Chips Ahoy? The Legal Issues Associated with Radio Frequency Identification Technology (RFID) in the Workplace

Chips Ahoy? The Legal Issues Associated with Radio Frequency Identification Technology (RFID) in the Workplace Jennifer Shaw Deputy Director American Civil Liberties Union of Washington CONTENTS 1. Article regarding the ACLU s work around RFID published in the King County Bar Association s Bar Bulletin 2. ACLU of Washington flyer regarding RFID in identity cards 3. ACLU of Washington flyer regarding privacy protection in the age of technology 4. ACLU of Washington flyer regarding the use of RFID in transit passes 5. Text of HB 2729 a Washington state bill enacted in 2007 that prohibits the skimming of information from the RFID tag in Washington s Enhanced Driver s License 6. Bill report for HB 2729 that summarizes the effects of HB 2729

RFID IN ID CARDS Could enable the remote identification, tracking and stalking of RFID-equipped cardholders. DON T CHIP MY RIGHTS AWAY What Is RFID? Radio Frequency Identification (RFID) tags store and broadcast information to reader devices. Developed as a way of tracking products, RFID raises serious privacy and security concerns when incorporated into identification cards. When information traditionally printed on an ID card such as name, address, Social Security Number, or driver s license number is stored on an RFID tag, it forces individuals to broadcast their personal information without any notice or choice. RFID Tags: Do not notify an individual when information on the tag is read; Do not typically allow individuals to easily turn them off or block the sending of their information; RFID Use for Identification Threatens Personal Safety Today s RFID technology is too crude to protect private information from unauthorized access. Privacy protections are needed. People Should Know When Their Data Is Read Unlike ID cards equipped with barcodes or magnetic stripes, an RFID-equipped card does not have to be physically given to an individual wanting the card s information. Instead, personal information can be secretly read through wallets, pockets, backpacks, or purses by identity thieves, pickpockets, government officials, and others. People would never know if their identity information were stolen, or if they were being targeted, tracked or stalked. People Should Be Able to Choose Who Sees Their Information The RFID technology touted for today s ID cards does not allow individuals to authorize the sending of their personal information. With RFID, cardholders movements could be tracked, sacrificing anonymity at political meetings, protest marches, or private activities. (Continued on back) Could be a source for identity thieves harvesting personal information such as name, date of birth, address, digital photos, fingerprint images, etc; 1

More Secure Alternatives Exist Existing alternatives, like barcodes or magnetic strips, make information more secure than RFID. RFID s advantage is remote access to information precisely what would make RFID-enabled ID holders less safe and less secure. Don tchipmyrightsaway Oppose RFID Use in Identification Documents! Personal information stored on drivers licenses and other government issued IDs should be protected and secure, and not put the ID holder at risk for tracking, stalking, or identity theft. RFID should not be used on ID documents unless the technology protects data privacy and allows people to control when their data is read. As use of RFID spreads, we urge policy-makers to: Resist using RFID in government-issued identification cards, such as driver s licenses or student ID cards. Provide guidelines for RFID use for personally identifiable information, including an individual s right to be notified when someone reads his or her information and the ability to block unauthorized reading. Oppose RFID in ID Cards! AMERICAN CIVIL LIBERTIES UNION OF WASHINGTON FOUNDATION 705 2ND AVENUE, 3RD FL., SEATTLE, WA 98104 T/206.624.2184 WWW.ACLU WA.ORG 1/2007 2

