RFID in the Employment Context: The Struggle Between Individual Privacy and Corporate Efficiency

By Anna Gotfryd* and Rachel Tenin**

I. Introduction

“Once a new technology rolls over you, if you’re not part of the steamroller, you’re part of the road.”[1]  In this case, Radio Frequency Identification Technology (RFID) is the steamroller, and companies who choose not to adopt this technology are roads.  RFID is a technological advancement that utilizes radio waves to identify objects and people.[2]  Once a RFID tag is near a RFID reader, the tag sends electromagnetic waves to a computer that then become stored as digital data.[3]  Although RFID has been around for over sixty years, it has recently expanded.

II. RFID in Modern Society

Consumers encounter RFID in various forms ranging from toll passes stationed inside their vehicles to microchips implanted in their pets.[4]  Even the Vatican imbeds the chips in identification badges to keep track of clergy and staff with the goal of maintaining the security of private files.[5]  While certainly a valuable and even necessary technology, its expansion has triggered reluctance.  Just over a year ago, a Texas school district was sued after district officials implemented a pilot program using RFID technology to monitor students’ whereabouts on school property in hopes of enhancing safety.[6]  However, privacy-related concerns do not appear to be impeding the anticipated growth of RFID.  The RFID market is expected to triple between 2013 and 2020, from just under $8 billion to more than $23 billion.[7]  RFID is primarily used for inventory management and in corporate supply chains, but in recent years it has gained momentum as an employee tracking technology.

III. RFID as an Employee Tracking Technology

Humans are a corporation’s most valuable resource, and effective management of its resources is of utmost importance to decreasing waste while increasing output.  Thus, companies have begun implementing ways to track employees using RFID.  RFID is a useful tool for many businesses because the chips improve accuracy, efficiency, and productivity.[8]  For example, Bank of America asked ninety workers to wear chipped badges, which recorded their movements and the tone of their conversations.[9]  The data collected demonstrated that the most productive workers were part of close-knit teams.  Implementing the results, Bank of America scheduled group breaks that overrode previous individual breaks and increased workplace productivity by ten percent.

A quick Google search will display dozens of companies that are eager to sell their latest RFID employee tracking products.  One such company, Intelleflex, advertises the sale of RFID badges that track employees and reveal to employers detailed information about their workers such as an employee’s name, location history, photograph, and biometric information.[10]  Perhaps the most intrusive example of RFID use is the human implantation of a microchip.  In 2006, concerns about invasive business practices gained attention after a company in Cincinnati, Ohio announced that it would inject RFID chips into the biceps of willing employees.[11]  While implanting humans with RFID for work-related purposes is considered extreme, many companies have noticed the benefits of RFID technology.

IV. Where Is RFID Headed?

The inexpensive and discreet nature of RFID has led to a myriad of ways private employers can use RFID technology.  RFID today is applied by businesses with the goal of increasing workplace efficiency through the maintenance of employee attendance records, calculation of overtime, and reduction of tardiness among others.[12]  As RFID usage becomes more commonplace, there is much room for discussion regarding security issues, employees’ rights to privacy, and employers’ rights to workplace organization.

A. The “Magic” of Technology and the “Monster” of Profit Margins: Companies Adopt RFID in Global Business Models

Competition is a driving force in all intersections, and its effects are particularly apparent in the marketplace.  This spring, Disney Parks will be introducing MyMagic+ wristbands that collect mounds of visitor personal data in an effort to better customize visitors’ experiences, market effectively to target audiences, and, of course, to increase sales.[13]  Disney’s inevitable struggle with privacy concerns as they launch this innovative program will be exceptionally informative of the lenient or restrictive direction that the law will take.  Despite the hurdles, “Disney has decided that MyMagic+ is essential.”[14]  Thomas O. Staggs, chairman of Disney Parks and Resorts, recognizes the need for the company to “aggressively weave new technology into its parks—without damaging the sense of nostalgia on which the experience depends—or risk becoming irrelevant to future generations.”[15]

B. The Intersection of Individual Privacy and RFID Application

RFID technology itself does not threaten individual privacy; it is when implemented in invasive and opaque ways that problems arise.  Recently, researchers observed RFID tracking sensors at a Boston hospital to monitor the activity of sixty-seven nurses.[16]  The nurses wore chipped identification badges that measured nurse-to-nurse interactions, the physical activity of the nurses, and nurse-to-patient interactions.  Sociometric Solutions, the company that conducted the study, claims that data analyzed through the tracking of these nurses showed strong relationships between nurses’ behaviors and patients’ overall hospital stay.  Sociometric Solutions suggests that the data retrieved will allow the hospital to better plan their investments, leading to improvements to patient recovery and bottom-line cost reductions.  Hospitals in the United States have also implemented RFID wristbands for their staff members.  The wristbands monitor how well employees wash their hands and even send hand-washing hygiene report cards to the employees.[17]  This technology will allow for companies to organize in ways that improve feedback, interactions, and the ways that individuals work.[18]  RFID technology is extremely beneficial from a business perspective, and the law is struggling to keep up.

