RFID and privacy: living in perfect harmony.

I. INTRODUCTION

If you have never heard of the acronym "RFID," which stands for "Radio Frequency Identification," remember it, because it will likely become a household term. If you have not seen RFID, it is not surprising, as the device can be about as small as a grain of rice, and research is already in progress to make the technology invisible to the human eye. (1) Very simply, RFID is a device that can be placed on a person, animal, or object, and the RFID device can store information. That information can be identified when the device reacts to radio waves. (2)

RFID has existed for decades and is a relatively old technology when measured by today's infinitesimal life span for technology. (3) However, RFID only became commercially viable within the last few years as RFID has been slated as a potential replacement for the UPC barcode system. (4) Like many emerging technologies, RFID has the potential to provide great economic benefits for the government, businesses, and consumers while posing a potentially serious threat to consumer privacy and personal security.

It is difficult to gauge whether RFID has gained more publicity or progress since its introduction into the commercial sector. Recent proposals by several corporate retail titans, who hope to expand RFID into nearly every facet of the retail and supply chains, have caused consumer advocates, privacy advocates, and legislators to join together in a phalanx to defeat, or at least mitigate, RFID's perceived threat to privacy. (5)

Various remedies have been proposed to allay the inherent privacy concerns surrounding RFID. The remedies range from total bans to legislative restrictions to consumer warning labels. This note will focus on using private regulation and education, current privacy laws, and limited government oversight to diminish the potential privacy and security threats of RFID. This will help ensure that the fledging RFID technology can improve our industries, businesses, and lives, while protecting our personal information.

II. ORIGIN OF RADIO FREQUENCY IDENTIFICATION

RFID traces its roots to both the radar and the radio. (6) The "identification, friend or foe" ("IFF") transponder, which was used to identify aircraft during World War II, was the predecessor to RFID. (7) While early forms of RFID were developed, tested, and refined from the 1950s through the 1970s, it was not until 1987 when RFID saw its first major commercial use in the form of electronic highway toll collection devices. (8) RFID saw gradual increases in commercial use during the 1990s, however, RFID received an enormous boost in commercial viability as manufacturers, distributors, and retailers envisioned RFID tags eventually replacing the UPC barcode system. (9) Today, the U.S. Patent office has registered over 350 patents related to RFID. (10)

III. RFID OPERABILITY 

RFID belongs to a larger category of electronic identification systems known as automatic identification ("Auto-ID"). (11) Along with RFID, Auto-ID contains several types of identification technologies, such as UPC barcodes, smart cards, along with retinal, voice, finger, and other biometric recognition systems. (12)

RFID has two main components. The RFID tag or transponder, sometimes also referred to as a RFID chip, consists of a silicon microchip with an attached antenna, which both receives and transmits data. (13) The RFID tag is the data-storage device that can be attached to any object or implanted in humans and animals. (14)

The second component of the RFID system is an RFID reader. The reader emits radio waves, which are received by the RFID tag. (15) When the RFID tag receives a radio wave from the reader, it sends back the data, which is stored in the tag's memory, to the RFID reader. (16) The RFID reader then relays the collected data from the tag to a computer system installed with identification software. (17) The data stored on an RFID tag can list identification numbers, location, or specifications of the tagged product, such as price, expiration date, color, size, weight, etc. (18) The RFID reader can be a portable, handheld device, similar to a checkout scanner, or it can be permanently affixed. (19)

A. Active RFID Tags 

There are two basic types of RFID tags: active and passive. Active tags are less common than passive tags, cost more than passive tags, but are much more reliable and have a far greater signal range than passive tags. (20) Active tags' increased signal range is due to its internal power source, or battery. (21) The battery life is often designed to last ten years or more. (22)

The active tag is typically used when signals are required to be transmitted through metal, like shipping containers, or liquids, since additional power is required to transmit the signal through these materials. (23) The active tag can also store more information than the passive tag. (24) Active tags are considerably larger and more expensive than passive tags, due to their power source and read-write data capability. (25)

Most active tags are approximately the size of a coin and their price depends on the level of sophistication, while the smallest passive tag is half the size of a grain of sand and costs several cents. (26) The active tags that track containers in the transportation industry can be nearly a half-foot in length and several inches tall. (27) An active tag's signal range is typically over 100 meters. (28) Active tags also have the capability to be combined with sensory devices to track information such as temperature, moisture, light, radiation, and vibrations. (29)

B. Passive RFID Tags 

Passive tags are used more frequently in the commercial industry because they are less expensive than active tags. (30) The passive tag contains no internal power source. (31) The sole source of power needed to transmit a signal back to the reader is derived from the signal sent from the reader itself. (32) In other words, the passive tag is energized by the radio waves sent from the reader. Passive tags have an unlimited lifespan and can be thinner than a sheet of paper. (33)

Passive tags almost always have a shorter signal range than active tags, with a typical signal range of approximately three meters or less. (34) The signal frequency that an RFID system (tag and reader together) operates on, determines both the speed and the amount of information that can be communicated, or transferred, between the reader and the tag. (35)

As a general rule, the higher the frequency is, the faster the data transfer rate and transfer amount is. The distance that a signal can travel from an RFID tag to a reader is primarily determined by the amount of power used to deliver the signal. (36) The general rule for signal distance is: the more power that is used, the farther the signal can travel.

However, an important distinction exists between the necessary power levels required by passive and active tags. Passive tags require a high level of power from the reader, and the returned signal strength from the tag is much lower than the strength initially delivered from the reader. (37)

In contrast, an RFID reader can send a weaker signal to an active tag (since there is no need to power the active tag), and the active tag's internal battery sends a high-powered signal back to the reader. (38)

Additionally, both active and passive tags' signal range (distance) is affected by the tag antenna length, the antenna material composition, the tag size, and by any impediments such as metals or liquids that stand between the reader and the RFID tag. (39) Another limitation on passive tags, as compared to active tags, is that the vast majority of passive tags are read-only, (40) similar to a barcode.

C. Differences Between RFID and the UPC Barcode

As the retail industry envisions RFID replacing UPC barcodes, a comparison of RFID tags with UPC barcodes is necessary to properly weigh the strengths and limitations of these two technologies.

