CEN/TR 16674:2014

Information technology - Analysis of privacy impact assessment methodologies relevant to RFID

The scope of this Technical Report (TR) is to identify methodologies that are used for, or have been considered applicable to, wireless technologies. These methodologies are analyzed to identify features that are applicable to RFID.
Based on the Industry RFID PIA Framework endorsed by the Article 29 Data Protection Working Party, the Technical Report focuses on proposing risk analysis methodologies suitable for the data capture area of an RFID system. This includes the RFID tag, the interrogator, the air interface protocol used for communication between them, and the communication from the interrogator to the application.
The Technical Report also proposes risk management features based on the inherent capabilities of a number of RFID technologies that conform to standardized RFID air interface protocols. This should provide enough information to enable the proposed privacy control features to be applied to other RFID technologies including those with proprietary air interface protocols and tag architectures. The risk management features exclude fundamental privacy by design features because these should be the subject of revisions and enhancements to technology standards. The risk management features defined in this Technical Report are considered applicable to current and future implementations of RFID based on existing technology. As such, this Technical Report is considered as input into a standard procedure for undertaking an RFID Privacy Impact Assessment.

Informationstechnik - Analyse der RFID- Datenschutzfolgenabschätzung für spezifische Sektoren

Technologies de l’information - Analyse des méthodes d’évaluation de l’impact sur la vie privée adaptées à la RFID

Informacijska tehnologija - Analiza metodologij za ocenjevanje vpliva na zasebnost v povezavi z RFID

Področje uporabe tega tehničnega poročila je določevanje metodologij, ki se uporabljajo ali se obravnavajo kot ustrezne za uporabo z brezžičnimi tehnologijami. Z analizo teh metodologij se določi lastnosti, ki veljajo za RFID. Na podlagi industrijskega ogrodja ocenjevanja vpliva RFID na zasebnost, ki ga določa člen 29 Delovne skupine za varstvo podatkov, tehnično poročilo predvsem predlaga metodologije analize tveganja, ki so ustrezne za področje zajema podatkov v sistemu RFID. To vključuje oznako RFID, bralnik, protokol radijskega vmesnika, ki se uporablja za komunikacijo med njima, in komunikacijo med bralnikom in aplikacijo. Tehnično poročilo predlaga tudi lastnosti obvladovanja tveganja, ki temeljijo na zmogljivosti številnih tehnologij RFID, ki so v skladu s standardiziranimi protokoli radijskega vmesnika RFID. To naj bi zagotovilo dovolj informacij, ki bi omogočile, da se predlagane lastnosti nadzora zasebnosti uporabijo v drugih tehnologijah RFID, vključno s tistimi, ki imajo lastniške protokole radijskega vmesnika in arhitekture oznak. Lastnosti obvladovanja tveganja ne zajemajo temeljnih vgrajenih lastnosti, ker naj bi bile te predmet popravkov in izboljšav tehnoloških standardov. Lastnosti obvladovanja tveganja, ki jih določa to tehnično poročilo, se uporabljajo za dejanske in prihodnje uporabe RFID, ki temeljijo na obstoječi tehnologiji. Tako je to tehnično poročilo prispevek k standardnemu postopku za oceno vpliva RFID na zasebnost.

General Information

• Status: Published
• Publication Date: 03-Jun-2014
• ICS: 35.240.60 - IT applications in transport
• Technical Committee: CEN/TC 225 - AIDC technologies
• Drafting Committee: CEN/TC 225 - AIDC technologies
• Current Stage: 6060 - Definitive text made available (DAV) - Publishing
• Start Date: 04-Jun-2014
• Due Date: 25-Feb-2014
• Completion Date: 04-Jun-2014
• Mandate: M/436 - Standardisation mandate to the European Standardisation Organisation CEN, CENELEC and ETSI in the field of information and communication technologies applied to Radio Frequency Identification (RFID) and systems
• Ref Project: SIST-TP CEN/TR 16674:2014 - Information technology - Analysis of privacy impact assessment methodologies relevant to RFID

Standards Content (Sample)

SLOVENSKI STANDARD
01-september-2014
Informacijska tehnologija - Analiza metodologij za ocenjevanje vpliva na
zasebnost v povezavi z RFID
Information technology - Analysis of privacy impact assessment methodologies relevant
to RFID
Informationstechnik - Analyse der RFID- Datenschutzfolgenabschätzung für spezifische
Sektoren
Technologie de l’information - Analyse des méthodes d’évaluation de l’impact sur la vie
privée adaptées à la RFID
Ta slovenski standard je istoveten z: CEN/TR 16674:2014
ICS:
35.040.50 Tehnike za samodejno Automatic identification and
razpoznavanje in zajem data capture techniques
podatkov
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

TECHNICAL REPORT
CEN/TR 16674
RAPPORT TECHNIQUE
TECHNISCHER BERICHT
June 2014
ICS 35.240.60
English Version
Information technology - RFID privacy impact assessment
analysis for specific sectors
Technologies de l'information - Analyse des méthodes Informationstechnik - Analyse der RFID-
d'évaluation de l'impact sur la vie privée adaptées à la RFID Datenschutzfolgenabschätzung für spezifische Sektoren

This Technical Report was approved by CEN on 20 January 2014. It has been drawn up by the Technical Committee CEN/TC 225.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2014 CEN All rights of exploitation in any form and by any means reserved Ref. No. CEN/TR 16674:2014 E
worldwide for CEN national Members.

