Implementing RFID in Europe: Privacy and Security Standards Guidelines. Stephane Pique - RFID Business Consultant

Transcription

1 1

2 Implementing RFID in Europe: Privacy and Security Standards Guidelines - RFID Business Consultant 2

3 Europe and RFID COMMUNICATION from the commission to the European parliament, the council, the European economic and social committee and the committee of the regions (March 2007) COMMISSION RECOMMENDATION on the implementation of privacy and data protection principles in applications supported by radio-frequency identification (May 2009) Privacy and Data Protection Impact Assessment Framework for RFID Applications (January 2011) 3

4 Major points of the recommendation (1/2) Data Protection Directive 95/46/EC and Directive 2002/58/EC are fully applicable to the use of RFID applications that process personal data. RFID application operators should take all reasonable steps to ensure that data does not relate to an identified or identifiable natural person An assessment of the privacy and data protection impacts carried by the operator prior to the implementation of an RFID application 4

5 Major points of the recommendation (2/2) operators should inform individuals of the presence of tags that are placed on or embedded in products. Retailers should deactivate or remove at the point of sale tags used in their application unless consumers give their consent to keep tags operational. 5

6 Phases of the EC mandate Phase 1 consisted in a gap analysis in terms of standardization realized by ETSI Phase 2 was initiated in 2012 with CEN Technical Committee 225 to develop a Standardization program 6

7 Introduction CEN European Committee for Standardization Mandate 436: Consists of 5 project teams Team A: Common European RFID Notification Signage Team B: RFID Device Privacy Team C: Privacy Impact Assessment Team D: RFID Penetration Testing Team E: Extended RFID Device Security Capability Over 20 RFID experts Industry contributors 7

8 Scope of mandate Simplify the tasks of RFID system implementers and operators Helping them to understand their responsibilities under existing EU Data and Privacy Protection Law Create frameworks and templates to assist both large and small enterprises 8

9 Deliverables - CEN Technical Reports Notification of RFID: Additional information to be provided by operators Privacy capability features of current RFID technologies Analysis of PIA methodologies relevant to RFID RFID PIA analysis for Specific Sectors RFID threat and vulnerability of RFID Systems analysis Authorization of mobile phones when used as RFID interrogators è Finalized until Q4/2013 9

10 Deliverables - CEN Technical Specifications Notification of RFID: The information sign to be displayed in areas where RFID interrogators are deployed Device interface to support ISO/IEC Mode 1 and Mode 3 tags è Finalized until Q4/

11 Deliverables - CEN European Norms Information technology - Radio frequency identification for item management RFID Emblem (EN ISO/IEC 29160) è finalized Notification of RFID: The information sign and additional information to be provided by operators of RFID data capture applications RFID privacy impact assessment (PIA) process è Finalized in

12 PTA - Common European RFID Notification Signage 12

13 PTA - Common European RFID Notification Signage The Common European RFID Notification Signage system will provide a simple means to notify citizens to the presence of RFID interrogators in public areas, including shops, public transport locations, libraries, etc. The Signage system will allow citizens to be advised of the presence of RFID tags placed on or in items, including contactless bank and public transport cards, library books, and tags used to assist in warranty, maintenance and recycling of durable household goods. Signage system will be similar to the familiar CCTV signage 13

14 PTA - Signage based on familiar CCTV signs

15 PTA - The European Emblem What?: The Generic version of the ISO Emblem as per Standard. Uniqueness all over Europe Where? On the sign to be displayed in areas where RFID interrogators are deployed. Also on items depending on the result of the PIA Purpose: Unlikely that logos that serve the purpose of communicating a trademark of a proprietary system or a business application, the Common European RFID emblem shall be utilized as a generic emblem to indicate the presence of an RFID application for the notification of citizens about the RFID technology utilization 15

16 PTA - Signage Three elements Common Notification Emblem Scope and purpose of RFID system How to contact operator/controller è Points to where more information can be found Two general signs Areas where readers may be operating (EC Rec 8) Tagged items (EC Rec 9) One Emblem! 16

17 PTA - Additional Information to be provided by operators Operator of the application Purpose of the application Data processed Summary of the Privacy Impact Assessment Likely risks and the mitigation measures 17

18 PTB - RFID Device Privacy 18

19 PTB - Privacy capability features of current RFID technologies Access protection features Features to protect Consumer Privacy Features to protect Data Security Features for tag authentication Standards support of privacy capability features Product support of privacy capability features 19

20 PTB - Access protection features 20

21 PTB - Features to protect Consumer Privacy 21

22 PTB - Features to protect Data Security 22

23 PTB - Features for tag authentication 23

24 PTC - Privacy Impact Assessment 24

25 PTC - Privacy Impact Assessment Standards Propose a generic, simple but efficient methodology to implement PIA for RFID applications Look at the current situation: How RFID is being used in key sectors (retail, libraries, banking, transportation) Existing laws, current PIAs, how RFID actually works Related question: What is the relationship of Privacy to Data Protection and Data Security? Key Point: role and use of technology by individuals (consumer, user, employee) 25

26 Privacy Impact Assessment (PIA) Ensure compliance with the EU legal framework and best practices on privacy and data protection Protect the customer s privacy Protect the company s reputation Privacy by design risk management Increase customer confidence in the RFID technology 26

27 PTC - PIA process 27

28 PTC - EN on PIA process Based on the Privacy and Data Protection Impact Assessment Framework Defines aspects of that framework as normative or informative procedures to enable a common European method for undertaking an RFID PIA Provides a standardized set of procedures for developing PIA templates, including tools compatible with the RFID PIA methodology In addition, it identifies the conditions that require an existing PIA to be revised, amended, or replaced by a new assessment process 28

29 PTD - RFID Penetration Testing 29

30 PTD - Tests outside ETSI regulations (1/2) 30

31 PTD - Tests outside ETSI regulations (2/2) 31

32 PTD - Some conclusions A regular Library gate antenna operating at 13,56 MHz Activation range limit is 1,6m / 5,2 ft (field strength beyond ETSI) Under the measurement conditions* max. eavesdrop distance is 3,2m / 10,5ft At MHz Activation range limit is 27m / 88ft (power beyond ETSI) Under the measurement conditions* max. eavesdrop distance is 80m / 87yd è Test demonstrated that to obtain useful personal data by means of illicit reading and eavesdropping is more difficult than commonly understood * Rx sensi3vity, floor noise, tag backsca@ered, signal strength, etc. 32

33 PTE - Extended RFID Device Security Capability 33

34 PTE - Some conclusions Inclusion of ISO/IEC based new NFC Forum Tag Type will not have an impact on the read range of the ISO/ IEC or ISO/IEC tags and therefore it will not increase the capabilities of NFC phones to capture data without consent The capability to read ISO/IEC compliant tags might cause a threat for exiting applications that currently use such tags Read range of NFC phones can practically not be extended UHF capabilities could potentially be a threat for the consumer s privacy. However, availability is very limited 34

35 Useful links CEN/NEN website: ETSI website: Official EU website: policy/rfid GS1 PIA tool: Database on worldwide RFID standards: 35

36 Contact details RFID Business Consultant

37 37