RFID has a number of significant advantages over the UPC barcode. First, barcodes are a "line of sight" application. (41) This means that barcodes must be positioned in a particular manner in order for the barcode to be properly scanned. For instance, think of the countless times you have waited in a checkout line while the clerk was trying to scan an item that simply could not be read by the scanner. This problem may have been the result of improper positioning of the barcode to the scanner or the barcode itself was scratched, faded, wet, or dirty. RFID does not need line of sight. (42) The tag only needs to be within range of the RFID reader, without needing to be specially positioned. (43) RFID tags can be read through water, ice, paint, built-up grime, fog, dust, and most other visually challenging environments. (44) RFID's data can be transferred (read) in these environments in less than 100 milliseconds, which is nearly instantaneous to human perception. (45) Additionally, multiple RFID tags can be read simultaneously and queries can be programmed to have the RFID readers search only for tags based on the requested criteria. (46)

RFID tags have a much larger information storage capacity than UPC barcodes. UPC barcodes hold 96 bits, while passive RFID tags can hold from 64 bits to over 2 kilobytes. (47) This larger storage capacity not only allows the RFID tag to store more information, but also allows RFID tags to identify the specific, individual item. (48) UPC barcodes can only identify the type of item.

For example, with UPC barcodes, every Hershey's Bar has the same UPC barcode number (a Hershey's Bar in Chicago has the same UPC barcode number as a Hershey's Bar in Los Angeles). (49) With RFID tags, every individual Hershey's Bar could have its own RFID number. (50)

An RFID unique number is called an Electronic Product Code ("EPC"). (51) EPC's format is superior to UPC barcode format because EPCs can be used to identify hundreds of trillions of unique items, whereas UPC barcode format does not result in enough unique numbers to identify each individual product. (52) As this note will explain, the ability to identify each individual product allows manufacturers, distributors, and retailers to keep "real-time" track of when an actual item is moved, purchased, misplaced, or stolen.

The most significant drawback for RFID compared to UPC barcodes is their price differences. As for price, UPC barcodes cost much less per barcode than per RFID tag since they can be printed onto a product or at least printed onto a sticker, which can be affixed to a product. (53) RFID tags' price depends on whether the tag is active or passive, the amount and type of memory space, the tag size, material composition, and the quantity of tags purchased in bulk. (54)

The most simple, read-only, passive tags that have only enough memory to store a manufacturer's name and unique item number can cost as little as five cents, (55) while more complex, active tags, with read-write programmability can cost over $200.00 each. (56) RFID tags' price should continue to decrease as more companies begin selling "Smart Labels" and "Smart Label" printers. (57) Smart Labels are essentially paper adhesives or "stickers" with small, passive, embedded RFID transponders. (58)

D. RFID Applications

While many people are readily familiar with electronic highway toll collectors and clothing store electronic anti-theft devices, RFID has many other uses that may be less familiar. Employers are beginning to issue employee identification ("ID") cards with embedded RFID chips. (59) These employee ID cards are used to gain access to doors, elevators, and parking garages simply by holding the RFID-laden ID card in front of an RFID reader. (60) The RFID employee cards are superior to the magnetic strip ID cards, which can become ineffective with frequent use from sliding the card through the magnetic strip reader. Other similar RFID devices include cars with "Smart Keys," which allow the driver to keep the car key on her person while unlocking or starting the vehicle. (61)

Businesses have begun using RFID technology for payment systems by replacing magnetic-strip cards with RFID cards. Exxon-Mobil Speedpass and MasterCard PayPass are two examples of RFID payment systems that allow users to hold the SpeedPass or PayPass in front of an RFID reader, which then deducts the payment from their accounts, just like an ATM debit card. (62) MasterCard has already embedded PayPass into cellular phones, allowing payment by simply holding the cell phone in front of the reader, rather than searching to pull the PayPass card out from a wallet or purse. (63) Several public mass transit systems have RFID readers in the turnstiles, which open by holding an RFID subway or train card in front of a scanner. (64)

The airline industry has begun using RFID for managing checked baggage. (65) RFID readers can scan multiple bags at once and can identify and redirect misplaced luggage faster. (66) Michelin has introduced RFID-enabled tires, which electronically measure the tire pressure, tread wear, and tire damage. (67)

Mechanical devices are not alone in receiving RFID upgrades. Veterinarians implant dogs, cats, and other pets with RFID chips, which can be scanned at animal shelters to identify a lost pet. (68) Other forms of animal RFID implantation include cattle tracking. (69) The RFID chip is used to identify the cow's herd of origin in order to trace the source of a carcass that a packing plant condemns for e-coli infection or other disease. (70)

Pets and cattle are not the only living organisms to be implanted with RFID chips. Recently, and perhaps more disturbing (or maybe fascinating), humans have been implanted with RFID chips for various reasons. Several luxury resorts and nightclubs in Spain and the Netherlands offer to implant RFID chips into guests' arms, which allow the guest to pay for food or drinks and unlock doors without carrying a credit card or a hotel key card. (71) The Mexican Attorney General's office implanted several of its employees with RFID chips for building access control. (72) Certain prisons are beginning to require their inmates to wear RFID bracelets to track their whereabouts. (73) In 2004, the FDA approved the "VeriChip" to be implanted into medical patients to allow expedited access to the patient's medical history and records, for various emergencies, such as vehicle accidents and also for battlefield injuries.(74)

Despite the seemingly invasive nature of implanting humans and animals with RFID chips, the application that has generated the most optimism and controversy alike is the movement for commercial retailers to entirely replace the UPC barcode system with RFID. The idea began to surface after retailers saw the success of RFID at the Department of Defense, which has employed active RFID tags in its logistics field to track supply pallets around the world since Operation Desert Storm in the early 1990s. (75) Commercial manufacturers, distributors, and retailers intend to replicate the military's success by tracking their own pallets, containers, and even individual products. (76)

Retail giants like Wal-Mart, Tesco, and Albertsons, along with product manufacturers like Gillette and Proctor & Gamble see the potential for RFID tags to save money, time, and labor. (77) Manufacturers believe that RFID tags will achieve more efficient "just-in-time" manufacturing capabilities by accurately determining when their distributors' inventories need to be replenished. (78)

Distributors can better achieve "just-in-time" supply capabilities for their retailers by tracking the inventories of individual items. (79) Retailers can place RFID tags on every individual product, which can be identified at the item level, rather than at the product level. (80) The RFID-tagged products would then be placed on "smart shelves," which would notify their storage room or warehouse whenever a product needed restocking or when the product was nearing its expiration date. (81) A research study conducted by the University of Arkansas found that Wal-Mart's use of RFID resulted in a sixteen percent reduction in out-of-stock items and also that RFID-tagged items were restocked at least three times quicker than products with UPC barcodes. (82)

Manufacturers, distributors, and retailers all hope to reduce massive waste during defective product recalls by only recalling the products from the defective lot, rather than recalling the entire batch. (83) The retail industry believes that RFID tags will reduce product theft from both customers and employees, which will increase company revenues. (84)

IV. FOURTH AMENDMENT CONCERNS

While the potential for RFID products and systems may appear endless and promising, there are legitimate privacy and security concerns. In the United States, the Constitutional concerns center on RFID's potential infringement of Fourth Amendment privacy protections.

