Corporate & Commercial
Cite as: D. Zachary Hostetter, When Small Technology is a Big Deal: Legal Issues Arising From Business Use of RFID, 2 Shidler J. L. Com. & Tech. 10 (Dec. 16, 2005), at <http://www.lctjournal.washington.edu/Vol2/a010Hostetter.html>
© 2005 D. Zachary Hostetter
Radio Frequency Identification (“RFID”) is a wireless tracking technology. Goods fitted with radio tags can communicate with computers via radio waves, revolutionizing methods to locate and catalogue goods at every stage of the supply line. Current research predicts that 40% of all inventory intensive businesses will have such wireless tracking systems by the end of 2005.
This article examines current legal trends that impact business use of RFID including contractual considerations to properly allocate risks attendant with implementation of RFID, FCC regulation of RFID, and consumer privacy concerns.
Introduction
What is RFID?
Commercial Use of RFID
FCC Licensing for RFID
Standardization of RFID Technology
Contractual Issues Arising in RFID Deployment
Consumer Privacy and RFID
Conclusion
<1> Billions of RFID tags, which include wireless tracking devices, are predicted to be deployed by 2005 alone, making the technology poised to become as ubiquitous as the barcode.2 In 1948, the first work explaining the potential to use radio as an identification device was written.3 However, the technology required to implement the idea did not exist until thirty years later. In 1991, RFID gained a foothold when the world’s first highway electronic tolling system opened in Oklahoma.4 The system, currently known as EZ-pass, was soon adopted by other states, allowing thousands of cars a day to drive through toll booths without stopping and have their license plates scanned as a means of paying tolls
<2> Wal-Mart has required its top 100 suppliers to begin rollout of RFID systems in January 2005.5 However, RFID technology has encountered considerable opposition from privacy advocates and federal and state regulators concerned with the tracking capabilities of RFID. This Article examines regulatory and legal issues associated with RFID that may affect the decisions and policies of businesses considering implementation of the technology.
<3> RFID systems are a subset of a larger class of technology known as automatic identification (“Auto-ID”) systems.6 Auto-ID systems are used to track and compile data about people, animals, and goods.7 Perhaps the most familiar example of Auto-ID is found at any retail or grocery store where goods are tracked by scanning a Universal Product Code (“UPC”), also known as a barcode. A UPC barcode contains product identification as well as the price. Every RFID system uses the same principle. RFID technology can be thought of as “essentially a new and vastly improved barcode.”8 However, it has the potential to revolutionize Auto-ID by taking the technology to the air.
<4> RFID is a method of identifying unique items using radio waves.9 All RFID systems have two components: (1) a transponder (i.e., a tag) and (2) an interrogator (i.e., a reader).10 The tag is attached to the item to be tracked and is fitted with a microchip that holds digital information and an antenna that receives and transmits radio signals. The reader receives information emitted from the tag about the object to which it is attached.
<5> There are two kinds of RFID tags: active and passive. Active tags hold more information and work at greater distances, but must rely on a battery to power the information in the tag. Active tags are often placed on shipping containers or in airplanes. These tags emit a constant signal to a properly tuned reader regarding the plane’s or ship’s identity.11 Passive tags do not rely on battery power. When the reader initiates contact, the tag “wakes up” drawing power from the radiation emitted by the reader.12 The tag is then able to send back information stored on the chip.13
<6> RFID has the potential to revolutionize current methods for tracking goods in a supply chain. Sales for supply chain RFID systems are estimated to reach $1.1 billion by 2007.14 The clear advantage of passive RFID is its low tag cost. In addition, because they do not need batteries, passive tags are less bulky than active tags, the smallest being the size of a grain of sand.15 Therefore, passive RFID is typically the preferred choice for supply chain applications.16
<7> The most important application of RFID is an Electronic Product Code (“EPC”). An EPC is a lot like its predecessor, the barcode. 17 It simply contains information about a product. However, unlike barcodes, which can tell you that a box contains product X, EPCs can distinguish one box of product X from another box containing the same product. The potential to differentiate goods at this level has immense consequences for interacting with goods in a supply chain. For example, suppose a grocery store is alerted that apple juice from the Atlanta, Georgia plant of its beverage supplier has been contaminated. Suppose also that the grocery store has juice from both the Atlanta and Columbus, Ohio, locations.
<8> If a store uses barcodes to identify its inventory, the only information that can be obtained from the individual boxes is that each contains apple juice priced at a given amount. However, if each box is fitted with an RFID tag, it is possible for the grocer to point an RFID reader at her entire apple juice inventory and specify in a matter of seconds which boxes are from the Atlanta plant and which from Columbus.
<9> RFID has other key advantages over UPC systems. RFID requires no line of sight to scan. The technology is also difficult to counterfeit, cannot be smudged, is rewritable, and allows each tag to be programmed with a unique serial number.18 Unlike barcodes, which must be passed in front of a scanner, RFID tags can be read remotely merely by being in the vicinity of the reader, sharply reducing time and labor.19 In short, RFID tags enable a grocery clerk to scan all of the items in a cart in the time it takes to scan one barcode, without having to touch a single item.
