The Privacy Challenges And Strategies In Retailing Industry On Rfid Implementation.

(1)

T H E PRI V ACY CH ALLEN GES AN D ST RAT EGI ES I N

RET AI LI N G I N DU ST RY ON RFI D I M PLEM EN T AT I ON

Hamzah Ritchi

Department of Accounting and

Business Information System

Jl. Dipatiukur No.35

Phone: (021) 2509055

Fax: (021) 2509055

April 2006

Padjadjaran University

(2)

(3)

Abstract

his paper aims to investigate privacy challenges faced by producers and consumers in retailing industry as a result from recent changes in acquiring and disseminating information by RFID. The technology is now in early stage of adoption among retailers, promising potential benefit for retailer particularly in efficiency enhancement and cost reduction. Though it sounds promising, fear of being tracked and monitored into personal life drives consumers to protest the adoption down to retailing level.

Major retailers are acting as producer in which they are the one who interact directly to consumer. As analysis steps further, it was found that there is a discourse between hegemonic and counterhegemonic in demonstrating the use rhetorical management of meaning by major retailer group to alter the understanding of consumers concerning RFID. Additionally, the use of power, though effective in absence of legal foundation, in longer term provides harmful for producers since trust issues emerge and affect to increase of uncertainty level of a given product.

Information society should be able to get a balance to provide adequate privacy protection without unjustifiably harming economic efficiency and business needs. Consequently, there is a need to create balance between using RFID as enabler of business need and protecting privacy of consumer’s life and information, ranging from establishing regulation to protect privacy up to letting consumer to choose, provided privacy requirements are satisfied.

(4)

(5)

The Privacy Challenges and Strategies in Retailing Industry on RFID Implementation

1

Introduction

The advancement of Information and Communication Technology (ICT) has been continuing rapidly, enabling information and knowledge dissemination to become faster, more accurate and in multi format basis. ICT are undergoing dynamic and continuous rapid development which is driven by new technologies that are emerging fast and business environment demand (Mutsaer, van der Zee and Giertz, 1998). As wired-based internet continuously evolves as standard to connect computers to computers all over the globe, an investigation that is deemed more extensive has been also explored in wireless domain. Much better than bar code scanning, Radio Frequency Identification (RFID) technology arises to bring a belief that its development may evolve as a way to connect things to computers in wireless way (Markman, 2003).

RFID has recently received promotions for commercial use particularly in retailing industry. Major retailers (Wal-Mart, Tesco, Marks and Spencer, Target, etc) have been endorsing their business partners to embrace RFID in their value-chain operation, ranging from logistic, shipment and warehousing (Twist, 2005; Jones, Hill, Hillier, and Comfort, 2005; Jones, Hill, Hillier, Shears and Comfort, 2004; Juban and Wyld, 2004, Kinsella, 2003). This news created an immediate reaction among the leading distributors, integrators and sellers to find out everything about this new technology and how it could benefit them.

Notably, RFID provides considerable benefits to retailers. It allows them to have a better inventory control, saving them from stock out problem and inventory theft (Kelly and Erickson, 2005). They also have a more supply visibility to track the physical product flow of their goods from the moment their manufacturer partners ship the goods to the receiving. Tracking facilitates quick resolution of disputes between manufacturers and retailers over what items, what quantity and when items were delivered (Caputo et al., 2003). Similarly, shrinkage from the shipment of goods to the point of receipt is readily identifiable. All of these benefits are eventually thought as a gain for consumers in term of efficiency and price reduction. However, like many new technologies, RFID is still in its embryonic stage, and it is regarded to pose potential harm to producer and consumer society.

This paper aims to investigate privacy challenges faced by producers and consumers in retailing industry as a result from recent changes in information acquisition and dissemination by RFID. Additionally, the paper examines strategy employed by each group of society to address obstacles exposed that may hinder them from getting the most out of ICT. While RFID has been actually used in many areas since early 1980s (Juels, 2006 ; Kelly and Erickson , 2005; Jones, Hill, Hillier, Shears and Daphne, 2004), the focus on this paper will be on the recent commercial use and as in retail industry.

(6)

Hamzah Ritchi The PrivacyChallenges and Strategies in Retailing Industry on RFID Implementation

2

It is argued that major retailers face a number of major challenges that should be addressed regarding in effect of RFID implementation, not only limited to technical issues such as lack of standard, high cost of tags, and security improvement, but also how to induce consumer to accept RFID on their products. They do this on behalf of consumer convenience, triggered with profit interest. On the other hand, consumers are facing fear that their personal life would be monitor under RFID chips surveillance. In other words, RFID has the potential to threaten consumers in their most personal part, privacy and security (Kelly and Erickson, 2005; Little and Brown, 2006; Albrecht, 2006). This results with community that fight against these major retailers.

