CCTV is not the only form of ubiquitous observation going on, there is increased use of Radio Frequency Identification (“RFID”) tagging.
RFID tagging is increasingly being used on individual products (rather than the former pallet level) and raises the possibility that a person wearing or carrying a tagged product could be tracked where suitable RFID tag readers are deployed and a pattern of their movements and purchasing habits build up from the records.
As the records would not, by themselves, be capable of identifying the individual (save by the shop which sold the tagged products, which might hold personal data about the person such as credit card details), this information would not be the subject of data protection laws, would not be confidential and would not require the individual’s consent regarding how it is processed.
However, once sufficient data has been collected it can be used to establish patterns and target the individual for advertising or other purposes. If the individual is identifiable, is this then personal data? At what point does it become personal data?
There seems to be a current gap in the law with regard to RFID. Once again, data protection laws are subject to the charge of failing to keep pace with technology. We will be watching to see how these types of technological advancement are addressed in 2011.