CEN/TR 16674:2014

Information technology - Analysis of privacy impact assessment methodologies relevant to RFID

The scope of this Technical Report (TR) is to identify methodologies that are used for, or have been considered applicable to, wireless technologies. These methodologies are analyzed to identify features that are applicable to RFID.
Based on the Industry RFID PIA Framework endorsed by the Article 29 Data Protection Working Party, the Technical Report focuses on proposing risk analysis methodologies suitable for the data capture area of an RFID system. This includes the RFID tag, the interrogator, the air interface protocol used for communication between them, and the communication from the interrogator to the application.
The Technical Report also proposes risk management features based on the inherent capabilities of a number of RFID technologies that conform to standardized RFID air interface protocols. This should provide enough information to enable the proposed privacy control features to be applied to other RFID technologies including those with proprietary air interface protocols and tag architectures. The risk management features exclude fundamental privacy by design features because these should be the subject of revisions and enhancements to technology standards. The risk management features defined in this Technical Report are considered applicable to current and future implementations of RFID based on existing technology. As such, this Technical Report is considered as input into a standard procedure for undertaking an RFID Privacy Impact Assessment.

Informationstechnik - Analyse der RFID- Datenschutzfolgenabschätzung für spezifische Sektoren

Technologies de l’information - Analyse des méthodes d’évaluation de l’impact sur la vie privée adaptées à la RFID

Informacijska tehnologija - Analiza metodologij za ocenjevanje vpliva na zasebnost v povezavi z RFID

Področje uporabe tega tehničnega poročila je določevanje metodologij, ki se uporabljajo ali se obravnavajo kot ustrezne za uporabo z brezžičnimi tehnologijami. Z analizo teh metodologij se določi lastnosti, ki veljajo za RFID. Na podlagi industrijskega ogrodja ocenjevanja vpliva RFID na zasebnost, ki ga določa člen 29 Delovne skupine za varstvo podatkov, tehnično poročilo predvsem predlaga metodologije analize tveganja, ki so ustrezne za področje zajema podatkov v sistemu RFID. To vključuje oznako RFID, bralnik, protokol radijskega vmesnika, ki se uporablja za komunikacijo med njima, in komunikacijo med bralnikom in aplikacijo. Tehnično poročilo predlaga tudi lastnosti obvladovanja tveganja, ki temeljijo na zmogljivosti številnih tehnologij RFID, ki so v skladu s standardiziranimi protokoli radijskega vmesnika RFID. To naj bi zagotovilo dovolj informacij, ki bi omogočile, da se predlagane lastnosti nadzora zasebnosti uporabijo v drugih tehnologijah RFID, vključno s tistimi, ki imajo lastniške protokole radijskega vmesnika in arhitekture oznak. Lastnosti obvladovanja tveganja ne zajemajo temeljnih vgrajenih lastnosti, ker naj bi bile te predmet popravkov in izboljšav tehnoloških standardov. Lastnosti obvladovanja tveganja, ki jih določa to tehnično poročilo, se uporabljajo za dejanske in prihodnje uporabe RFID, ki temeljijo na obstoječi tehnologiji. Tako je to tehnično poročilo prispevek k standardnemu postopku za oceno vpliva RFID na zasebnost.

General Information

• Status: Published
• Publication Date: 03-Jun-2014
• ICS: 35.240.60 - IT applications in transport
• Technical Committee: CEN/TC 225 - AIDC technologies
• Drafting Committee: CEN/TC 225 - AIDC technologies
• Current Stage: 6060 - Definitive text made available (DAV) - Publishing
• Start Date: 04-Jun-2014
• Due Date: 25-Feb-2014
• Completion Date: 04-Jun-2014
• Mandate: M/436 - Standardisation mandate to the European Standardisation Organisation CEN, CENELEC and ETSI in the field of information and communication technologies applied to Radio Frequency Identification (RFID) and systems
• Ref Project: SIST-TP CEN/TR 16674:2014 - Information technology - Analysis of privacy impact assessment methodologies relevant to RFID

Standards Content (Sample)

SLOVENSKI STANDARD
SIST-TP CEN/TR 16674:2014
01-september-2014
Informacijska tehnologija - Analiza metodologij za ocenjevanje vpliva na
zasebnost v povezavi z RFID
Information technology - Analysis of privacy impact assessment methodologies relevant
to RFID
Informationstechnik - Analyse der RFID- Datenschutzfolgenabschätzung für spezifische
Sektoren
Technologie de l’information - Analyse des méthodes d’évaluation de l’impact sur la vie
privée adaptées à la RFID
Ta slovenski standard je istoveten z: CEN/TR 16674:2014
ICS:
35.040.50 Tehnike za samodejno Automatic identification and
razpoznavanje in zajem data capture techniques
podatkov
SIST-TP CEN/TR 16674:2014 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
SIST-TP CEN/TR 16674:2014