The Supreme Court's 1967 landmark decision in Katz v. United States introduced a basic Fourth Amendment concept of privacy, holding that people, not places, have a "reasonable expectation of privacy" against government intrusion (at least without a search warrant). (85) However, "reasonableness" is measured both objectively and subjectively. (86)

Subjective means that in a given situation, one actually expected privacy, while the objective prong requires a privacy expectation that society (or in reality, the Court) is prepared to recognize. (87) For example, subjectively, a person may not want his/her car inspected by a narcotics-trained dog during a traffic stop by the police. However, since the dog can only reveal illicit items such as illegal drugs, society does not accept this personal expectation for privacy because there is no objectively "reasonable expectation of privacy" in concealing illegal activity. (88)

How would RFID fare under the Katz test? As an emerging technology, RFID could hold a precarious position. (89) The uncertainty lies in the objective prong, depending on whether the Court would find that society has a "reasonable expectation of privacy" against specified uses of RFID technology. (90)

Even if the Court were to find that society had such an expectation, the restrictions on RFID would be limited to warrant-less, government surveillance and intrusion, since the Fourth Amendment only protects citizens "against unreasonable searches and seizures" conducted by the state, not the private sector. (91) State legislatures or Congress would have to enact any regulation of RFID use by private citizens and corporations.

An additional problem with using the courts to restrict RFID privacy infringement is that past decisions have found varying degrees of a "reasonable expectation of privacy," depending on whether a person is at home, at work, in a car, in a motor home, in a public area, or in a phone booth. (92)

The Supreme Court's decision in Kyllo v. United States may provide the best guide to the Court's direction on emerging technologies. (93) In Kyllo, the Court held that police use of a thermal imaging device to randomly scan homes for indoor marijuana plants was an impermissible search under the Fourth Amendment. (94) The Court's reasons for ruling the police's thermal scanner search unconstitutional may foreshadow the outcome of any future RFID litigation.

First, unlike the narcotics dog that only detects illegal activities, the thermal imager could see not only infrared images of illicit activities (growing marijuana plants for instance), but also benign or legal activities, such as residents taking a hot shower. (95) Second, the police must obtain a search warrant to "see" anything in a home that they would not be able to see without physically entering the home. (96) Put differently, this means that the police do not need a search warrant to view anything that a public observer could view with the unaided eye. However, the Court suggested that if the thermal imager were in widespread public use, then the police would also have permission to use the device. (97)

Based on the Kyllo decision, government use of an RFID reader to scan for RFID-tagged items inside a home would almost certainly require a search warrant because the reader could "see" items that the police would not be able to see without physically entering the home. Additionally, RFID readers are not currently in "general public use," and therefore, the use of a reader would afford the police the ability to peer into a home and see items that a public observer could not see. (98) This constitutes a search under gyllo. (99)

Although Kyllo would restrict government scanning of RFID tags within the home, it offers little protection to government scanning outside the home. The Supreme Court has already held that warrant-less police use of an inconspicuous GPS-tracking device, planted on either a car or inside of a purchased container (and ostensibly on any type of object) is not a search, as long as the car or container is outside the vicinity of one's home. (100)

The Fourth Amendment privacy cases do not offer much protection against government surveillance beyond the confines of the home, and the small protection they do afford is susceptible to further erosion. Assume that RFID technology will become more readily available. As RFID becomes more common, the potential exists that society may eventually see RFID technology as a part of everyday life, similar to cell phones, rather than as offensive to privacy. If society were to take this view, then restrictions on RFID would not satisfy the objective prong of the Katz test, because society would view an expectation of privacy against RFID detections as unreasonable. (101) In other words, if RFID becomes ubiquitous like cell phones, judicial remedies and restrictions on RFID will be more difficult to obtain under the Katz doctrine.

This scenario may not be very far away. America has seen vast increases in security measures in the wake of 9/11, which may gradually cause citizens to become "immune" to certain encroachments on their privacy. For instance, public and private buildings have increased video surveillance. (102) Airports, government facilities, customs checkpoints, and public events have heightened security measures. (103) Phone and internet traffic is increasingly monitored by both private and government entities. (104) Therefore, if citizens become accustomed to gradual privacy infringements, and if RFID technology becomes mainstream, judicial remedies against RFID on Fourth Amendment grounds become less likely.

V. RFID LEGISLATION AND REGULATION: THE GOOD, THE BAD, AND THE UGLY

The potential difficulties of inserting RFID technology into Fourth Amendment privacy jurisprudence may explain the dearth of RFID cases brought into Federal courts. (105) It may also explain why Congress, along with several states, has introduced RFID-specific legislation. (106) There is great disagreement between privacy advocates, businesses, government agencies, state legislatures, Congress, and the legal community as to the proper way to regulate RFID. (107) The root of the disagreement comes from the uncertainty involved with RFID technology.

On one end of the RFID debate spectrum are free-market advocates, who completely want the market to self-regulate RFID without any governmental interference. (108) This includes retailers like Wal-Mart and Proctor & Gamble, both of whom are members of EPCglobal, which is a private organization that is developing global RFID standards for commercial use, to avoid conflicting legislative standards. (109)

On the other end of the spectrum are various privacy advocates that seek stricter RFID guidelines, usually through legislation. (110) Among the privacy advocates are the American Civil Liberties Union (ACLU), the Electronic Privacy Information Center (EPIC), and Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN). (111) Rather than advocating for one specific agenda, this note will summarize the prominent arguments from both sides, and explain which regulation proposals from each side will allow RFID to thrive, while keeping privacy infringements to a minimum.

There are a variety of reasons cited as the basis for needing RFID regulation. One concern is that consumers may purchase RFID-laden products, unaware of the tag's presence, and be unable to deactivate or remove the tag. (112) A second reason is to prevent the reading of personal belongings that have RFID tags attached, without that person's knowledge or consent. (113) A third major concern for RFID legislation is to protect individuals' Personally Identifiable Information (PII). (114) PII is a term that describes any personal information that can be directly linked to one person, such as a social security number, credit card number, etc. (115)

A. Notice, Consent, and Deactivation 

Both privacy advocates and businesses agree that if a retailer intends to use RFID-tagged items at the consumer level, the retailer must ensure that the customer has notice of the tag, consented to its use, and has an opportunity to deactivate the tag. (116)

1. Notice

As for notice, legislation could require that sufficient notice must be given to customers as to the presence of an RFID tag and to its location on the package. However, the retail industry should be responsible for the design and implementation of the specific notice requirements, to allow for uniform standards.

