State leads way on RFID privacy

Washington state has passed some of the first laws in the country related to privacy and radio-frequency-identification (RFID) technology.

Last week, Gov. Christine Gregoire signed into law two bills protecting consumer privacy by making it a felony to possess information gained from an RFID-enhanced driver's license, except when crossing international borders, or to maliciously scan someone's identification remotely without their knowledge and consent.

As a state with many travelers who cross the border frequently, Washington has become a test bed for RFID. It's one of four states that have signed agreements with the U.S. Department of Homeland Security to use RFID technology in optional-enhanced driver's licenses that became available in January.

Critics say that is a precursor to establishing a national ID card.

While the new technology "does simplify border crossings with neighboring countries, it also presents new and broad opportunities for identity theft and surveillance," said Rep. Deb Eddy, D-Kirkland, who sponsored HB 2729, which goes into effect in June. Because the data on the chip is not encrypted, its unique number can be captured from a distance, Eddy said. The licenses are shipped with a foil sleeve to prevent radio transmission.

HB 2729 says personal information on identity cards may be released to law-enforcement agencies only for customs and border-protection purposes. Personally identifying information may be released to law-enforcement agencies for other purposes "only if accompanied by a court order," the law states.

Another bill signed into law, HB 1031, outlaws "skimming," making it a felony for a person to "intentionally scan another person's identification device without that person's prior knowledge and consent for the purpose of fraud, identity theft or any other illegal purpose."

The Senate took out an "opt in" provision that would have made it illegal for any company or person to slip an RFID chip into objects such as loyalty cards or cellphones without consumer consent, said state Rep. Jeff Morris, D-Anacortes, the bill's sponsor.

"This is a technology that the consumer is clearly unaware of unless it's pointed out to them," he said.

The bill was opposed by the retail and cellphone industries, Morris said. "The RFID chip will be a huge revenue stream for them as they start to move the phone into the place of the credit card."

"I don't think there's any question mobile payment is in the near future," said Joe Farren, director of public affairs at CTIA, the wireless-industry association. Mobile phones are "increasingly your portal to everything you do in your life."

The association supports efforts to establish a national wireless policy, which would be a more consistent way to handle rules than being "regulated 50 different ways in 50 states," Farren said.

New Hampshire is poised to go further than Washington. This month, the New Hampshire House voted to ban RFID chip implants in humans and require a notification label on any product that contains RFID chips.

The New Hampshire bill bars the state from using RFID chips in driver's licenses, license plates or traffic toll transponders.

Eddy called the new Washington laws "a good beginning" but added that as the technology "moves faster than our understanding of its implications," other constitutional issues need to be considered.

Kristi Heim: 206-464-2718

or kheim@seattletimes.com