---------------------- Page: 2 ----------------------
SIST-TP CEN/TR 16674:2014

TECHNICAL REPORT
CEN/TR 16674

RAPPORT TECHNIQUE

TECHNISCHER BERICHT
June 2014
ICS 35.240.60
English Version
Information technology - RFID privacy impact assessment
analysis for specific sectors
Technologies de l'information - Analyse des méthodes Informationstechnik - Analyse der RFID-
d'évaluation de l'impact sur la vie privée adaptées à la RFID Datenschutzfolgenabschätzung für spezifische Sektoren


This Technical Report was approved by CEN on 20 January 2014. It has been drawn up by the Technical Committee CEN/TC 225.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.





EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2014 CEN All rights of exploitation in any form and by any means reserved Ref. No. CEN/TR 16674:2014 E
worldwide for CEN national Members.

---------------------- Page: 3 ----------------------
SIST-TP CEN/TR 16674:2014
CEN/TR 16674:2014 (E)
Contents Page

Foreword .4
Introduction .5
1 Scope .6
2 Terms and definitions .6
3 Symbols and abbreviations .7
4 Risk analysis for wireless RFID communications and RFID devices .8
4.1 Introduction .8
4.2 RFID technologies .8
4.3 The RFID system architecture .9
4.4 The challenge of having millions of readers in the hands of individuals . 10
4.5 Lessons from the risk environment concerning wireless networks . 11
4.6 Conclusion and a way forward . 13
5 The relationship of the RFID PIA process and methodologies standards to the privacy law . 14
5.1 Privacy requirements . 14
5.2 Definitions . 16
5.2.1 General . 16
5.2.2 Five types of privacy . 17
5.2.3 Personal data .
...

SLOVENSKI STANDARD
SIST-TP CEN/TR 16674:2014
01-september-2014
Informacijska tehnologija - Analiza metodologij za ocenjevanje vpliva na
zasebnost v povezavi z RFID
Information technology - Analysis of privacy impact assessment methodologies relevant
to RFID
Informationstechnik - Analyse der RFID- Datenschutzfolgenabschätzung für spezifische
Sektoren
Technologie de l’information - Analyse des méthodes d’évaluation de l’impact sur la vie
privée adaptées à la RFID
Ta slovenski standard je istoveten z: CEN/TR 16674:2014
ICS:
35.020 Informacijska tehnika in Information technology (IT) in
tehnologija na splošno general
SIST-TP CEN/TR 16674:2014 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST-TP CEN/TR 16674:2014

---------------------- Page: 2 ----------------------

SIST-TP CEN/TR 16674:2014

TECHNICAL REPORT
CEN/TR 16674

RAPPORT TECHNIQUE

TECHNISCHER BERICHT
June 2014
ICS 35.240.60
English Version
Information technology - RFID privacy impact assessment
analysis for specific sectors
Technologies de l'information - Analyse des méthodes Informationstechnik - Analyse der RFID-
d'évaluation de l'impact sur la vie privée adaptées à la RFID Datenschutzfolgenabschätzung für spezifische Sektoren


This Technical Report was approved by CEN on 20 January 2014. It has been drawn up by the Technical Committee CEN/TC 225.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.





EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2014 CEN All rights of exploitation in any form and by any means reserved Ref. No. CEN/TR 16674:2014 E
worldwide for CEN national Members.

---------------------- Page: 3 ----------------------

SIST-TP CEN/TR 16674:2014
CEN/TR 16674:2014 (E)
Contents Page

Foreword .4
Introduction .5
1 Scope .6
2 Terms and definitions .6
3 Symbols and abbreviations .7
4 Risk analysis for wireless RFID communications and RFID devices .8
4.1 Introduction .8
4.2 RFID technologies .8
4.3 The RFID system architecture .9
4.4 The challenge of having millions of readers in the hands of individuals . 10
4.5 Lessons from the risk environment concerning wireless networks . 11
4.6 Conclusion and a way forward . 13
5 The relationship of the RFID PIA process and methodologies standards to the privacy law . 14
5.1 Privacy requirements . 14
5.2 Definitions . 16
5.2.1 General . 16
5.2.2 Five types of privacy . 17
5.2.3 Personal data . 18
5.2.4
...