Retailers could design a uniform logo that would be visible on each RFID-tagged package, or place signs on shelves, aisles, or checkout lines that indicate the use of RFID products. (117) Although legislation could require a government warning label on each package, a commercially designed label will most likely be more conspicuous, more effective, and place RFID in a less threatening light. For example, consider the differences between the industry-designed "Real Seal" on dairy products and the government-designed surgeon general's warning on cigarettes. (118) In addition, it would be in retailers' best interest to conduct "public information campaigns," such as commercials, in-store advertising, and brochures to explain how the RFID process works at a particular retailer. (119)

2. Consent

Regarding customer consent, EPIC seeks to have retailers "obtain written consent" from customers if any PPI is used in conjunction with RFID. (120) There are several reasons why legislation should not be passed to require written consent for the use of RFID.

First, a pivotal purpose for using RFID is to save time, and this requirement would impede the time-saving benefits. (121) Second, consent can be obtained indirectly. A combination of sufficient notice and the ability to deactivate RFID would prevent customers from leaving a store without knowing they had purchased an RFID tag and without knowing they could deactivate the tag. Third, companies have a strong incentive not to use PII carelessly--they want your loyal business. (122) The use of RFID in conjunction with PII will be discussed in greater detail.

Also, stores already link the items you buy to your PII when a UPC barcode is scanned--the main difference is that a barcode is laser-scanned and RFID is detected wirelessly. (123) Other types of consent legislation are clearly proper, such as Wisconsin law that "prohibits [human] implantation [of RFID chips] without consent." (124)

3. Deactivation

Legislation requiring retailers to provide their customers with the opportunity to deactivate, destroy, or remove the RFID tag before exiting the store would face little opposition, as many businesses and privacy advocates alike support this concept. (125) However, legislation that would require deactivation, destruction, or removal of RFID tags would defeat several important RFID benefits, such as individual product recalls, and receipt-less returns, exchanges, and warranties. (126)

There are several ways to deactivate an RFID tag. One way is simply to remove the tag, which adds manual labor and time costs. Another way is to use blocker tags. Blocker tags are devices that can be placed over an RFID chip to prevent all or only specifically designated signals from reacting with the chip. (127) However, the blocker tag may not be practical as they are expensive and they leave the customer with the sole burden of providing privacy protection. (128) Also, blocker tags could become illegal if thieves begin using blocker tags to obstruct the wireless signal to the RFID chip, allowing them to steal products.

A more efficient method of deactivation is to transmit an electronic code into the RFID tag that either deactivates the tag, leaving reactivation possible, or else "kills" the tag, rendering it incapable of being reactivated. (129)

Legislation calling for mandatory deactivation codes, rather than destruction codes, would serve a dual purpose. The RFID tag would be deactivated before leaving the store, but the store could still reactivate the tag later, if necessary, for a receipt-less transaction or product recall. Since many businesses are in favor of giving customers the choice to disable their RFID tags, ostensibly they would support any carefully drafted legislation that required the use of deactivation codes.

B. Placing RFID Tracking Fears in Perspective

As explained earlier, the Fourth Amendment only provides protection against government use of tracking devices near one's home. Perhaps the larger concern is RFID tracking by private individuals or entities inside and outside the home without one's knowledge or consent. (130)

The proverbial fear scenario is the burglar, equipped with an RFID reader, who could scan potential victims or their homes to discover whether they had any valuable merchandise. (131) Others fear that marketing research firms could scan houses or garbage cans to determine the products used by the household. (132) Another concern is simply the ability to track the physical movements of individuals. (133)

1. RFID Needs Better PR

Educating the public about the limitations of RFID is sorely needed to diffuse these exaggerated fears. First, passive RFID tags emit no honing or GPS tracking signals. (134) This means that a person's location could only be detected by multiple, strategically placed RFID readers along the person's path of movement. (135) Even if there were multiple readers in different locations, one would have to have access to the information from each reader in order to track a person's movements.

Additionally, many RFID tags and readers require slow, consistent movements to read the tags, and many tags can only be read within several feet of the reader, with distance diminishing if walls, moisture, or environmental factors are involved. (136)

Also, tags and readers must correspond in frequency levels, meaning that a reader delivering a 500 kHz frequency cannot read a tag that only accepts a 10 MHz frequency, and vice versa. (137) Retailers can also encrypt the tags so that only their own RFID readers can interact with the encrypted tag. (138) And as mentioned previously, blocker tags can prevent readers from detecting RFID tags. (139) With the plethora of RFID limitations, combined with encryption and blocking capabilities, the possibility of using RFID as a public tracking device remains quite small.

2. Legitimate Regulation is Limited Regulation

This does not mean that RFID tracking should be free from any form of regulation. Legitimate legislation could include requiring encryption of all RFID tags that leave a store in an activated condition. Legislate the encryption requirement, but permit the private sector to develop the encryption scheme to allow for uniformity and for quicker encryption scheme changes in the incident of any breaches.

Another regulation possibility to prevent random RFID tracking is minimum read distances for tags and readers. Legislatures could mandate a minimum distance requirement, but still allow the private sector to determine the precise distance as needed for specific business applications. Since the RFID reader's power is directly related to the detection distance, (140) legislators could also place a maximum power requirement on RFID readers in certain public areas, and especially on portable RFID readers.

If RFID readers ever reach the point of becoming the weapon of choice for burglars, snoops, and predators, then legislatures could always require licenses, permits, or background checks prior to purchasing an RFID reader.

C. Protection of PII

Arguably, the most legitimate RFID privacy concern is ensuring the protection of PII. The reason this fear is more realistic than those previously mentioned is because the threat to PII is currently conceivable, is not entirely dependant upon future advances in RFID technology, and can only remain secure if all RFID-using businesses and agencies vigilantly comply with PII safeguarding regulations. (141)

If a retailer obtains any PII, such as when a customer pays with a credit card, the concern is that the retailer could potentially link the customer's PII to the unique number from the RFID-tagged merchandise. (142) A retailer could then create a database of consumer profiles that could track each customer's purchases to better understand individual purchasing patterns. (143) Further, if the retailer electronically writes the PII into the RFID tag, one concern is that after the customer leaves the store with the RFID-laden product, the PII could be read by anyone with an RFID reader. (144) Another concern is that the retailers or their employees could misuse or sell the valuable customer PII data for targeted marketing schemes, studying individual spending habits, or simply peering into people's lives by detecting or recording their personal belongings. (145)

Although the storage of PII onto RFID tags and the linking of PII to individual consumers are technologically feasible, there are several factors that strongly suggest that widespread PII misuse is unlikely to occur. One reason is that businesses have no incentive to encode PII onto RFID tags themselves. (146) The cost of adding PII onto the trillions of RFID tags that would exist in a national retail store would incur significant added costs per RFID tag, when cost reduction is one of the main purposes for using RFID. (147) Another reason businesses are not seeking to store PII on RFID tags is to avoid the "Big Brother" image--they do not want to scare customers away, because they want their business. (148)

Consider current paper receipts. Nearly every store "X's" out credit card numbers (except the last four), and does not place customer names, addresses or other personal information on the receipt. Yet the store can still identify a customer to the receipt without any privacy implications. Similarly, stores will want to maintain the same policies for RFID tags as for paper receipts, to allay customer fears of misuse and to keep them returning.

