Tracking Privacy

Sandra R. Hughes

Position: Global privacy executive, Procter and Gamble

Issue: Radio frequency identification (RFID) and privacy. RFID tags could help manufacturers and retailers track shipments and inventory more quickly and accurately. But consumers worry their buying habits will be tracked as well. Can companies ensure buyers’ privacy?

Personal Point of Impact: Heads Procter and Gamble’s global privacy council, setting and enforcing the company’s policies on the privacy of individuals’ personal information; member of the public-policy steering committee of EPCglobal, a nonprofit industry organization that sets standards to support the use of RFID to track consumer products in the supply chain

Technology Review: How would RFID work to track products?

Sandra Hughes: It’s a technology that involves a silicon chip and an antenna, which together we call a tag. The tags emit radio signals to devices that we call readers. One of the things that is important to know about is EPC. Some people use RFID and EPC interchangeably, but they are different. EPC stands for electronic product code; it’s really like an electronic bar code.

TR: So manufacturers and distributors would use EPCs encoded in RFID tags to mark and track products? Why’s that any better than using regular bar codes?

Hughes: Bar codes require a line of sight, so somebody with a bar code reader has to get right up on the bar code and scan it. When you’re thinking about the supply chain, somebody in the warehouse is having to look at every single case. With RFID, a reader should be able to pick up just by one swipe all of the cases on the pallet, even the ones stacked up in the middle that can’t be seen. So it’s much, much faster and more efficient and accurate.

TR: Why is that speed important?

Hughes: We want our product to be on the shelf for consumers when they want it. A recent study of retailers showed that the top 2,000 items in stores had a 12 percent out-of-stock rate on Saturday afternoons, the busiest shopping day. I think the industry average for inventory levels is 65 days, which means products sitting around, taking up space for that time, and that costs about $3 billion annually. Often a retail clerk can’t quickly find products in the crowded back room of a store to make sure that the shelves are filled for the consumer, or doesn’t know that a shelf is sitting empty because she hasn’t walked by lately. With RFID, the shelf can signal to the back room that it is empty, and the clerk can quickly find the product.

TR: Are these tags being used already?

Hughes: A number of tests have been and are continuing to be done to evaluate and improve the technology. Primarily it’s been at the case level and pallet level, but sometimes it will be to the shelf, because in the end, the goal is to make sure that the right product is on the shelf for consumers to buy when they want it. There’s a lot of learning that still has to go on with the reliability of being able to read these tags, because if you’re going to use them to track products through their life cycles, you need the information to be accurate.

TR: Does that mean tracking a product even after a buyer has brought it home?

Hughes: No. Our focus is making sure the product’s there on the shelf. So to me, that’s the life cycle.

TR: How long will it take until we see these tags regularly?

Hughes: That’s going to be spread out over several years. What’s moving it along are mandates by retailers like Wal-Mart, Target, Metro in Germany, and Albertsons. The Wal-Mart mandate is that by January, their top 100 suppliers would be tagging pallets and cases of all of their products. In the next year or two, consumers are going to be seeing tags on cartons for big items, like computer equipment or furniture, for example. But for individual items like shampoo bottles, I think we’re talking eight to 10 years out.

TR: Some of the retailers, such as Wal-Mart and Metro, have seen consumer backlash over privacy concerns. Why is that?

Hughes: The most widely publicized privacy concern is that the EPC would be linked to personally identifiable information. The tags themselves don’t have any personally identifiable information, but the fear is that the number will be linked somehow to personal information. The other fear is that tracking or surveillance will go on outside the store-that an individual could be tracked to their home or so on because they have a tag on one of the products that they’ve purchased.

Hughes: They’re concerns that consumers have, so they are real to them and something that we feel needs to be addressed. But there are solutions for everything. If you think about it, the linkage in a retail store to personally identifiable information would be done just as it is today with bar codes. Whether consumers know it or not, if they have a loyalty card, the personal information that they have provided to get that card and all of the discounts and coupons that go with it must be linked to the bar codes of items that they purchase. So when you think about the electronic product code-this is the same thing.

TR: So you couldn’t track someone using a tag in his shirt or on a tube of toothpaste?

Hughes: The scenario I’ve heard is, “Somebody would be able to know every place I’ve been all throughout the day.” Let’s say that you went to a restaurant, and you went to a grocery store, and you went here or there. Wherever that tag is being read, that place would have to also have your personal information. And those locations would all have to be sharing information for someone to put it together and say, “This person went to this restaurant and this grocery store.” I can’t imagine businesses sharing that information about customers when you think that a lot of them are competing with each other.

TR: What about being able to follow someone directly using a tag, the way intelligence agencies have tracked terrorists using their cell phones?

Hughes: Assuming you knew someone’s identity and wanted to follow him using the tag like a homing device, you would have to be quite close to the person to “read” that tube of toothpaste. These are passive tags, which means they have no battery and don’t emit any signal unless a reader “wakes them up.” If you were going to stalk somebody, you don’t want to be seen. That’s going to be pretty difficult to do with passive tags.

TR: What about stores? Could the tags allow retailers to go even further in tracking customers and their buying habits?

Hughes: Well, the EPCglobal community has developed a set of usage guidelines. One of the things it says is that if a retailer is going to use the EPC information combined with personal information in any way differently than they do with bar codes today, then they need to make that information and choices available to the consumer. But to my knowledge, nobody has any plans to do that today.

TR: What if I’m freaked out anyway that you know exactly which tube of toothpaste I bought, and it has this working tag on it?

Hughes: These guidelines cover the basic tenets of privacy, which are that you let the consumer know that there is a tag on the product. And then they would be given a choice on disabling or deactivating those tags. But because the technology is in its infancy, there are not a lot of solutions yet. Basically, the tag can be removed or the packaging thrown away.

TR: That’s it? I can peel it off?

Hughes: Yes, or don’t buy the product. There will be other solutions-deactivation, either full or partial, I don’t know what else-all of which are still being developed and tested. We’re going to see a lot of developments, and it is really quite exciting to think about the way things will be five years from now. Already ideas are popping up-like blocker tags, or a metal shopping bag, because RFID can’t go through metal. There’s a lot of creativity that is still to come.