Additionally, combining producer and consumer together, it is suggested that RFID creates a tension between power and ethics as such that major retailers push their interest to gain dollar and efficiency benefit at the expense of consumer’s privacy and security. Trust issue created by this tension problem in return, impacts the quality of the perceived value of products by consumers. This raises a proposition that selection system proposed by Wijnberg and Gemser (2000) might be not sufficient enough to explain the relationship.

Therefore, these challenges merit attention. Retailers need to collaborate with RFID vendors to obtain open standard, and continue reducing costs. On the other hand, an open dialogue about the technology’s advantages and potential dangers is an important step in introduction, coupled with strong set of fair information principles.

This paper draws a range of various literature mainly of those performed by Akerlof (1970), Darby and Karni (1973), Warf and Grimes (1997), Westin (2003), and Wijnberg and Gemser (2000). Literature review is conducted as primary method of data and analysis. This paper will start by describing short understanding of RFID, continued by evaluation of challenges posed by the two sides, along with strategy employed to overcome those challenges. Lastly, conclusion and recommendations will be discussed.

Definition

RFID is a small tag containing an integrated circuit chip and an antenna, and has the ability to respond to radio waves transmitted from the RFID reader in order to send, process, and store information. The RFID system consists of three basic components: a tag, a reader, and back office data processing equipment. The tag contains unique identification information of the item to which it is attached; the reader emits and receives radio waves to read the information stored in the tag, and the data-processing equipment processes all the collected data. This equipment can be as simple as a personal computer or as complex as an entire networked enterprise management information system (Wu, Nystrom, Lin, and Yu, 2005)

(7)

3

Discussions

Business Interest Issues

As mentioned earlier on, challenges for producer are dominated more by technical rather than social, such as no globally agreed standards and global radio spectrum (Mullen, 2004), costs consideration, and security (Twist, 2005). Ranges of improvement have been done (e.g, tag technology, network and data integration improvement) to justify all of those technical challenges (Wu et. All, 2005; Sarma, Weis, and Engels, 2003)

Major retailers are striving to get consumers’ welcome that their RFID-embedded products will not harm them. However, in spite of technological achievements and measurable customer benefits resulting from the RFID application, privacy complaints have gained public attention and increasingly put pressure on what was meant to enhance customer convenience (Loebbecke, 2005). Though consumer seem receive benefit from the increasing customer service, price discount, and other loyalty program (Albrecht, 2002), tagging RFID chips to individual items (may this be cultural product or non cultural product) after leaving the store from retail store and keeping them active into their very personal life such as home and offices are also somewhat disturbing.

There seems to be a gap between major retailers with consumers in communicating RFID endorsement. There are two possible explanations which might satisfy this situation: Firstly, major retailers are introducing RFID implementation when public policy that arranges technology assessment do not exist (Jones et.all, 2005a). Existing public policy permits commercial enterprises to collect information on consumers with few restrictions, indicating unbalanced assessment favouring to commercial interest. It is believed there is nothing inherently unethical in collecting information on customers when appropriate procedural justice safeguards are put into place to protect legitimate consumer interests (Kelly and Erickson, 2005). Secondly, there are concerns that customers may not be aware, or be given notice, that RFID tags have been attached to products within retail outlets (Henley Centre, 2005; Albrecht, 2002).

Based on this situation, it can be seen how business interest maintains its mainstream hegemony by driving major retailers to use their power by altering public meaning on total surveillance that may resulted from hidden use of RFID tags. Power is defined as the capacity to shape reality and to preform somebody in such a way that he or she does what one wants without any need of explicit power (Lukes, 1974, cited in Boonstra and Gravenhorst, 1998:107). Power can be enabled by the use of management of meaning (Hardy and Sullivan, 1998). Through a beneficial loyalty offerings, wrapped-up with well-designed package, major retailers have power to manage the meaning of consumer’s personal data pooling as something necessary to continue the offerings. As consumers regard this an inevitable way of for the sake of consumer, they become powerless relative to major retailers. And consequently, these corporations do not hesitate to launch and maintain its RFID tagging program.

(8)

4

the ease and speed of single-click purchasing. In a fully RFID-powered world, a smart-card carrying consumer could conceivably roll her shopping cart directly out of a supermarket past a reader that would tote up her purchases, charge her credit line, deduct the items from inventory and hand her a receipt -- and then disable the tracking devices. That is one type of convenience (Markman, 2003).