D. Current Information Privacy Laws are Effective

Even if good business practices are not enough to persuade retailers to handle customer PII in an ethical manner, current information privacy laws will. Currently, credit card companies record all purchases made, phone companies record all calls, and internet search engines record all search history. (149)

However, current privacy laws, along with company standard operating procedures, and government agencies, like the FCC, require this information to remain confidential. (150) The PII derived from an RFID transaction should not be treated any differently than PII derived from any of these other sources.

Additionally, if a state's current privacy information laws are ambiguous as to whether they include RFID, the state legislature could amend the law to include RFID, as Utah recently did. (151) State legislators should check their state's current privacy laws and computer crime laws to determine whether the law is broad enough to encompass RFID, or if not, whether an amendment including RFID would suffice.

As a general rule, legislators should also ensure that any new RFID privacy laws only "legislate the data, not the device." (152) Legislating the data, meaning PII, is acceptable because the industry does not need to create PII databases in order to maintain the efficiency and benefits derived from RFID use in the supply, distribution, and retail sectors. However, over-legislating the RFID device (reader and tags) itself could severely interfere with the private sector's ability to develop uniform operating standards, which might "limit its benefit to consumers, raise costs of implementation, and limit innovative applications." (153)

E. Legislative Caution

Some businesses and their supporting organizations are "opposed to any existing RFID legislation." (154) As this note has explained, state and federal legislators can be involved in the RFID regulation and implementation process in a variety of ways without hindering RFID's commercial potential.

However, there are several cautionary notes that legislatures should heed before enacting any legislation that could sideline RFID technology while gaining only negligible privacy protections.

The first step for all legislatures, before enacting any RFID legislation, should be to become properly educated and informed about the technicalities and realistic capabilities of RFID. U.S. Senators Byron Dorgan, a North Dakota Democrat, and John Cornyn, a Texas Republican, formed a bipartisan RFID Caucus with the stated goal of "[educating] their colleagues about the potential uses and benefits of RFID." (155)

Legislators should also collaborate with EPCGlobal, which works with companies around the globe to develop standardized RFID procedures. (156) State legislation of RFID poses massive uniformity problems, because RFID tags are used by national retailers whose operations would be severely curtailed if they had to comply with 50 conflicting RFID state laws. (157) Therefore, if the government enacts any RFID legislation, a federal statute would be preferable to a state statute, which would at least allow businesses to operate under a uniform national standard, even if it is one that they did not design. (158)

A final reason why legislatures should work closely with EPCglobal and other private sector entities is that the private sector has the funding, research, and flexibility to update and improve upon their existing regulations, whereas legislation becomes quickly outdated and is fraught with political motivations. (159)

VI. CONCLUSION

RFID technology has the potential to drastically improve supply, distribution, and retail industries, while providing numerous advancements and benefits to consumers. The RFID privacy concerns must be addressed immediately to allow successful RFID implementation. The difficulty lies in determining the proper methods to regulate RFID and determining who should design and conduct the regulation. Sole regulation by either government legislation or by private industry is neither practical nor realistic. The optimal approach involves the informed collaboration of both entities to create uniform standards that maximize RFID efficiency and protect individual privacy rights.

(1.) See ANN CAVOUKIAN, INFO. AND PRIVACY COMM'R OF ONT., TAG YOU'RE IT: PRIVACY IMPLICATIONS OF RADIO FREQUENCY IDENTIFICATION (RFID) TECHNOLOGY 9 (2004), available at http://www.ipc.on.ca/images/Resources/ uprfid.pdf. "Researchers at Coming have developed tiny coded beads invisible to the human eye that can be embedded in inks to tag currency and other documents or added to substances like automobile paint, explosives, or other products that law enforcement officers or retailers have a strong interest in tracking. Researchers say the technology could be ready for commercial use in three to six years." Id.

(2.) See ASS'N FOR AUTOMATIC IDENTIFICATION AND MOBILITY, INC. (AIM), RADIO FREQUENCY IDENTIFICATION--RFID: A BASIC PRIMER 3 (2001), http://www.aimglobal.org/technologies/rfid/resources/RFIDPrimer.pdf [hereinafter A BASIC PRIMER] (on file with author).

(3.) See The History of RFID Technology, RFID J., http://www.rfidjournal.com/article/articleview/1338/1/129/ (last visited Mar. 4, 2008).

(4.) UPC stands for Universal Product Code, and it is the standard scannable barcode, which is printed or affixed on nearly all retail products. See UPC Home Page, http://www.upccode.net/faq.html (last visited Mar. 4, 2008); see Jim Rendon, RFID Will Replace Barcodes, If New Partnership Succeeds, SEARCHMOBILECOMPUTING.COM, June 2, 2003, http://searchsap.techtarget.com/originalContent/0,289142, sid2l_gci1201516,00.html.

(5.) See Doug Campbell, RFID Policy May Not Wait, RFID J., Mar. 28, 2005, http://www.rfidjournal.com/article/articleview/1461/1/82/.

(6.) See JEREMY LANDT, AIM, INC., SHROUDS OF TIME: THE HISTORY OF RFID 4 (2001), http://www.transcore.com/pdf/AIM%20shrouds_of_time.pdf.

(7.) Id.

(8.) Id. at 5. During the 1950s, researchers continued to expand RFID development through different combinations of radio and radar use, similar to the IFF transponder. Id. at 4. In the 1960s, the first commercial use of RFID was developed, Electronic Article Surveillance (EAS), which was a predecessor to our current RFID anti-theft devices used in clothing stores and libraries. Id. During the 1970s, "developers, inventors, companies, academic institutions, and government laboratories were actively working on RFID, and notable advances were being realized at ... [the] Los Alamos Scientific Laboratory, Northwestern University, and the Microwave Institute Foundation in Sweden among others." Id.