<10> Businesses that are considering implementing RFID EPC systems should be aware that federal regulations promulgated by the Federal Communications Commission (“FCC”) may limit their application. The FCC regulates radio frequencies in order to prevent interference with other systems near the same frequency bands.20
<11> The FCC’s regulation of “low-power” devices governs RFID systems.21 Since these devices have a low potential for interference with other wireless devices, they do not require a license from the FCC. However, these devices must be authorized via the FCC certification process. “Certification entails filing an application with the FCC containing: (a) legal information about the filing party and the device; (b) a technical report consisting of, among other things, a block diagram of the device and Radio Frequency test results (usually conducted by an accredited testing lab) of the device and its components; and (c) an analysis as to how the device complies with FCC regulations.”22 The only party responsible for fines or disciplinary action for noncompliant systems is the manufacturer of the component parts. But operators and businesses that use a noncompliant system can be affected if the FCC orders it to be removed from the market.23
<12> The RFID frequency band is 902 Megahertz (“MHz”) to 928 MHz.24 Federal regulations limit that band to a field strength of 1/2 volts per meter.25 In other words, when the tag is one meter away from the reader, the radio signal can be no stronger than one half of a volt. This field strength can be problematic for passive tags that need a higher voltage at the distance of one meter to power up. One possible consequence, if this is the case, is that the tags closest to the reader on a pallet of goods will be updated into the system while tags furthest away will remain unread. Federal regulations also stipulate that the RFID carrier frequency must “hop” from channel to channel within the 902 MHz to 928 MHz bandwidth. The regulation specifies 50 channels, and the RFID reader may not dwell on any channel for more than .4 seconds before switching to another channel.26
<13> Since the early 2000s, the focus of RFID systems has been at 915 MHz. Not all business applications will fit within this standard. The frequency band limitation has important implications with regards to the range at which an RFID tag can be read. At 915 MHz, use of a single reader with an antenna must be within ten feet of the tag to be read.27 Passive tags in this bandwidth are also unreadable at high speed.28 Perhaps the chief disadvantage at 915 MHz is the interference of liquid. A tag that reads at ten feet will read almost nothing when close to liquid.29
<14> In 2004, Wal-Mart announced its intention to require its top 100 suppliers to adopt RFID systems by January 2005.30 Many other suppliers have begun using RFID of their own volition.
<15> RFID is plagued by the same obstacle that confronted the advent of VCRs, computers and cell-phones: compatibility.31 This poses two important questions regarding contract relations between a retail business like Wal-Mart and its suppliers: (1) how will the risk of implementing a new technology be allocated between the two parties? (2) How will the technology be unified in order to be effective at every stage of the supply line from supplier to retailer?
<16> There are approximately twenty different manufacturers of RFID readers worldwide.32 Given these different systems, businesses implementing RFID should consider using what are called “intelligent” readers that can be calibrated to read different kinds of RFID tags and therefore read different manufacturers’ products. However, the technology for these “intelligent” readers is still in the early stages of development making implementation difficult.
<17> One entity striving to create standardization of RFID is called EPCglobal.33 EPC stands for “electronic product code”. EPCglobal is a developer of industry standards for various EPC systems, including barcodes. It is a joint venture of EAN International and the Uniform Code Counsel (“UCC”), and is governed by a board of governors composed of major companies; including Wal-Mart.34 In December 2004 EPCglobal ratified a unique specification for tracking goods with RFID, labeling it the second generation of EPC, or “Gen 2”.35
<18> EPCglobal’s Gen 2 experiment promises global interoperability of RFID by creating a system that captures information using RFID technology and enters it into the global supply chain in real time.36 In other words, computers would have the ability to “see” each product in the supply chain at any given time via the Internet. Perhaps the most important aspect of EPCglobal’s Gen 2 project is that it may provide compliance with FCC as well as international regulations.37 Although regulations in Asia are not fully defined, regulations in Europe are more constrained than the United States to accommodate its crowded electromagnetic environment.38
<18> The Gen 2 protocol implicates possible legal issues with intellectual property rights. Although EPCglobal claims that the Gen 2 standard can be used free of royalties, a company called Intermec Technologies claims that Gen 2 uses technology that it has patented.39 EPCglobal has responded that Gen 2 can be implemented without using any of Intermec’s patents. However, vendors of RFID systems can be sure to avoid liability only by negotiating licensing fees with Intermec or any other patent holder.
<19> The standardization promised by EPCglobal is promising; however, Wal-Mart is unwilling to wait for the promise to become a reality.40 Suppliers must choose between scores of RFID programs now in order to do business with major retailers such as Wal-Mart.41 Many suppliers are worried that they will have to invest in new and unproven RFID technology with little expectation of a return on their investment.42 Businesses implementing RFID for the first time should consider a host of contractual issues in their contracts with purchasers as well as with vendors that sell or license RFID systems.