V. New Legislation Involving RFID Tracking

The utilization of location tracking tools within the workplace is unprecedented and tasks legislatures with the creation of laws.[19]  So far, the most substantial case law was decided in 2012 in United States v. Jones.  The Supreme Court held that the government’s installation of a GPS device on a defendant’s vehicle with the purpose of monitoring the vehicle’s movements represented a “search” within the meaning of the Fourth Amendment.[20]  The holding is quite narrow, as it only addresses the government’s use of GPS tracking when it constitutes a physical trespass.  This raises questions regarding the nature and the scope of location tracking data within the private sector, leaving states to individually address privacy concerns.

In 2005, California was the first state to adopt legislation that addressed RFID and privacy-related concerns, but it was limited to the use of automated teller machines.[21]  Today, six states prevent unauthorized “skimming” of RFID information.[22]  Four states—Wisconsin, North Dakota, Oklahoma, and California—have taken measures to prevent employers from requiring employees to implant RFID chips in their bodies.[23]  In July 2013, Montana made history as the first state to pass a law restricting state officials from tracking anyone using an electronic device.[24]  In January 2014, an Illinois law disallowed state agencies from using electronic tracking devices on vehicles.[25]

In 2011, the New Hampshire House of Representatives proposed House Bill (HB445), which restricted electronic tracking of individuals.  However, it provided an employer exception, allowing employers to track employees within the confines of an employment relationship during working hours.[26]  HB445 passed in the New Hampshire House of Representatives, but it failed in the Senate.  Last year, the New Hampshire House of Representatives tried again with a 2013 House Bill (HB592).  HB592 provides even more leeway to employers than the original draft.  The later draft expands on employers’ abilities to track their employees in any “work-related functions, during or after working hours, upon reasonable notice to the employee.”[27]  This bill died in chambers, but New Hampshire’s efforts illustrate the struggle of legislatures to find a clear solution, leaving employers lacking clarity about limitations on their ability to track their employees.  With the increasing use of RFID in the employment context, federal and state legislatures will need to construct guidelines and clarifications hastily.

VI. Recommendations

Employer efficacy, created through transparency and openness, will lead to workplace efficiency and an embrace of technology necessary to compete in the marketplace, rather than fear and rejection.  Communication is crucial, particularly when implementing technology that is unfamiliar.  In a case study conducted for RAND Infrastructure, Safety, and Environment, researchers monitored six private-sector companies, in an effort to understand these corporations’ policies for collecting, keeping, and using data obtained by RFID.  Of the companies studied, only one had “[e]xplicit, written policies governing the use of RFID in the workplace. . . .”[28]  All of the companies “ke[pt] the records indefinitely,” rather than adopting a “limited data retention policy. . . .”[29]  Not a single company communicated to its employees that the data on their ID badges was being collected and stored.  Employers should deal with legal uncertainties by explaining to employees the benefits that RFID provides to companies.  Policies that clearly define the scope of an employer’s tracking ability on an employee are best to elicit informed consent.  The idea of informed consent is consistent with fair, ethical information practices and clear guidelines communicating employer expectations.  Informed consent will allow for employee rights that strike the right balance between individual privacy and workplace efficiency.

VII. Conclusion

The ever-increasing demands for corporations to exceed their bottom line while competing in a marketplace rapidly adapting to technological advances means that employers should, and in fact must, take advantage of RFID technology in order to merely keep up.  However, the law is unable to match the demands of the market and the advances of technology.  RFID utilization requires a legal remedy.  This technology is being applied to human beings with rights to privacy and non-discrimination.  Corporations ought to be allowed to take advantage of research efforts and maximize workplace efficiency.  However, both parties are entitled to a legal framework setting clear guidelines within which they can operate.  Informed consent is a prerequisite to medical treatment and should necessarily be extended to the employer-employee workplace context.

 


*J.D. Candidate, University of Illinois College of Law, expected 2016. B.A. Sociology, B.A. Communication, summa cum laude, University of Illinois at Urbana-Champaign, 2013. I thank the editors of the Journal of Law, Technology, and Policy for their time and guidance in the creation of this piece.

**J.D. Candidate, University of Illinois College of Law, expected 2016. B.A. History, B.A. Speech Communication, University of Illinois at Urbana-Champaign, 2007. I would like to thank the editors for their time and attention to this piece.