Contents Page
Foreword .4
Introduction .5
1 Scope .6
2 Terms and definitions .6
3 Symbols and abbreviations .7
4 Risk analysis for wireless RFID communications and RFID devices .8
4.1 Introduction .8
4.2 RFID technologies .8
4.3 The RFID system architecture .9
4.4 The challenge of having millions of readers in the hands of individuals . 10
4.5 Lessons from the risk environment concerning wireless networks . 11
4.6 Conclusion and a way forward . 13
5 The relationship of the RFID PIA process and methodologies standards to the privacy law . 14
5.1 Privacy requirements . 14
5.2 Definitions . 16
5.2.1 General . 16
5.2.2 Five types of privacy . 17
5.2.3 Personal data . 18
5.2.4 Processing . 18
5.2.5 Processor . 18
5.2.6 Controller . 18
5.2.7 Data security . 18
5.2.8 Data minimization . 19
5.2.9 Purpose binding . 20
5.2.10 Openness . 21
5.2.11 Individual Access. 21
5.2.12 Consent . 21
5.2.13 Limiting Use, Disclosure and Retention . 23
5.2.14 Accuracy . 23
5.2.15 Unique identifiers. 23
5.2.16 Accountability . 23
5.2.17 RFID operator . 24
5.3 Accountable Technology . 24
5.4 Applying Data Protection Concepts in practice . 24
5.5 Technical/business considerations . 25
6 RFID and personal information . 25
6.1 DPD . 25
6.2 Personal information written in a tag . 25
6.3 Unique identifier . 25
6.4 Tracking and profiling . 26
6.5 Proportionality of wearable RFID tags . 26
6.6 Technical issues with unknown legal consequences. 27
7 Standards organizations and risk management standards . 27
7.1 Standards organizations . 27
7.2 Risk management standards . 28
7.2.1 General . 28
7.2.2 AS/NZS 4360 . 29
7.2.3 BS7799 (ISO17799) . 29
7.2.4 NIST SP 800-30 . 29
7.2.5 RFRM . 29
7.2.6 COBIT . 30
7.2.7 HIPAA . 30
7.2.8 ITIL . 31
7.2.9 ISMS . 31
7.2.10 ISO/IEC 27001 . 31
7.2.11 ISO/IEC 27002 . 31
7.2.12 ISO/IEC 27005 . 31
7.2.13 ISO TR 13335 . 31
8 Legal supported PIA methodology . 32
8.1 Background information . 32
8.2 Analysis of five PIAs . 34
8.3 Findings . 34
8.3.1 The application operator perspective . 34
8.3.2 The consumer and public interest perspective . 35
8.4 Audit report on the use of wireless technologies . 36
9 Proposed methodologies for RFID PIA process . 36
9.1 Initial Decision Tree . 36
9.2 Critique on the initial decision tree . 37
9.3 Relevance of the 2011 RFID PIA Framework . 38
9.3.1 General . 38
9.3.2 Framework reviews by others . 38
9.3.3 Scope of work for the 2011 RFID PIA Framework . 38
10 The reasoning for addressing the privacy assessment at the periphery for RFID. 41
10.1 The role played by RFID in the lives of individuals . 41
10.1.1 The nature of RFID possession by individuals . 41
10.1.2 The degree of exposure to RFID risks . 41
10.2 Where RFID technology is the determining factor for privacy assessment . 42
10.2.1 The Privacy assessment technology layers . 42
10.2.2 The role of RFID technology in privacy assessment . 43
10.3 Privacy assets . 43
11 The case for a cost-effective PIA process . 44
11.1 Templates . 44
11.2 Understanding the technology . 45
11.3 Monitoring RFID threats and vulnerabilities . 45
11.4 Assisting th
...