Additionally, prior to ICT, information collection is of little concern because of the primitive data collection technology available. But now, with rapid development in ICT, personalization of an identifiable scattered data is made possible. Moreover, the standardized and universal connection of internet enabled data acquisition and dissemination is conducted in a centralized place that is readily accessible by anyone.

Privacy and Security Issues

Privacy is defined as the claim of an individual to determine what information about himself or herself should be known to others (Henley Centre, 2005; Westin (2005); Solove, 2002) The privacy threat comes when RFID tags remain active once you leave a store. That is the scenario that should raise alarms--and currently the RFID industry seems to be giving mixed signals about whether the tags will be disabled or left enabled by default (Markman, 2003)

In more privacy detailed concerns, RFID has the potential to threaten consumers in numerous ways, namely through intrusion on their privacy – either physical or informational – and security. Informational privacy refers to the right of an individual to retain control over the collection and use of personally identifiable facts and information about their daily lives. Unregulated use of RFID may cause aggregation of personal information and product purchase information (Jones et. all, 2005). If the unique product information on an RFID tag is linked to personally identifiable customer information, such as a store or credit card number, which may in turn hold or offer access to further personal data, including address, income and credit rating for example, then this allows the retailer to build up detailed profiles of their customers and of their browsing as well as their purchasing behaviours.

This would allow retailers to initiate individual telephone based target marketing of customers who had not even been purchasing particular items. Retailers could also use these profiles to make inferential assumptions not only about a customer’s buying habits but also his/her health, lifestyle and travel. The widespread network of RFID receivers could be constantly observing, processing and evaluating consumers’ behaviour and thus rapidly eroding an individual’s freedom to enjoy their lifestyle in anonymity.

(9)

5

Though consumers are voluntarily giving their personal information by RFID tag, the current developments still identify security issue in the technology. RFID tags can be manipulated easily by hackers, shoplifters, or disgruntled employees (Claburn and Hulme, 2004). This can create another problem particularly in relation to crime. There is a chance one’s stored personal information is misused and as if this person is committing a crime.

As consequence, grass-root movements and libertarians are now just down the road to protest RFID use in retailing and demanding RFID to be used within supply chain only. In September 2003, Liberty, the UK’s leading human rights and civil liberties organisation, launched a campaign against retailers that employ RFID technology (Jones, et all, 2005). Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN) leaders, one of the grass root most community that is most vocal on battling RFID, produce a book titled “Spychips: How Major Corporations and Government Plan to Track Your Every Move with RFID” (see spychips.com). In 2005 at New Hampshire and Texas, protest took place to protest Wal-Mart's use of RFID. They are still moving on with primary source of fund comes from donation (see motherjones.com and nocards.org). The counter attack by these grass roots portrays the counterhegemonic that employs internet as tools to express opinion freely though domination is still under commercial retailers.

It is appealing to recognize that conflicts identified in this paper, mostly take place at the commercial point (retail) rather than indirect supply, manufacturing, distribution, and logistics. It shows that because retailers – the final stage of producer side of supply-chain – are those who interface immediately with buyers as consumer side entire products. Therefore, every retailer’s movement that may potentially harmful on consumer is by all means sensitive.

Though it seems there is no direct connection to valuation of retail products quality (the product will still be the same) as suggested by Akerlof (1970), yet the tension driven by opposite views of RFID innovation establishes “trust issue” in longer term. Consumers perceive retailers of doing unethical opportunistic behaviour by entering their privacy territory. Consequently, it augments uncertainty and in return, distorts the quality of the perceived value of products by consumers.

Individuals are not always aware, however, that their privacy might be at risk when the technologies they encounter on an everyday basis, or those they choose to own, are used in ways other than those first anticipated. Trust becomes critical to individual willingness to engage with retailers, and it will decline when the companies lose public confidence (Henley Centre, 2005). Relating this phenomenon to what is proposed by Wijnberg and Gemser (2000), selector system may not change much in verifying retailers’ products that are essentially the same. Nevertheless, selection system in determining quality of retailers’ products are now shifting beyond the product itself but also how safe, convenient, and private does the product is perceived. The use of non profit organization such as grass-root communities that concerns on specific matters provides an ‘expertise’ system that helps consumers in deciding quality of product.