[1] Sherry Kubanyi, New Technology Series: Be Part of the Steamroller—Not Part of the Road, Legaco Express, http://www.legaco.org/blog/new-technology-series-paralegal (last visited Apr. 6, 2014).

[2] What Is RFID?, RFID J., http://www.rfidjournal.com/faq/show?49 (last visited Apr. 6, 2014).

[3] Kristina M. Willingham, Scanning Legislative Efforts: Current RFID Legislation Suffers from Misguided Fears, 11 N.C. Banking Inst. 313, 314 (2007).

[4] All About Radio Frequency Identification (RFID), Nat’l Consumers League http://www.nclnet.org/technology/74-radio-frequency-identification/126-all-about-radio-frequency-identification-rfid (last visited Apr. 6, 2014).

[5] Jake Jones, Vatican To Begin Tracking Clergy and Employees with RFID Cards, Examiner (Dec. 2, 2012), http://www.examiner.com/article/vatican-to-begin-tracking-clergy-and-employees-with-rfid-cards.

[6] A.H. v. Northside Indep. Sch. Dist., 916 F. Supp. 2d 757, 762 (W.D. Tex. 2013).

[7] Pat Toensmeier, Report Predicts Major Growth in RFID Market, ThomasNet News (Oct. 28, 2013), http://www.thomasnet.com/journals/procurement/report-predicts-major-growth-in-rfid-market/.

[8] Marisa Anne Pagnattaro, Getting Under Your Skin-Literally: RFID in the Employment Context, 2008 U. Ill. J.L. Tech., & Pol’y 237, 238.

[9] Rachel Emma Silverman, Tracking Sensors Invade the Workplace: Devices on Workers, Furniture Offer Clues for Boosting Productivity, Wall St. J. (Mar. 7, 2013, 11:42 AM), http://online.wsj.com/news/articles/SB10001424127887324034804578344303429080678.

[10] Personnel Monitoring, Intelleflex, http://www.intelleflex.com/solutions.pm.asp (last visited Apr. 6, 2014).

[11] Citywatcher.com Requires Tagging of Employees, RFID Gazette (Feb. 13, 2006), http://www.rfidgazette.org/2006/02/citywatchercom_.html.

[12] What Is RFID System Attendance Monitoring System?, Biometric System, http://www.biometricsystem.in/Attendance-Recorder.html (last visited Apr. 6, 2014).

[13] Brooks Barnes, At Disney Parks, a Bracelet Meant to Build Loyalty (and Sales), N.Y. Times (Jan. 7, 2013), http://www.nytimes.com/2013/01/07/business/media/at-disney-parks-a-bracelet-meant-to-build-loyalty-and-sales.html.

[14] Id.

[15] Id.

[16] Cases: Nurse Study—Patient Outcomes, Sociometric Solutions, http://www.sociometricsolutions.com/cases.html (last visited Apr. 6, 2014).

[17] Claire Swedberg, IntelligentM Wristband Monitors Hand Hygiene, Vibrates to Provide Staff Alerts, RFID J. (Apr. 1, 2013), http://www.rfidjournal.com/articles/view?10558.

[18] Ben Waber, The Next Big Thing in Big Data: People Analytics, Bloomberg Businessweek (May 16, 2013), http://www.businessweek.com/printer/articles/117040-the-next-big-thing-in-big-data-people-analytics.

[19] Corey A. Ciocchetti, The Eavesdropping Employer: A Twenty-First Century Framework for Employee Monitoring, 48 Am. Bus. L.J. 285, 311 (2011).

[20] United States v. Jones, 132 S. Ct. 945, 947 (2012).

[21] State Statutes Relating to Radio Frequency Identification (RFID) and Privacy, Nat’l Conference State Legislatures (Dec. 20, 2013), http://www.ncsl.org/research/telecommunications-and-information-technology/radio-frequency-identification-rfid-privacy-laws.aspx.

[22] Id.

[23] Id.

[24] Seaborn Larson, Montana the First State To Pass Spy Law, Daily Inter Lake (July 8, 2013, 9:00 PM), http://www.dailyinterlake.com/news/local_montana/article_022211de-e81a-11e2-9d43-0019bb2963f4.html.

[25] H.B. 1199, 98th Gen. Assemb., 381st Sess. (Ill. 2013).

[26] H.B. 445, 2011 Sess. (N.H. 2012).

[27] H.B. 592, 2013 Sess. (N.H. 2013).

[28] Edward Balkovich, Tora K. Bikson & Gordon Bitko, Privacy in the Workplace: Case Studies on the Use of Radio Frequency Identification in Access Cards, Rand, http://www.rand.org/pubs/research_briefs/RB9107/index1.html (last visited Apr. 6, 2014).

[29] Id.