SLOVENSKI STANDARD
01-september-2014
Informacijska tehnologija - Analiza metodologij za ocenjevanje vpliva na
zasebnost v povezavi z RFID
Information technology - Analysis of privacy impact assessment methodologies relevant
to RFID
Informationstechnik - Analyse der RFID- Datenschutzfolgenabschätzung für spezifische
Sektoren
Technologie de l’information - Analyse des méthodes d’évaluation de l’impact sur la vie
privée adaptées à la RFID
Ta slovenski standard je istoveten z: CEN/TR 16674:2014
ICS:
35.020 Informacijska tehnika in Information technology (IT) in
tehnologija na splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

TECHNICAL REPORT
CEN/TR 16674
RAPPORT TECHNIQUE
TECHNISCHER BERICHT
June 2014
ICS 35.240.60
English Version
Information technology - RFID privacy impact assessment
analysis for specific sectors
Technologies de l'information - Analyse des méthodes Informationstechnik - Analyse der RFID-
d'évaluation de l'impact sur la vie privée adaptées à la RFID Datenschutzfolgenabschätzung für spezifische Sektoren

This Technical Report was approved by CEN on 20 January 2014. It has been drawn up by the Technical Committee CEN/TC 225.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United
Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2014 CEN All rights of exploitation in any form and by any means reserved Ref. No. CEN/TR 16674:2014 E
worldwide for CEN national Members.

Contents Page
Foreword .4
Introduction .5
1 Scope .6
2 Terms and definitions .6
3 Symbols and abbreviations .7
4 Risk analysis for wireless RFID communications and RFID devices .8
4.1 Introduction .8
4.2 RFID technologies .8
4.3 The RFID system architecture .9
4.4 The challenge of having millions of readers in the hands of individuals . 10
4.5 Lessons from the risk environment concerning wireless networks . 11
4.6 Conclusion and a way forward . 13
5 The relationship of the RFID PIA process and methodologies standards to the privacy law . 14
5.1 Privacy requirements . 14
5.2 Definitions . 16
5.2.1 General . 16
5.2.2 Five types of privacy . 17
5.2.3 Personal data . 18
5.2.4 Processing . 18
5.2.5 Processor . 18
5.2.6 Controller . 18
5.2.7 Data security . 18
5.2.8 Data minimization . 19
5.2.9 Purpose binding . 20
5.2.10 Openness . 21
5.2.11 Individual Access. 21
5.2.12 Consent . 21
5.2.13 Limiting Use, Disclosure and Retention . 23
5.2.14 Accuracy . 23
5.2.15 Unique identifiers. 23
5.2.16 Accountability . 23
5.2.17 RFID operator . 24
5.3 Accountable Technology . 24
5.4 Applying Data Protection Concepts in practice . 24
5.5 Technical/business considerations . 25
6 RFID and personal information . 25
6.1 DPD . 25
6.2 Personal information written in a tag . 25
6.3 Unique identifier . 25
6.4 Tracking and profiling . 26
6.5 Proportionality of wearable RFID tags . 26
6.6 Technical issues with unknown legal consequences. 27
7 Standards organizations and risk management standards . 27
7.1 Standards organizations . 27
7.2 Risk management standards . 28
7.2.1 General . 28
7.2.2 AS/NZS 4360 . 29
7.2.3 BS7799 (ISO17799) . 29
7.2.4 NIST SP 800-30 . 29
7.2.5 RFRM . 29
7.2.6 COBIT . 30
7.2.7 HIPAA . 30
7.2.8 ITIL . 31
7.2.9 ISMS . 31
7.2.10 ISO/IEC 27001 . 31
7.2.11 ISO/IEC 27002 . 31
7.2.12 ISO/IEC 27005 . 31
7.2.13 ISO TR 13335 . 31
8 Legal supported PIA methodology . 32
8.1 Background information . 32
8.2 Analysis of five PIAs . 34
8.3 Findings . 34
8.3.1 The application operator perspective . 34
8.3.2 The consumer and public interest perspective . 35
8.4 Audit report on the use of wireless technologies . 36
9 Proposed methodologies for RFID PIA process . 36
9.1 Initial Decision Tree . 36
9.2 Critique on the initial decision tree . 37
9.3 Relevance of the 2011 RFID PIA Framework . 38
9.3.1 General . 38
9.3.2 Framework reviews by others . 38
9.3.3 Scope of work for the 2011 RFID PIA Framework . 38
10 The reasoning for addressing the privacy assessment at the periphery for RFID. 41
10.1 The role played by RFID in the lives of individuals . 41
10.1.1 The nature of RFID possession by individuals . 41
10.1.2 The degree of exposure to RFID risks . 41
10.2 Where RFID technology is the determining factor for privacy assessment . 42
10.2.1 The Privacy assessment technology layers . 42
10.2.2 The role of RFID technology in privacy assessment . 43
10.3 Privacy assets . 43
11 The case for a cost-effective PIA process . 44
11.1 Templates . 44
11.2 Understanding the technology . 45
11.3 Monitoring RFID threats and vulnerabilities . 45
11.4 Assisting the SME PIA proce
...