While radio frequency identification technology (RFID) may offer potential benefits, it also raises privacy fears. Despite these fears, the Competitive Enterprise Institute (CEI) argues in a recent report that these fears should not lead to legislative controls of RFID. Rather, the CEI believes that "prompt deployment of, and experimentation with, RFID would best serve the interests of the public and the economy." Perhaps, but those people harmed by perceived privacy invasion will not be pleased in the meantime.

So, what exactly is RFID and how does it provide possible advantages over bar codes and static ID cards? RFID, as described by the CEI, implements the radio frequency portion of the electromagnetic spectrum to identify objects uniquely. Radio communications and new efficiencies in fabrication and miniaturization feed into RFID devices that in turn can assist in the production and delivery of goods, and specifically to enable unique identification in new and more effective ways.

RFID is moving along such that it is soon to be ready for prime time as a real alternative to bar codes (Uniform Product Codes — boxes of vertical bars and spaces). Most of us are readily familiar with bar codes on most consumer goods. RFID already is being used in the shipping and logistics industry, in transportation access cards, and for use in some identification cards. In terms of personal identification, RFID already enables key card holders to enter secure buildings and pass through toll gates rapidly.

The promise of RFID is that as the technology advances and is deployed more and more, products shipped on trucks, trains and planes and stored in warehouses regularly will be inventoried without unloading and ferreting through pallets and packaging. Furthermore, RFID apparently could assist consumer ease by allowing receipt-free returns and thwarting post-sale theft.

But not all is clean and easy with RFID, as it has raised significant enough privacy concerns to cause alarm among activist groups, state legislators to consider restrictive legislation, and the Federal Trade Commission (FTC) to conduct hearings aimed at potential regulation. The privacy concerns that have been voiced relate to direct monitoring and indirect monitoring.

In terms of direct monitoring, the expressed fear is that someone in the manufacturing or sales chain may use information obtained from RFID systems to learn information about or track a consumer against her interests. As an example provided by the CEI, RFID could be implemented to understand a particular consumer's purchases from a store and then ascertain when the consumer returns to the store. This type of information could lead to the store developing a "file" about the consumer and her purchasing activities. This also could cause the store to focus specific marketing efforts at that consumer. Use of information like this from RFID very well may offend some consumers' privacy standards.

Indirect monitoring can occur when an outsider to an RFID network uses the existence of RFID "tags" to read and collect personally identifiable information against the interests of the people being monitored. As an example set forth by the CEI in this context, union personnel at a right-to-work rally surreptitiously could scan RFID tags on clothing, ID cards and the like. When a person whose RFID tag's serial number was scanned at the rally later shows up at a union hall, she could face retaliation from the union. This type of monitoring likely would offend notions of privacy held by many people.

Notwithstanding the above privacy concerns, the CEI feels legislation is inappropriate at this time to restrict or control RFID because "there is little real-world experience" based on the limited deployments of RFID tags so far. That indeed may be the case. But the CEI goes farther, stating that "as RFID technology comes into full use, various social forces will constrain it more suitably than would government regulation," as "RFID users face economic incentives and consumer preferences that will direct the technology's evolution in harmony with consumer interests," and because "consumers' easy access to defensive techniques and counter-technologies will complement existing laws that already protect privacy."

That all is much easier said than done. Self-regulation has been proposed before as technologies developed, and after privacy violations occurred and the self-regulation did not get the job done completely, the law came marching in — such as the Children's Online Privacy Protection Act, the Financial Services Modernization Act (Gramm-Leach-Bliley), and other privacy laws.

RFID is off the ground and we will see where this new technology takes us. Let's watch closely to ensure that our privacy is not further encroached as the world gets smaller and smaller.

Eric Sinrod is a partner in the San Francisco office of Duane Morris (www.duanemorris.com), where he focuses on litigation matters of various types, including information technology disputes. His column appears Wednesdays at USATODAY.com. His Web site is www.sinrodlaw.com, and he can be reached at ejsinrod@duanemorris.com. To receive a weekly e-mail link to Mr. Sinrod's columns, please send an e-mail with the word Subscribe in the Subject line to ejsinrod@duanemorris.com.