Strategy

(10)

6

introduction of RFID must be guided by a strong set of fair information principles. Range of strategies may be conducted to address the privacy and commercial problem. First, given the tremendous potential for harm to society, the use of RFID technology should be legally regulated. CASPIAN in this context has contributed the legal input entitled “Position Statement on the Use of RFID on Consumer Products “(CASPIA, 2003). Second, requiring major retailers employing RFID to notify buyers about RFID tabs are being used. Such tags should be clearly visible and readily removable. Third, RFID tags should be automatically disabled at checkout unless the consumer expressly opts to keep the tag enabled. Fourth, since consumers need to feel they have control over the RFID infrastructure before they routinely trust its services, educating consumer of Privacy Enhancing Technology should be intensified (Günther and Spiekermann, 2005). Fifth, governmental authorities should be required to obtain a court order in order to be able to access RFID tags.

Conclusion and Recommendation

RFID technology is now in the early stage of adoption among retailers. It is found that hegemonic discourse exists as dominant party that attempts to obtain its profit goals. As RFID is regarded of being beneficial which outweighs other cost considerations, conflicts arises between major retailers and consumers that fall under two categories, business orientation and privacy violation.

The discourse between hegemonic and counterhegemonic also demonstrates the use rhetorical management of meaning by major retailer group to alter the understanding of consumers toward RFID. The use of power though effective in absence of legal foundation, in longer term provides harmful for the producers since trust issues emerges and impact to the increase of uncertainty level of a given product.

As the economic benefits become evident and the price of the technology continues to decline, usage will undoubtedly rapidly expand among retailers. As noted previously, retailers have always collected information on their customers.

Existing public policy permits commercial enterprises to collect information on consumers with few restrictions. Once RFID tags are deployed on a widespread basis in consumer goods, it will be virtually impossible for a consumer to “opt-out” of using those goods. Therefore, there should be a balance between using RFID as enabler of business need and protecting privacy of consumer’s life and information, ranging from establishing regulation to protect privacy up to letting consumer to choose provided privacy requirements are satisfied.

This paper has limits in a way that it focuses more on developed economies practices. Another limit is discussion of the RFID if it is viewed from innovation base theory. Therefore, addressing the two areas are open for further research and discussion.

References

Akerlof, G. A., 1970, The Market for 'Lemons': Qualitative Uncertainty and the Market Mechanism, Quarterly Journal of Economics, 89, 488-500.

(11)

7

Denver University Law Review, Summer, 79(4), pp.534-539 and 558-565.

Boonstra, Jaap J. and Gravenhorst, Kilian M. Bennebroek, Power Dynamics and Organizational Change: A Comparison of Perspectives, European Journal Of Work And Organizational Psychology, , University of Amsterdam, Faculty of Social Sciences, Amsterdam, The Netherlands 7(2), 97–120.

Bret, Kinsella., 2003, The Wal-Mart factor, Industrial Engineer, Norcross:Nov 35, (11),pp.32. Caputo, A., Pelagagge, P. and Scacchia, F., 2003, Integrating transport systems in supply

chain management software tools, Industrial Management & Data Systems, 103(7), pp. 503-15.

CASPIAN, 2003, Position Statement on the Use of RFID on Consumer Products [online], Spychips.com November 14, 2003 available at http://www.spychips.org/ and

www.privacyrights.org

Claburn, Thomas and Hulme, George V., 2004, RFID's Security Challenge Security -- and its high cost -- appears to be the next hurdle in the widespread adoption of RFID[online]. InformationWeek, Nov 15, 2004 12:01, Available from:

http://www.informationweek.com/story/showArticle.jhtml?articleID=52601030&ti d=13690 [Accessed 24 April 2006].

Darby, M. R. & Karni, E., 1973,. Free Competition and the Optimal Amount of Fraud, Journal of Law and Economics, 16, 67-88.

Günther, Oliver and Spiekermann, Sarah, 2005, RFID and the perception of control; the consumer's view, Association for Computing Machinery. Communications of the ACM, New York: Sep 2005, 48(9), p. 73.

Henley Centre, 2005, Privacy in the Digital Networked Economy [online], Report prepared by Polly Courtney, Charlotte Lacey and Rebecca Nash to BT Group, 11-33 St. John

Street London EC1M 4PJ. Available from:

http://www.btplc.com/Societyandenvironment/Hottopics/Privacyinthenetworkedd igitaleconomy/Privacyinthedigitalnetworkedeconomy.pdf [Accessed 20 April 2006]. Jones, Peter., Clarke-Hill, Colin., Hillier, David., and Comfort, Daphne., 2005, The benefits,

challenges and impacts of radio frequency identification technology (RFID) for retailers in the UK, General Review [online], Marketing Intelligence & Planning, 23(4),

Available from

http://www.emeraldinsight.com.ezproxy.lib.unimelb.edu.au/Insight/ViewContentSe rvlet?Filename=/published/emeraldfulltextarticle/pdf/0200230406.pdf [Accessed 5 April 2006].

