On Generating RFID Privacy Policies in Consideration of Openness and Enforcement

Several consumer protection groups and authorities in different countries have recently proposed guidelines for Radio Frequency Identification (RFID) privacy. Guidelines typically request that RFID application providers publish their privacy policies. Although several guidelines outline the primary components of privacy policies, few guideline have addressed how RFID application providers can establish privacy policies. This work proposes a scheme, which is going to be adopted by the RFID Applications for Campus Security and Safety Enhancement Project in Taiwan, to help RFID application providers establish RFID privacy policies in consideration of openness and enforcement. By using the proposed scheme, RFID application providers can clarify privacy practices for their applications in RFID privacy policies and communicate these policies to application users. Moreover, application providers can provide evidence to third parties trusted by both application providers and users to ensure that policies are enforced. While an increasing number of countries have started requesting that RFID application providers publish their privacy policies, this work will help countries develop guidelines and regulations for RFID application providers establishing application-based privacy policies.