<20> Businesses at the beginning of the supply chain often do not store the inventory of other businesses and therefore do not need to employ intelligent readers that can read multiple brands of tags. These businesses should consider passing the risk of RFID technology to subsequent parties in the supply chain. Any supply contract between such businesses should specify the type of RFID technology to be used. This will entail negotiating a contract that takes into account the expectations of businesses on the receiving end of the goods in the supply chain as well. Any seller that uses RFID should document the type of tag that is affixed to the product and explicitly disclaim liability for failure of tags to meet specific expectations of the buyer (e.g. volume of tags that must be read, the distance needed to read tags, ability to rewrite tags with additional information etc.).
<21> Once a supplier has decided on and negotiated RFID specifications with purchasers, it must also negotiate a contract with an RFID system vendor. Some of the issues to consider in contracts for the supply or licensing of RFID technology include: (1) defining the RFID system and how it operates; (2) the scope of deployment of the system and permissible uses; (3) cost of the system; (4) time frame for deployment of the RFID system from start to finish; (5) whether and in what ways the system can be modified over time; (6) what brand of tags must be used at what cost; (7) how the tags should be affixed to the items being tracked; (8) whether the system is FCC compliant; (9) how subsequent modification will affect FCC compliance43 ; (10) how any related software will work (and any limitations); and (11) indemnification against possible infringement of intellectual property rights for the software.44
<22> The promised global interoperability of the Gen 2 standard that allows RFID to function in supply chain applications also raises consumer privacy issues. Interoperability increases the risk that information from tags attached to consumer goods can be scanned by an unintended third party. The size of RFID tags makes them easy to embed in consumer products without a consumer knowing that the technology is present. RFID technology also permits unique numbering of individual items such that an individual consumer might be linked to a particular product in his or her possession. Moreover, databases can hold the unique information contained on each RFID tag making it possible to link individual persons with objects. RFID also makes it possible to track a person and his habits without his consent.45
<23> RFID tracking has already been implemented in some applications. A California public school in January 2005 implemented a policy requiring students to wear ID cards embedded with RFID tags. Each time a student walked through a door inside the school, a reader updated the information into a database indicating whether the student was at school and at what time, whether the student went to class, and how many times the student went to the bathroom.46 The program was terminated by February, however, due to public opposition.47
<24> At present the majority of the opposition is for item-level implementation of RFID in retail sales. Consumers are reportedly concerned about their groceries or clothing emitting radio waves containing private information about them. Consumers may also want to know about the location of RFID readers and when they will be used. The U.K. based clothing retail store, Marks and Spencer, gives notice to customers not only that RFID tags are present in clothing, but that they will not be scanned by readers at the register.48
<25> Six states have suggested legislation of RFID, none of which have come to fruition. Nevertheless, businesses should be aware of FCC regulations and look for future regulation of RFID at the state and local level. California, Utah, and Missouri legislators have introduced bills to regulate RFID.49 Maryland, Massachusetts, and Virginia have indicated that they will follow suit.50 The Missouri bill is the least intrusive, and merely requires retailers that use RFID tagged products to display that fact on the product.51 The Utah bill goes further. It not only requires notice to customers of the presence of RFID, it requires manufacturers and distributors to alert retailers of the presence of tags and to teach them how to kill the tags if possible.52 A similar California bill was defeated by members of the California state assembly.53
<26> Although the California bill regarding retail use of RFID was defeated, the Identity Information Protection Act of 2005 was admitted to the assembly floor on September 2, 2005.54 The bill requires a three-year waiting period before RFID can be used in connection with identity documents in California, including driver’s licenses. It also requires that the information contained in an identification document embedded with RFID be limited to a unique identifier rather than personal information, and makes it a crime to read such information surreptitiously from an RFID tag.55
<27> Businesses can deploy RFID systems in a way that alleviates consumer privacy concerns. In order to err on the side of caution, businesses should use “read only” (not rewritable) tags; “kill” the tags before they are released to consumers; affix tags to packaging rather than the object; alert consumers to the presence of readers and the manner in which they will be used; and place a notice that RFID tags are present together with instructions for removal. Retailers that use RFID should have a privacy policy available to consumers. Finally, businesses should address consumer privacy concerns by educating the public about RFID including what RFID tags look like and how the technology works.
<28> RFID may revolutionize the way in which goods are tracked in the supply chain.56 Businesses that supply goods for Wal-Mart or the US Department of Defense have already begun tagging pallets with RFID. A recent study found that 40% of inventory-intensive small to medium-sized businesses in the United States will have a wireless tracking system such as RFID by the end of 2005.57
<29> Businesses that use RFID as part of supply chain management must be proactive in allocating risks associated with use of RFID into their contracts.