PROTECTING OUR PRIVACY IN AN AGE OF TECHNOLOGY Government, business and others can now easily capture and compile our personal information electronically even when we re on the go. Whether they use tiny circuits in our cars, clothes or credit cards, we must take steps to protect our privacy. Why We Need Laws to Protect Privacy Washingtonians may not even know when they have embedded devices transmitting personal information. Hidden electronic devices can store identifying numbers, photos, names, addresses and other information that can be used for identification purposes. Already, our information is stored in a variety of technologies, from 2-D barcodes to RFID tags that can be read from a distance. Without laws to regulate their use, these powerful tools can easily compromise our privacy. There is growing recognition that something needs to be done. Washington state should be a leader in providing protections for its residents while guiding technological innovation. What We Want Lawmakers to Do 1) Require Individual Consent before Third Parties Can Collect Personal Information When others can collect and use information for purposes different than what we intend, we must be able to choose what information to give up on a caseby-case basis. Business and government should have to get individual consent before information collected for one purpose is used for another. And in order to make an informed choice, we must receive notice that is easy to understand. 2) Protect the Privacy of Our Information Washingtonians should not risk identity theft simply by using products or services that incorporate technology. To reduce our risk, government and business should gather and keep only information that is relevant to the services provided, and should do so only with a person s authorization. 3) Protect Our Right to Move Freely Without Being Tracked Traditionally Americans have been able to move and act independently, without others being able to know everything we ve done. Yet emerging technologies can track where we are, where we ve been and predict where we re going painting a portrait that reveals the intimate details of our private lives. Lawmakers should regulate how organizations can aggregate and use this sensitive information. 4) Protect Our Identifying Numbers Increasingly, serial numbers are used to identify us for electronic transactions - from loyalty cards, to transit passes, to credit cards. We must treat these unique identifying numbers as personal information to avoid unwanted tracking and surveillance. If we broadcast the same numbers everywhere we go, we might as well have them tattooed on our forehead. 5) Make Organizations Responsible for Protecting the Data They Hold Many businesses and government agencies digitize our personal information and store it in offices around the world. As a result, our ability to protect this information is drastically reduced instead we must rely on those holding our private data. Organizations storing our personal information should be liable for any invasions of privacy that result from their business practices or negligence. We call on Washington policy-makers to support our privacy, security and freedom by implementing these principles. AMERICAN CIVIL LIBERTIES UNION OF WASHINGTON FOUNDATION 705 2ND AVENUE, 3RD FL., SEATTLE, WA 98104 T/206.624.2184 WWW.ACLU WA.ORG 2/2007

Orca Watch Public Transportation and Your Privacy The privacy of transit riders should be maintained when public transportation payment systems incorporate technological advances. However, the implementation of the new ORCA system is raising questions about how our privacy rights will be protected. Now is the time to address privacy concerns, when ORCA s technology, policies and procedures are still in development. ORCA One Regional Card for All Public transportation agencies in King, Pierce, Snohomish and Kitsap counties are developing a program that will replace all prepaid fare tickets and transfers with a radio frequency identification (RFID) smartcard. This new ORCA card is expected to replace passes received through schools and employers, or purchased through retail outlets. Details Collected about Transit Usage Each time a rider uses an ORCA card, a computer will record the date and time of use, as well as the route and transit agency where the card was swiped. Participating transit agencies will have a history of each ORCA card s transactions, showing when you boarded specific buses, trains, ferries and vanpools. AMERICAN CIVIL LIBERTIES UNION OF WASHINGTON FOUNDATION 705 2ND AVENUE, 3RD FL., SEATTLE, WA 98104 T/206.624.2184 WWW.ACLU WA.ORG 12/2007 If employers and schools pay for a portion of your card, they also may have access to the card s transaction details. This includes the dates, times and routes taken by an individual cardholder both when you are at work and school and when you are on your own time. Protect our Privacy When We Travel Transit agencies involved in ORCA should address the following concerns to protect riders privacy or security. Concern: Employers, schools and other organizations will have access to an individual s travel details. Transaction details about date, time and route number of public transit use can reveal information about your life, including religious and political activities. Having access to such information would enable others to monitor and track of your actions, without your consent. An employer should not be able to know where you catch the bus each Sunday morning. Schools should not know who took a bus after a nearby protest ended. Solutions: Create transit policy to protect the privacy of an individual s transaction history. Meet the reporting needs of organizations subsidizing or providing fare passes by providing aggregate or less detailed information. Continues ON side 2 >>

Orca Watch Public Transportation and Your Privacy >> Continues from side 1 Concern: Information about an individual s transportation usage will accumulate over time and could be reused for unintended purposes. Concern: Unauthorized reading or skimming of Information on the ORCA card s RFID chip will put people s privacy at risk without their knowledge. Other organizations and individuals may seek to obtain database information about how and when individuals use public transit. In other states, third parties already are obtaining details of individuals travel histories for use in divorce and custody cases all they need is the card number associated with the fare pass and transaction history. Solutions: Create transit policy to retain an individual s transaction data only for the shortest time required by law. Maintain only aggregate transaction information for transit analysis and planning purposes. To enable fare payments, ORCA cards will store and transmit information about recent rides, along with a unique card identification number. An unchanging unique identification number when attached to a person or that person s card can become a means for others to monitor the person s movements. ORCA cards should not transmit information to potential stalkers or anyone else looking to collect information about your travels. Solutions: Ensure that only legitimate transit agency readers can access unique identification numbers or other information stored on ORCA cards. Ensure that unauthorized parties cannot track a card through the RFID tag s unique identification number. It s Not Too Late to Make Changes Policies and procedures for the retention, sharing and use of information collected by ORCA are still in development. Privacy concerns should be addressed now, before the ORCA system is implemented.

