Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN), a consumer privacy group founded by Katherine Albrecht, has been quiet for the past few years. But last week, the group issued a "Position Paper on the Use of RFID in Schools, " in cooperation with the Electronic Privacy Information Center and the Privacy Rights Clearinghouse. The document has been endorsed by the American Civil Liberties Union, the Electronic Frontier Foundation and other groups.
One goal is to automate attendance taking and make the process more accurate. Another is to ensure students' safety. In the event of an evacuation, for instance, RFID could quickly and reliably confirm that every student and teacher had left the building.
The position paper does not point out any benefits. Instead, it provides some background about RFID and spells out "threats to privacy and civil liberties in schools. " Most of the threats outlined seem overblown, however. One cited example of the technology's supposed potential to inhibit free association is that "Students might avoid seeking counsel when they know their
RFID tags will document their presence at locations like counselor and School Resource Officer (SRO) offices. " I'm not sure why going to see a counselor would be considered controversial (though what a student discussed there might be); in any case, it's likely that such visits would be documented regardless of whether or not RFID tags were in use.
One example given of how the technology might be abused by those outside a school's employ is that "A student's location could be monitored from a distance by a jealous girlfriend or boyfriend, stalker, or pedophile. " But RFID technology is relatively short-range, which means a stalker would either need to set up readers everywhere that a student might conceivably go, in order to be able to read his or her tag, or follow that child very closely with an interrogator. If the predator were already closely following that student, why would an RFID reader even be necessary?
That said, I don't want to trivialize the paper's overall intent, which is to raise awareness of issues surrounding RFID's use in schools. I do agree with some elements of "the framework of RFID Rights and Responsibilities in Schools" outlined in the document. For instance, it says, "RFID implementations must be guided by Principles of Fair Information Practice. "
In fact, this was a hard-learned lesson for technology providers. Currently, according to those interviewed for our story "RFID Goes to School, " educating parents, teachers and older children is key to successfully deploying an RFID solution within schools to automate attendance taking and/or ensure children's safety.
The position paper claims that "RFID systems proposed must undergo a formal safety, technology, and privacy impact assessment, and schools should not implement RFID systems until this assessment takes place. " Broadly speaking, I agree. But I don't think every school should have to test the safety of every new deployment—if a system has already been deemed safe for use around humans by a credible organization, then schools should be allowed to use it.
I do agree that a privacy assessment is reasonable. Schools should, as a matter of good practice, have clearly defined rules regarding how the technology will be used, how long information will be stored, who will have access to that data and so forth. This should be part of a privacy assessment to ensure that the system is not used in unintended and perhaps unscrupulous ways.
The biggest problem I have with the proposal, though, comes under the heading of "Prohibited RFID Practices. " I take issue with the proposed requirement that both a student and his or her parents offer their consent before a school can track that child via RFID. Should students be consulted about whether they can be forced to attend math class? We, as parents, make decisions for our kids. If I felt my sons' school had a legitimate reason to track them via RFID, and that it was to their benefit, I would not want them to have the ability to opt out. If half of the kids opted out, the system would become worthless. (Some kids who are perpetually late for school, for example, or who like to cut classes, would probably want no part of such a program. )#)
The prohibited-practices section states, "Unless they opt into RFID systems, individuals should not be required to carry or interact with RFID-tagged objects. " I understand CASPIAN's concern that students who opted out could still be tracked using the tagged objects they carried, but it makes no sense to say that students who opt out should not be required to interact with tagged objects. What if the school decides to tag all laptops or library books for the purpose of better managing these items? It would make more sense to mandate that if a student's parents opted out, that child could not be tracked via an RFID-enabled ID badge or RFID-tagged object.
Parents might well disagree about whether RFID is required for taking attendance, or whether they want their kids being tracked wherever they go in school. But if a school does implement the technology, it should inform parents of precisely how the solution will be used, abide by the Principles of Fair Information Practice, and take steps to ensure that the system is not abused.