(9.) Id. at 5-6; see UPC Home Page, supra note 4; see Paul Blossom, Levels of RFID Maturity, Part 1, RFID J., Jan. 17, 2005, http://www.rfidjournal.com/ article/articleview/1342/1/82/.

(10.) See Landt, supra note 6, at 7.

(11.) See What is Automatic Identification?, RFID J., http://www.rfidjournal.com/faq/16/48 (last visited Mar. 4, 2008).

(12.) Id.

(13.) See AIM, Inc. Home Page, http://www.aimglobal.org/ technologies/rfid/what_is_rfid.asp (under "What is Radio Frequency Identification (RFID)?") (last visited Mar. 4, 2008) (on file with author).

(14.) Id.

(15.) Id.

(16.) Id.

(17.) Id.; RFID software is constantly being updated and is available from numerous software development companies. See, e.g., Jonathan Collins, IBM Launches RFID Online Resources for RFID Software Developers, RFID J., Aug. 1, 2006, http://www.rfidjournal.com/article/articleview/2534/; Jonathan Collins, Sun Debuts Its First RFID Software, RFID J., June 1, 2004, http://www.rfidjournal.com/article/articleview/967/1/1/; Mary Catherine O'Connor, NCR Announces RFID Software Suite, RFID J., Feb. 23, 2006, http://www.rfidjournal.com/article/articleview/2165/1/1/.

(18.) See A BASIC PRIMER, supra note 2, at 3.

(19.) Id. at 12.

(20.) Id. at 9.

(21.) Id.

(22.) Id.

(23.) Id.

(24.) Id.

(25.) Id. RFID tags can be "read-only," "write once read many" ("WORM"), or "read-write." Id. at 10. The read-only tags are the simplest, least expensive, and most commonly used RFID tag, as they are installed with pre-programmed information that cannot be changed. Id. The WORM tag can be initially programmed at the user level, rather than at the manufacturing level, but the information cannot be changed after the initial setup. Id. The read-write tags are the most versatile because they allow the user to re-program the information into the tag indefinitely. Id.

(26.) Id. at 10; see also RFID Summary, RFID Tags - Radio Frequency Identification Tags, http://www.rfident.org (last visited Mar. 4, 2008); Smartcode Debuts Smallest Chip, RFID J., Jan. 23, 2004, http://www.rfidjournal.com/ article/articleview/764/1/1/.

(27.) See, AIM supra note 13.

(28.) AUTOID, ACTIVE AND PASSIVE RFID: Two DISTINCT, BUT COMPLEMENTARY, TECHNOLOGIES FOR REAL-TIME SUPPLY CHAIN VISIBILITY 2-3 (2002), http://www.autoid.org/2002_Documents/sc31_wg4/docs_501-520/ 520_18000-7_WhitePaper.pdf [hereinafter AUTOID].

(29.) Id. at 3.

(30.) See AIM, supra note 13. Unless otherwise stated, the remainder of this note will only refer to passive RFID tags.

(31.) Id.

(32.) See A BASLE PRIMER, supra note 2, at 9.

(33.) Id.; see also Yoshiko Hara, Hitachi Advances Paper-thin RFID Chip, EE TIMES, Feb. 6, 2006, http://www.eetimes.com/news/design/showArticle.jhtml ?articleID=179100286. RFID tags' dimensions are measured in microns; the chip described in this article is 7.5 microns compared to the thickness of a standard sheet of paper is typically 80 to 100 microns thick. Id. However, this chip is not in widespread use as of 2007. Id.

(34.) See AUTOID, supra note 28, at 2.

(35.) See A BASIC PRIMER, supra note 2, at 6.

(36.) Id. at 7.

(37.) See AUTOID, supra note 28, at 1.

(38.) Id.

(39.) See A BASIC PRIMER, supra note 2, at 7.

(40.) See AIM, supra note 13.

(41.) Id.; see also David Crump, Beyond the Supply Chain, RFID J., Mar. 20, 2006, http://www.rfidjournal.com/article/articleview/2153/2/82/.

(42.) Id.

(43.) Id.

(44.) See AIM, supra note 13.

(45.) Id.

(46.) See Crump, supra note 41; see also AUTOID, supra note 28, at 2-3.

(47.) RFID Journal Glossary, http://www.rfidjournal.com/article/ glossary/3#12 7 (under "Memory") (last visited Mar. 4, 2008).

(48.) See CAVOUKIAN, supra note 1, at 8.

(49.) Id.

(50.) Id.

(51.) See EDMUND W. SCHUSTER ET AL., GLOBAL RFID 4 (2007), available at http://www.springer.com/cda/content/document/cda_download document/978354 0356547-cl.pdf?SGWID=0-0-45-332794-p173671330.

(52.) Id.

(53.) Various companies offer services to print UPC barcodes. UPC's homepage includes a function for customers to calculate the price per barcode. See http://www.upccode.net/label_printing.html (last visited Mar. 4, 2008).

(54.) See A BASIC PRIMER, supra note 2, at 9-11.

(55.) See Mark Roberti, A 5-Cent Breakthrough, RFID J., May 1, 2006, http://www.rfidjournal.com/article/articleview/2295/1/128/. Note that 5-cent RFID tags may be merely of a publicity stunt, rather than an earnest sale price because the tags must be purchased in bulk, at a minimum of 100 million tags. Id. However, more realistic purchase amounts of 1 million RFID tags can lead to individual tag prices of less than 20 cents. See Jonathan Collins, Alien Cuts Tag Price, RFID J., Apr. 1, 2004, http://www.rfidjournal.com/article/ articleview/857/1/1/.

(56.) See CAVOUKIAN, supra note 1, at 6.

(57.) Numerous companies offer "smart label" printing services or sell "smart label" printers to individual businesses. See, e.g., Weber Marking Systems, Inc. (product brochure), available at http://www.webermarking.com/images/ rfid_label_brochure.pdf (last visited Mar. 4, 2008).

(58.) Id.

(59.) See Mary Catherine O'Connor, DOI Buys 30,000 DESFire Chips, RFID J., Dec. 20, 2004, http://www.rfidjournal.com/article/articleview/1295/ 1/1/.

(60.) Id.

(61.) See A BASIC PRIMER, supra note 2, at 12.

(62.) See Exxon-Mobil Speedpass homepage, https://www.speedpass.com/ forms/frmHowItWorks.aspx?pgHeader=how (last visited Mar. 4, 2008); see also Mastercard PayPass Home Page, http://www.mastercard.com/us/personal/en/ aboutourcards/paypass/index.html (last visited Mar. 4, 2008).