CERTIFICATION OF ENROLLMENT SUBSTITUTE HOUSE BILL 2729 Chapter 200, Laws of 2008 60th Legislature 2008 Regular Session IDENTIFICATION DOCUMENTS EFFECTIVE DATE: 06/12/08 Passed by the House March 10, 2008 Yeas 0 Nays 0 FRANK CHOPP Speaker of the House of Representatives Passed by the Senate March 7, 2008 Yeas 0 Nays 0 BRAD OWEN President of the Senate Approved March 27, 2008, 4:12 p.m. CERTIFICATE I, Barbara Baker, Chief Clerk of the House of Representatives of the State of Washington, do hereby certify that the attached is SUBSTITUTE HOUSE BILL 2729 as passed by the House of Representatives and the Senate on the dates hereon set forth. BARBARA BAKER FILED Chief Clerk March 28, 2008 CHRISTINE GREGOIRE Governor of the State of Washington Secretary of State State of Washington

SUBSTITUTE HOUSE BILL 2729 AS AMENDED BY THE SENATE Passed Legislature - 2008 Regular Session State of Washington 60th Legislature 2008 Regular Session By House Technology, Energy & Communications (originally sponsored by Representatives Eddy, Pedersen, Appleton, Lantz, Williams, Upthegrove, Santos, Simpson, Hasegawa, Ericks, Ormsby, and Springer) READ FIRST TIME 02/01/08. 1 AN ACT Relating to identification documents; amending RCW 42.56.230 2 and 42.56.330; adding a new chapter to Title 9A RCW; and prescribing 3 penalties. 4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON: 5 NEW SECTION. Sec. 1. The legislature finds that: 6 (1) Washington state recognizes the importance of protecting 7 its citizens from unwanted wireless surveillance. 8 (2) Enhanced drivers' licenses and enhanced identicards are 9 intended to facilitate efficient travel at land and sea borders between 10 the United States, Canada, and Mexico, not to facilitate the profiling 11 and tracking of individuals. 12 (3) Easy access to the information found on enhanced drivers' 13 licenses and enhanced identicards could facilitate the commission of 14 other unwanted offenses, such as identity theft. 15 NEW SECTION. Sec. 2. The definitions in this section apply 16 throughout this chapter unless the context clearly requires otherwise. 17 (1) "Enhanced driver's license" means a driver's license that is 18 issued under RCW 46.20.202. p. 1 SHB 2729.SL

1 (2) "Enhanced identicard" means an identicard that is issued under 2 RCW 46.20.202. 3 (3) "Identification document" means an enhanced driver's license or 4 an enhanced identicard. 5 (4) "Radio frequency identification" means a technology that uses 6 radio waves to transmit data remotely to readers. 7 (5) "Reader" means a scanning device that is capable of using radio 8 waves to communicate with an identification document and read the data 9 transmitted by the identification document. 10 (6) "Remotely" means that no physical contact between the 11 identification document and a reader is necessary in order to transmit 12 data using radio waves. 13 (7) "Unique personal identifier number" means a randomly assigned 14 string of numbers or symbols issued by the department of licensing that 15 is encoded on an identification document and is intended to be read 16 remotely by a reader to identify the identification document that has 17 been issued to a particular individual. 18 NEW SECTION. Sec. 3. (1) Except as provided in subsection (2) of 19 this section, a person is guilty of a class C felony if the person 20 intentionally possesses, or reads or captures remotely using radio 21 waves, information contained on another person's identification 22 document, including the unique personal identifier number encoded on 23 the identification document, without that person's express knowledge or 24 consent. 25 (2) This section does not apply to: 26 (a) A person or entity that reads an identification document to 27 facilitate border crossing; 28 (b) A person or entity that reads a person's identification 29 document in the course of an act of good faith security research, 30 experimentation, or scientific inquiry including, but not limited to, 31 activities useful in identifying and analyzing security flaws and 32 vulnerabilities; or 33 (c) A person or entity that unintentionally reads an identification 34 document remotely in the course of operating its own radio frequency 35 identification system, provided that the inadvertently received 36 information: 37 (i) Is not disclosed to any other party; SHB 2729.SL p. 2