Jones, Peter., Clarke-Hill, Colin., Hillier, David., and Comfort, Daphne., Shears Peter., 2004, Radio Frequency Identification in Retailing and Privacy and Public Policy Issues, Management Research News, 27(8/9), pp.46-56.

Juban, Rusty L., and Wyld, David C., 2004, Would You Like Chips With That?: Consumer Perspectives of RFID, Management Research News, Patrington, 27(11/12), pp. 29, 16. Juels, A., 2006, RFID security and privacy: a research survey, Selected Areas in Communications,

IEEE Journal, Feb., 24(2), pp. 381- 394.

(12)

8

rights, conceptual paper [online], Industrial Management & Data Systems, 105(6),

Available from:

http://www.emeraldinsight.com.ezproxy.lib.unimelb.edu.au/Insight/viewContentIte m.do?contentType=Article&hdAction=lnkpdf&contentId=1509935 [Accessed 5 April 2006].

Little, Jonathon., and Brown, Alexander., 2006, Someone to watch over you [online], Computer Law & Security Report, 22(2), pp.169-171, Available from

http://www.sciencedirect.com.ezproxy.lib.unimelb.edu.au/science?_ob=MImg&_im

Loebbecke, Claudia, 2005, RFID Technology and Application in the Retail Supply Chain: The Early Metro Group Pilot [online], 18th Bled eConference eIntegration in Action, Bled, Slovenia, June 6-8, 2005, Available from: http://www.mm.uni-koeln.de/mitarbeiter-

loebbecke-publications-proceedings/Conf-081-2005-RFID%20Technology%20and%20Applications%20in%20the%20Retail%20Supply %20Chain.pdf [Accessed 15 April 2006].

Markman, Jon D., 2003, Super Models: Invest in the greatest thing since the bar code [online], MSN

Money 6/25/2003, Available from

http://www.moneycentral.msn.com/content/p50823.asp [Accessed 18 April 2006]. Mullen, D., 2004, RFID Technology Overview [online], Global Aviation Forum,AIM,

Available from:

http://www.informationweek.com/management/showArticle.jhtml?articleID=5260 1030&pgno=3&queryText= [Accessed 12 April 2006].

Mutsaers, E., van der Zee, H. and Giertz, H., 1998, The evolution of information technology, Information Management and Computer Security, 6(3), pp.115- 126.

Sarma, Sanjay E., Weis, Stephen A., and Engels , Daniel W., 2003, RFID Systems and Security and Privacy Implications, in B.S. Kaliski Jr., Ç.K. Koç, and C. Paar (Eds.), Cryptographic Hardware and Embedded Systems - CHES 2002: 4th International Workshop Redwood Shores, CA, USA, August 13-15, 2003, Lecture Notes in Computer Science, Auto-ID Center Massachusetts Institute of Technology Cambridge, MA 02139, 2523, pp.454-469 www.autoidcenter.org.

Solove,D.J., 2002, Conceptualizing privacy. California Law review, 90(4), 1087-1156.

Twist, D.C., 2005, The impact of radio frequency identification on supply chain facilities, Journal of Facilities Management, 3(3), pp.226-239.

Warf, B. & Grimes, J., 1997, Counterhegemonic discourses and the Internet, The Geographical Review, 87(2), 259-274.

Westin, A., 2003, Social and Political Dimensions of Privacy, Journal of Social Issues, 59(2): 431-453.

(13)

9

ABI/INFORM Global, May/Jun 11(3),pp. 323.

Wu, N.C., Nystrom, M.A., Lin, T.R., and Yu, H.C., 2005, Challenges to global RFID adoption [online], Technovation, In Press, Corrected Proof, 25 October, Available from

http://www.sciencedirect.com.ezproxy.lib.unimelb.edu.au/science?_ob=MImg&_im

agekey=B6V8B-4HDG95J-2-F&_cdi=5866&_user=559483&_orig=search&_coverDate=10%2F25%2F2005&_s

k=999999999&view=c&wchp=dGLzVzz-zSkzS&md5=6c5e28acbcc4db628e035a296d998ade&ie=/sdarticle.pdf [Accessed 10 April 2006].

See Reference