California RFID Bill Signed Into Law Today By Governor

By: Nicole A. Ozer

State Senator Joe Simitian (D-Palo Alto) announced today that Governor Schwarzenegger signed his Senate Bill 362, which would prohibit employers and others from forcing anyone to have a radio frequency identification (RFID) device implanted under their skin. The bill will go into effect on January 1, 2008.

RFID "tags" are tiny chips with miniature antennae that can be embedded in almost anything. Using radio waves, RFID can help identify and track objects, animals, or people. Devices known as "readers"access the information on the tags.

"RFID technology is not in and of itself the issue. RFID is a minor miracle, with all sorts of good uses," said Simitian. "But we cannot and should not condone forced 'tagging' of humans. It's the ultimate invasion of privacy."

Despite wide-ranging support, the RFID industry declined to support SB 362. Simitian described the RFID industry's silence on the issue as "unfortunate and regrettable." He noted that, "While we're having a robust debate about the privacy concerns associated with the use of RFID in government identity documents, at the very least, we should be able to agree that the forced implanting of under-the-skin technology into human beings is just plain wrong. I'm deeply concerned that the folks who make and market RFID technology were 'AWOL' on this issue."

Simitian noted that "Enlightened self-interest should have generated industry support. The public will continue to resist emerging technologies until and unless industry acknowledges and responds to the public's legitimate concerns about privacy and security."

"With the signing of SB 362, California has taken an important first step in crafting legislation to properly balance the potential benefits of RFID technology while safeguarding privacy and security, " said Nicole Ozer, Technology and Civil Liberties Policy Director at the ACLU of Northern California. "We are pleased that the Governor has stood up for the privacy and security rights of Californians and not allowed these rights to be 'chipped' away by inappropriate uses of RFID technology."

California now joins Wisconsin and North Dakota, which have already banned forced RFID implantation in humans.

In 2004, the U.S. Food and Drug Administration (FDA) approved an RFID tag for humans called VeriChip, which would allow healthcare professionals to access a person's medical history in the event the person couldn't communicate. The chip's parent company, VeriChip Corporation, reports that 2,000 people have already had tags implanted.

In 2006, a researcher was able to crack the security on a VeriChip implanted in an individual's arm and read and clone the chip in less than two hours.

"This may sound Orwellian," said Simitian, "but it's real, and it just makes sense to address it now. We can't have employers requiring their workforce to get 'tagged'. There are other ways to secure a company's physical and intellectual property–it certainly shouldn't be at the expense of a person's right to privacy."

The Council on Ethical and Judicial Affairs (CEJA), which develops ethics policies for the American Medical Association, recently issued a report raising concerns about the use of under-the-skin RFID tags in humans. They found that RFID devices can compromise a person's privacy and security because there is no assurance that the information contained in the tags can be properly protected. CEJA further found that RFID tagging may present physical risks because the tags may travel under the skin, making them hard to remove at a later time.

Simitian authored four other measures, SB 28, 30, 30, and 31, that address privacy concerns about the use of RFID in school identification documents, driver's licenses, and other public documents. Those bills are awaiting action when the Legislature reconvenes in January 2008.

Simitian began to look at the use of RFID in government-issued identification documents after an elementary school in Sutter, California required its students to wear identification badges that contained RFID tags that broadcast the students'information. Parents successfully petitioned the school to remove the RFID tags.

Simitian's effort to ensure privacy protections in connection with RFID technology has garnered support from an eclectic and sometimes unlikely mix of advocates. Among them are the American Civil Liberties Union, Gun Owners of California, Privacy Rights Clearinghouse, Citizens Against Government Waste, California State Parent Teacher Association (PTA), Republican Liberty Caucus, and the National Organization for Women (NOW).

To learn more about RFID technology, please the ACLU of Northern California RFID webpage.

Read Nicole Ozer's Stanford Technology Law Review Article: Rights Chipped Away: RFID in Identification Documents