1 (ii) Is not used for any purpose; and 2 (iii) Is not stored or is promptly destroyed. 3 NEW SECTION. Sec. 4. The legislature finds that the practices 4 covered by this chapter are matters vitally affecting the public 5 interest for the purpose of applying chapter 19.86 RCW. A violation of 6 this chapter is not reasonable in relation to the development and 7 preservation of business and is an unfair or deceptive act in trade or 8 commerce and an unfair method of competition for the purpose of 9 applying chapter 19.86 RCW. 10 Sec. 5. RCW 42.56.230 and 2005 c 274 s 403 are each amended to 11 read as follows: 12 The following personal information is exempt from public inspection 13 and copying under this chapter: 14 (1) Personal information in any files maintained for students in 15 public schools, patients or clients of public institutions or public 16 health agencies, or welfare recipients; 17 (2) Personal information in files maintained for employees, 18 appointees, or elected officials of any public agency to the extent 19 that disclosure would violate their right to privacy; 20 (3) Information required of any taxpayer in connection with the 21 assessment or collection of any tax if the disclosure of the 22 information to other persons would (a) be prohibited to such persons by 23 RCW 84.08.210, 82.32.330, 84.40.020, or 84.40.340 or (b) violate the 24 taxpayer's right to privacy or result in unfair competitive 25 disadvantage to the taxpayer; ((and)) 26 (4) Credit card numbers, debit card numbers, electronic check 27 numbers, card expiration dates, or bank or other financial account 28 numbers, except when disclosure is expressly required by or governed by 29 other law; and 30 (5) Documents and related materials and scanned images of documents 31 and related materials used to prove identity, age, residential address, 32 social security number, or other personal information required to apply 33 for a driver's license or identicard. 34 Sec. 6. RCW 42.56.330 and 2007 c 197 s 5 are each amended to read 35 as follows: p. 3 SHB 2729.SL

1 The following information relating to public utilities and 2 transportation is exempt from disclosure under this chapter: 3 (1) Records filed with the utilities and transportation commission 4 or attorney general under RCW 80.04.095 that a court has determined are 5 confidential under RCW 80.04.095; 6 (2) The residential addresses and residential telephone numbers of 7 the customers of a public utility contained in the records or lists 8 held by the public utility of which they are customers, except that 9 this information may be released to the division of child support or 10 the agency or firm providing child support enforcement for another 11 state under Title IV-D of the federal social security act, for the 12 establishment, enforcement, or modification of a support order; 13 (3) The names, residential addresses, residential telephone 14 numbers, and other individually identifiable records held by an agency 15 in relation to a vanpool, carpool, or other ride-sharing program or 16 service; however, these records may be disclosed to other persons who 17 apply for ride-matching services and who need that information in order 18 to identify potential riders or drivers with whom to share rides; 19 (4) The personally identifying information of current or former 20 participants or applicants in a paratransit or other transit service 21 operated for the benefit of persons with disabilities or elderly 22 persons; 23 (5) The personally identifying information of persons who acquire 24 and use transit passes and other fare payment media including, but not 25 limited to, stored value smart cards and magnetic strip cards, except 26 that an agency may disclose this information to a person, employer, 27 educational institution, or other entity that is responsible, in whole 28 or in part, for payment of the cost of acquiring or using a transit 29 pass or other fare payment media, or to the news media when reporting 30 on public transportation or public safety. This information may also 31 be disclosed at the agency's discretion to governmental agencies or 32 groups concerned with public transportation or public safety; 33 (6) Any information obtained by governmental agencies that is 34 collected by the use of a motor carrier intelligent transportation 35 system or any comparable information equipment attached to a truck, 36 tractor, or trailer; however, the information may be given to other 37 governmental agencies or the owners of the truck, tractor, or trailer SHB 2729.SL p. 4