(63.) See Another Use for Your Cell Phone, WIRELESS ITWORLD.COM, Aug. 15, 2006, http://wireless.itworld.com/4244/nls_itinsights060815/page_1.html.

(64.) See Randy Vanderhoof, RFID Transit Cards Help Retailers, RFID J., Oct. 27, 2003, http://www.rfidjournal.com/article/articleview/625/1/1/.

(65.) See Airlines Tagging Luggage with RFID, RFID GAZETTE, Feb. 14, 2005, http://www.rfidgazette.org/2005/02/airlines_taggin.html.

(66.) Id.

(67.) See Press Release, Michelin, Michelin Leaps Forward in Tire Electronics, (Nov. 2, 2006), available at http://www.michelinmedia.com/pressSingle/ value=MCH2006111367776.

(68.) See Pet-ID's Home Page, http://www.pet-id.net/ (last visited Mar. 4, 2008).

(69.) See Canadian Cattle Identification Agency FAQ page, http://www.canadaid.ca/Radio%20Frequency%201dentification%20FAQ'S.pdf (last visited Mar. 4, 2008).

(70.) Id.

(71.) See Alexandra Leo, RFID Tags: Convenient Technology or Path to Government Monitoring, ABC NEWS, May 2, 2006, http://abcnews.go.com/technology/story?id=1913574&page=1; see also Baja Beach Club, Barcelona, Spain, homepage, http://www.bajabeach.es/index_in.html (follow the "VIP" section and ensure you have selected "English," otherwise the website defaults to Spanish) (last visited Mar. 4, 2008).

(72.) See Will Weissert, Mexican Attorney General Personally Goes High-Tech for Security, USA TODAY, July 14, 2004, available at http://www.freerepublic.com/focus/f-news/1171529/posts? loc=interstitialskip.

(73.) See Financing for RFID Prison System, RFID J., Dec. 31, 2002, http://www.rfidjournal.com/article/articleview/241/1/38/.

(74.) See generally Jonathan Collins, RFID Remedy for Medical Errors, RFID J., May 28, 2004, http://www.rfidjournal.com/article/articleview/ 961/1/1/.

(75.) See Mark Hachman, DOD Details its RFID Plans, EWEEK.COM, Oct. 29, 2003, http://www.eweek.com/article2/0,1895,1490299,00.asp.

(76.) See MICROSOFT CORP., THE BUSINESS VALUE OF RFID 2 (2006), http:// www.rfidjournal.com/whitepapers/1.

(77.) See Paul Blossom, Levels of RFID Maturity, Part 1, RFID J., Jan. 17, 2005, http://www.rfidjournal.com/article/articleview/1342/1/82/; see also Mark Roberti, P&G-Gillette Merger Could Benefit RFID, RFID J., Feb. 4, 2006, http://www.rfidjournal.com/article/articleview/1389/1/1.

(78.) See MICROSOFT CORP., supra note 76, at 4-6.

(79.) Id.

(80.) Id. at 2.

(81.) Id. at 6.

(82.) See RFID Progress at Wal-Mart, IDTECHEX, Oct. 1, 2005, http://www.idtechex.com/products/en/articles/00000161.asp.

(83.) See Leslie K. Downey, Can RFID Save the Day for Spinach?, RFID J., at 1, Nov. 13, 2006, http://www.rfidjournal.com/article/articleview/ 2802/1/82/.

(84.) See MICROSOFT CORP., supra note 76, at 2.

(85.) 389 u.s. 347, 351, 361 (1967). Justice Harlan's concurring opinion in Katz is the actual source of the "reasonable expectation of privacy" test, and has become the de facto authority for the progeny of Fourth Amendment privacy cases. Id. at 361.

(86.) Id.

(87.) Id.

(88.) Illinois v. Caballes, 543 U.S. 405, 410 (2005).

(89.) As of February, 2007, there has not been an RFID case subjected to the Katz test in any state or federal court.

(90.) See Katz, 389 U.S. at 361.

(91.) See U.S. CONST. amend. IV.

(92.) See, e.g., Katz, 389 U.S. at 351 (phone booth); Carroll v. United States, 267 U.S. 132, 153 (1925) (automobile exception); California v. Carney, 471 U.S. 386, 393 (1985) (motor home exception).

(93.) 533 U.S. 27 (2001).

(94.) Id. at 40.

(95.) Id. at 38.

(96.) Id. at 34.

(97.) See id.

(98.) Id.

(99.) 533 U.S. at 34.

(100.) United States v. Knotts, 460 U.S. 276, 278-79, 281-84 (1983). Police placed a GPS-tracking device inside a container of chemicals that they suspected would be involved in narcotics production. Id. at 278-79. Police, without a warrant, tracked the defendant's movements as he transported the container in his car. Id. The Court held that "a person traveling in an automobile on public [roads] has no reasonable expectation of privacy in his movements from one place to another," but does have an expectation of privacy once he enters his home. Id. at 281-282. The Court emphasized that "scientific devices" that allow for "police efficiency" in crime detection are constitutional. Id. at 284.

(101.) See Katz, 389 U.S. at 361.

(102.) See, e.g., DANNA BETHLEHEM, OPTIBASE, IMPROVING HOMELAND SECURITY WITH IP VIDEO SURVEILLANCE 2-3, available at http://www.optibase .com/Objects/Solutions/white%20papers/homeland%20security%20formatted.pdf (last visited Mar. 4, 2008).

(103.) See, e.g., Department of Homeland Security Home Page's fact sheet on America's security since 9/11, http://www.homelandsecurity.state.pa.us/ homelandsecurity/cwp/view.asp?A=519&Q=173883 (last visited Mar. 4, 2008).

(104.) See DEP'T OF JUSTICE, LEGAL AUTHORITIES SuPPORTING THE ACTIVITIES OF THE NATIONAL SECURITY AGENCY DESCRIBED BY THE PRESIDENT 1-2 (2006), available at http://fl1.findlaw.com/news.findlaw.com/hdocs/docs/ nsa/dojnsa 1190 6wp.pdf. For an example of search engines maintaining internet search records, see Michael Barbaro & Tom Zeller Jr., A Face Exposed for AOL Searcher No. 4417749, N.Y. TIMES, Aug. 9, 2006, at A1, available at http://www.nytimes.com/ 2006/08/09/technology/09aol.html?ex=1173416400&en=001a14fcca0f3c4c &ei=5070.

(105.) See supra note 89.

