An Efficient and Flexible Way to Protect Privacy in RFID Environment with Licenses

To release the tension between the convenience and the privacy risk brought by RFID systems, organizations are requested to disclose their policies about RFID activities, to obtain a customer's consent, and to adopt appropriate mechanisms to enforce the policies. However, current researches on RFID typically focus on the enforcement part - to protect personal data stored in RFID tags and to prevent organizations from tracking a person through the information emitted by specified RFID tags. There is a missing piece for customers to achieve agreements with organizations efficiently and to limit organizations' RFID activities flexibly. This paper proposes a new technical and legal approach for responding to concerns about the privacy of personal data in RFID systems by extending the framework of online personal data licensing (OPDL) and applying the framework to RFID environment. In our proposed approach, organizations must obtain licenses before collecting a person's data via RFID technologies. The digitalized and standard licenses can further be checked automatically to ensure that the collection and use of a person's data is strictly under the person's consent. While individuals can control who have licenses and the content of the licenses easily, the framework can hopefully provide an efficient and flexible way to overcome the deficiency of current privacy protection technologies for RFID system.