1 from which the information is obtained. As used in this subsection, 2 "motor carrier" has the same definition as provided in RCW 81.80.010; 3 ((and)) 4 (7) The personally identifying information of persons who acquire 5 and use transponders or other technology to facilitate payment of 6 tolls. This information may be disclosed in aggregate form as long as 7 the data does not contain any personally identifying information. For 8 these purposes aggregate data may include the census tract of the 9 account holder as long as any individual personally identifying 10 information is not released. Personally identifying information may be 11 released to law enforcement agencies only for toll enforcement 12 purposes. Personally identifying information may be released to law 13 enforcement agencies for other purposes only if the request is 14 accompanied by a court order; and 15 (8) The personally identifying information of persons who acquire 16 and use a driver's license or identicard that includes a radio 17 frequency identification chip or similar technology to facilitate 18 border crossing. This information may be disclosed in aggregate form 19 as long as the data does not contain any personally identifying 20 information. Personally identifying information may be released to law 21 enforcement agencies only for United States customs and border 22 protection enforcement purposes. Personally identifying information 23 may be released to law enforcement agencies for other purposes only if 24 the request is accompanied by a court order. 25 NEW SECTION. Sec. 7. Sections 1 through 4 of this act constitute 26 a new chapter in Title 9A RCW. Passed by the House March 10, 2008. Passed by the Senate March 7, 2008. Approved by the Governor March 27, 2008. Filed in Office of Secretary of State March 28, 2008. p. 5 SHB 2729.SL

FINAL BILL REPORT SHB 2729 C 200 L 08 Synopsis as Enacted Brief Description: Addressing the reading and handling of certain identification documents. Sponsors: By House Committee on Technology, Energy & Communications (originally sponsored by Representatives Eddy, Pedersen, Appleton, Lantz, Williams, Upthegrove, Santos, Simpson, Hasegawa, Ericks, Ormsby and Springer). House Committee on Technology, Energy & Communications Senate Committee on Transportation Background: Western Hemisphere Travel Initiative. In April 2005 the departments of State and Homeland Security announced the Western Hemisphere Travel Initiative (Initiative), which requires individuals entering or re-entering the United States to present a passport or other federally approved identification or proof-of-citizenship document. The identification requirements of the Initiative for persons entering or re-entering the United States by land or sea became effective on January 31, 2008. Washington's Enhanced Driver's License. In 2007 legislation was enacted that authorized the Department of Licensing (DOL) to issue a voluntary enhanced driver's license or identicard (EDL/ID) to all applicants who, in addition to meeting all other driver's license or identicard requirements, provide the DOL with proof of U.S. citizenship, identity, and state residency. The EDL/ID uses Radio Frequency Identification (RFID) technology, a wireless technology that stores and retrieves data remotely. A RFID chip is embedded in each EDL/ID and contains a unique reference number. At the border crossing station, a RFID reader uses electromagnetic waves to energize the tag and collect this reference number. The reader converts the radio waves reflected back from the RFID tag into digital information and transmits it to the Customs and Border Protection network, which is an encrypted, secure network. The reference number is compared to the Customs and Border Protection's records to verify that an individual's identity matches the information printed on the front of his or her EDL/ID card. The Department of Homeland Security has designated the EDL/ID as acceptable documents for the purpose of entering or re-entering the United States. Public Records. Each state and local agency is required under the Public Records Act to make all public records available for public inspection and copying unless the record is exempted from disclosure. House Bill Report - 1 - SHB 2729

Collection of Personal Information from an Identification Document. There are no state laws that prohibit or restrict a non-governmental entity from using or distributing personal information gained through an EDL/ID or other identification card or document. Summary: Enhanced Driver's License. A person is guilty of a class C felony if the person uses radio waves to intentionally possess, read, or capture remotely, information on another person's enhanced driver's license without that person's express knowledge and consent. Exceptions are included for capturing the information on another person's enhanced driver's license: (1) to facilitate border crossing; (2) to conduct security-related research; and (3) for inadvertent scanning (provided that the information is promptly disclosed, and neither disclosed to any other party, nor used for any purpose). The unlawful capture or possession of information on a person's enhanced driver's license is deemed a violation of the Consumer Protection Act. Public Records Disclosure Exemptions. A public records exemption from disclosure is created for documents and related materials, including scanned images, used to establish identity, age, a residential address, a Social Security number, or other personal information required in connection with an application for a driver's license or identicard. A public records exemption from disclosure is also created for personally identifying information collected through a driver's license or identicard containing radio frequency identification or similar technology used to facilitate border crossing. Votes on Final Passage: House 95 0 Senate 47 0 (Senate amended) House 94 0 (House concurred) Effective: June 12, 2008 House Bill Report - 2 - SHB 2729