obtained by sensing RFID-based access cards. They found that RFID usage in the surveyed workplaces has a number of common features (data are used for more than access control, access control system records are linked with other enterprise databases, and security and employment practices trump privacy concerns), but that policies are not generally written down or communicated to employees. They conclude that although employees ought to be informed about uses of access control system records and have the right to inspect and correct records about their activities, implementing traditional fair information practices for access control systems records would be impractical for some situations, such as the individual’s ability to correct an erroneous record. Thus there is a need for a modified notion of fair information practices with regard to this use of RFID technology.
The research in the public interest described in this report results from the RAND Corporation’s continuing program of self-initiated research. Support for such research is provided, in part, by donors and by the independent research and development provisions of RAND’s contracts for the operation of its U.S. Department of Defense federally funded research and development centers.
This report is part of the RAND Corporation technical report series. RAND technical reports may include research findings on a specific topic that is limited in scope or intended for a narrow audience; present discussions of the methodology employed in research; provide literature reviews, survey instruments, modeling exercises, guidelines for practitioners and research professionals, and supporting documentation; or deliver preliminary findings. All RAND reports undergo rigorous peer review to ensure that they meet high standards for research quality and objectivity.
Permission is given to duplicate this electronic document for personal use only, as long as it is unaltered and complete. Copies may not be duplicated for commercial purposes. Unauthorized posting of RAND PDFs to a non-RAND Web site is prohibited. RAND PDFs are protected under copyright law. For information on reprint and linking permissions, please visit the RAND Permissions page.
The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.