RFID, Privacy and the Perception of Risk A strateg

RFID,PrivacyandthePerceptionofRisk:AstrategicFrameworkFrédéricThiesseUniversityofSt.GallenAuto-IDLabsWhitePaperWP-BIZAPP-031Thisisthepreprintversiononly.Forthepublishedversionpleasesee:FrédéricThiesse“RFID,PrivacyandthePerceptionofRisk”JournalofStrategicInformationSystems16(2),pp.214-232,2007Contact:Auto-IDLabSt.Gallen/ZurichUniversityofSt.GallenDufourstr.40a9000St.GallenSwitzerlandPhone:[phone]Fax:[phone]E-Mail:[e-mail]&ApplicationsAbstractAgainstthebackgroundofthefirstRFID-RolloutsbylargeretailersinNorthAmericaandEurope,thispaperconcernsitselfwiththeperceptionofRFIDtechnologyasarisktoprivacy.Theobjectiveofourcontributionistoidentify,atarelativelyearlyphaseoftheriskdevelopment,strategicoptionswithwhichRFIDsuppliersanduserscanpositivelyinfluencethepublicacceptanceofthetechnology.WeproposeastrategicframeworkbasedonresearchfindingsonriskperceptionandtechnologyacceptanceaswellasasetofoptionsforcopingwiththepublicperceptionofRFID-relatedprivacyrisks.KeywordsRFID,Privacy,TechnologyAcceptance,RiskPerception1.Introduction1.1.PracticalRelevanceThetechnologiesofRadioFrequencyIdentification(RFID)enjoyanenormousinterestatthecurrenttime,notonlyfromthestandpointofresearchbutalsofromcorporatepractice.EnterprisesfromdiversebranchesarehopingforsolutionstoawiderangeofmanagementproblemsthroughRFID,fromsimpleincreasesinprocessingefficiencyforthereceiptanddespatchofgoodsindistributioncentresthroughtoimprovementsingoodsavailabilityontheshelvesandontothestruggleagainstshrinkageandproductcounterfeiting.However,overthepastfewyears,concernsaboutthepossiblerisksofusingRFIDhaveincreasinglybeenvoiced.TherisksassociatedwithRFIDthatarediscussedinthepublicincludeboththedirectimpactofelectromagneticradiationonhealth,aswellasindirecteconomicconsequencessuchastheeliminationofjobsthroughincreasingautomation(Duce,2003).ThemostfrequentlyvoicedfearreferstothemisuseofdatageneratedbyRFID,resultinginanundesirableintrusionintotheprivacyofindividuals.Thedebatehasbecomeadditionallyheatedthroughtheactionsandcampaignsofpressuregroups.Forexample,thewell-publicised“BigBrotherAward”giventotheMetroGroup,alongwithademonstrationinFebruary2004infrontoftheMetroFutureStore,causedtheretailertoultimatelywithdrawtheRFID-basedcustomercardsthatwereincirculationatthetime(AlbrechtandMcIntyre,2005).FurtherexamplesinEuropeandtheUS,suchasthecallforaboycottofGilletteproductsbecauseoftestswithRFIDtranspondersinrazorbladepackages,showthatthesearenotisolatedincidents.Thatthisprotestmovementcanbringaboutsuchsustainableeffects,whilstworkingwiththesimplestofmethods,permitsconclusionsregardingthesignificancethatdataprotectionandprivacyhaveachievedinthepopulaceasawhole.1.2.ResearchquestionandstructureThiscontributionconcernsitselfwiththequestionhowcompaniesshouldcopewithnegativepressreactionsandthecampaignsofvarioussocialgroupsinordertopositivelyinfluencethepublicperceptionofRFIDandthustopavethegroundforfutureapplicationsinretail,CPG,lifesciencesandotherindustries.Forthisreason,theprimaryaimsofthearticleare:(a)tousetheoryandresearchonriskperceptionandtechnologyacceptancetoanalysethedevelopmentofRFIDasariskissueand(b)toconsiderwaystominimisetheeffectofriskperceptionsonimplementationsofthetechnologyandconsumerbehaviour.Tomeettheseaimsthearticleisstructuredintofivesections.ItbeginswithashortoverviewofRFIDtechnology,itsrelevancetoprivacy,andtechnicalcountermeasuresproposedinotherworks.Thefollowingsectionprovidesareviewofthetheoreticalconceptsofrisk,trust,andtechnologyacceptanceaswellastheinterrelationsbetweenthem.Wecontinuewithananalysisofmedia-reportingaboutRFIDandreconstructthehistoryoftheRFIDrisksdebateoverthepastfewyears.Inanextstepweproposeatheory-basedframeworkforriskmanagementandproposeasetofstrategicoptions.Thecontributionendswithadiscussionofourapproachandanoutlookonfuturedevelopments.2.RFIDandPrivacy2.1.RFIDtechnologyandapplicationsRFIDisatechnologyfortheautomaticidentificationbyradioofphysicalobjectssuchasindustrialcontainers,palettes,individualproductsandalsopeople.Theidentificationeventtakesplaceovertransponderslocatedinorontherespectiveobjects,whichcanbeaddressedwithoutphysicalcontact,overtheso-calledairinterface,bytheantennaonascannerdevice.TypicalareasofapplicationforRFIDlie,adjacenttoclassicssuchasanimalidentificationoraccesscontrolsystems,aboveallinSupplyChainManagement,wherethetechnologymakespossiblesimplifiedgoodsturnover,automaticstockcontrolinthestoreroomresp.onthesalesfloor,theftprotection,producttrackingetc.(BoseandPal,2005).ThereasonfortherecentrapidandescalatinguseofRFIDliesprimarilyinadvancedminiaturisation,maturityaswellasintheconstantpricedeclinewhichmakestheuseofRFIDeconomicallyviableinevermoreareasofapplication(Byfield,1996;Sarma,2001;Want,2004).AnothertriggerhasbeenespeciallytheactivitiesoftheAuto-IDCenter,aprojectfoundedin1999attheMassachusettsInstituteofTechnology(MIT),incooperationwithnumerousindustrialsponsors,forthedevelopmentofRFIDStandards.ThemainresultoftheAuto-IDCenterwastheElectronicProductCod