(106.) See Renee Doucher Ferguson, States Look to Lockdown RFID, EWEEK, Sept. 20, 2006, http://www.eweek.com/article2/0,1895,2018019,00.asp. Georgia, Utah, New Hampshire, and Wisconsin all have some form of RFID legislation, while California and several other states have introduced RFID legislation. Id.

(107.) Listing all named parties would go well beyond the scope of this note, however, several of the prominent organizations and agencies involved with RFID regulation will be discussed later.

(108.) See, e.g., EPCGLOBAL, AN OVERVIEW OF EPCGLOBAL'S ACTION AND WORKING GROUPS 1, http://www.epcglobalinc.org/what/cookbook/chapter1/ 004--WorkingwithEPCglobalActionGroupsv1.pdf (EPCglobal works with businesses worldwide to develop universal RFID industry standards) (last visited Mar. 4, 2008); Grant Gross, RFID Users Say No Privacy Law Needed, INFOWORLD, July 14, 2004 (Wal-Mart and Proctor & Gamble representatives tell Congress that RFID privacy laws are unnecessary), http://www.infoworld.com/article/ 04/07/14/HNrfidusers_1.html.

(109.) See supra note 108, including all listed citations.

(110.) See JULIE HUTTO & ROBERT D. ATKINSON, PROGRESSIVE POLICY INST., RADIO FREQUENCY IDENTIFICATION: LITTLE DEVICES MAKING BIG WAVES 4 (2004) (a coalition of ACLU, EPIC, CASPIAN and others have called for boycotts, moratoriums, and legislation to oppose RFID expansion), http://www.ppionline.org/documents/RFID_1006.pdf.

(111.) Id.

(112.) See ELEC. PRIVACY INFO. CTR. (EPIC), GUIDELINES ON COMMERCIAL USE OF RFID TECHNOLOGY 4 (2004) (proposing "removal" of RFID tags as a customer's right), http://www.epic.org/privacy/rfid/ rfid_gdlnes-070904.pdf.

(113.) See CTR. FOR DEMOCRACY AND TECH. (CDT), CDT WORKING GROUP ON RFID: PRIVACY BEST PRACTICES FOR DEPLOYMENT OF RFID TECHNOLOGY (2006), http://www.cdt.org/privacy/20060501rfid-best-practices.php (under paragraph "RFID and Privacy").

(114.) See HUTTO & ATKINSON, supra note 110, at 5; see also P3P Writer Home Page, http://www.p3pwriter.com/LRN_000.asp (under Personally Identifiable Information) (last visited Mar. 4, 2008).

(115.) Id. Information such as names, age, birth dates, etc. is not PII because multiple people can have these information characteristics. Id.

(116.) See ELEC. PRIVACY INFO. CTR., supra note 112, at 2-3; see also HUTTO & ATKINSON, supra note 110, at 8-9.

(117.) Id.; see also Ferguson, supra note 106 (EPCglobal is developing a nationally recognized logo).

(118.) See Real Seal's Home Page, http://www.realseal.com (last visited Mar. 4, 2008).

(119.) See HUTTO & ATKINSON, supra note 110, at 8.

(120.) See ELEC. PRIVACY INFO. CTR., supra note 112, at 3.

(121.) See HUTTO & ATKINSON, supra note 110, at 8.

(122.) Id. at 6.

(123.) Id. at 5-6.

(124.) See Ferguson, supra note 106.

(125.) See ELEC. PRIVACY INFO. CTR., supra note 112, at 3; see also HUTTO & ATKINSON, supra note 110, at 9.

(126.) See HUTTO & ATKINSON, supra note 110, at 7, 9.

(127.) See CAVOUKIAN, supra note 1, at 18-19.

(128.) Id. at 19.

(129.) See HUTTO & ATKINSON, supra note 110, at 7.

(130.) See CAVOUKIAN, supra note 1, at 15.

(131.) See HUTTO & ATKINSON, supra note 110, at 6.

(132.) Id.

(133.) Id.

(134.) Active tags are not considered in the analysis because they are primarily used for industrial container movement, not on individual products purchased at the retail level.

(135.) For example, electronic highway toll collectors, like EZ-Pass on the East Coast, employ RFID readers that can monitor an individual vehicle's movement as it passes through each toll booth. However, the reader cannot monitor the vehicle's movements on the road in between toll booths. Similarly, a person with an RFID tag could only be tracked while passing an RFID reader, not continuously as a GPS-tracking device could.

(136.) See AUTOID, supra note 28, at 2-4.

(137.) See A BASIC PRIMER, supra note 2, at 5-6.

(138.) See HUTTO & ATKINSON, supra note 110, at 6.

(139.) See CAVOUKIAN, supra note 1, at 18-19.

(140.) See AUTOID, supra note 28, at 1.

(141.) See CAVOUKIAN, supra note 1, at 15; see also CDT, supra note 113, (under paragraph "RFID and Privacy") (PII security threats arise if unauthorized individuals access RFID communications or network databases).

(142.) See HUTTO & ATKINSON, supra note 110, at 5.

(143.) See CAVOUKIAN, supra note l, at 15-16.

(144.) See generally HUTTO & ATKINSON, supra note 110, at 5-6.

(145.) See CAVOUKIAN, supra note l, at 15-16.

(146.) See generally HUTTO & ATKINSON, supra note 110, at 6.

(147.) Id. at 6 & n.19.

(148.) Id. at 6.

(149.) See id.; see also FCC Home Page, http://www.fcc.gov/cgb/ consumerfacts/phoneaboutyou.html (last visited Mar. 4, 2008); Barbaro & Zeller, supra note 104.

(150.) See id., including accompanying citations.

(151.) See Ferguson, supra note 106. "Utah's law amends the definition of computer networks to include wireless RFID networks." Id.

(152.) See generally Gross, supra note 108 (noting that California Congressman Darrell Issa suggested that "legislation should focus on what companies and government agencies do with the information they collect, instead of what technology is used to collect the information.").

(153.) See HUTTO & ATKINSON, supra note 110, at 9.

(154.) See Ferguson, supra note 106 (quoting Maureen Riehl, Vice President, Government and Industry Relations Counsel at the National Retail Federation).

(155.) Id.

(156.) See EPCGLOBAL, supra note 108, at 1.

(157.) See HUTTO & ATKINSON, supra note 110, at 8.

(158.) Id.

(159.) See Ferguson, supra note 106; see also Gross, supra note 108 ("Recent debates over a House spyware bill showed how difficult it is to legislate based on specific technologies.").

Justin M. Schmidt, J.D. Candidate, May 2008, Rutgers University School of Law--Newark; Bachelor's, 2001, University of Michigan--Ann Arbor; Officer, 2001-2005 United States Marine Corps, veteran of the Iraq War.