You are here: Resources > FIDIS Deliverables > HighTechID > D12.3: A Holistic Privacy Framework for RFID Applications > 
(S3) Scenario 3: An Identity Manager for RFID Tags  Title:


Scenarios from D7.7

(S4) Case study: the Metro Future Store in Rheinberg

Martin Meints (ICPP) 


In Rheinberg, Germany, the Metro group as the third largest retailer in the world runs the so-called “Future Store”, in which the use of RFID is being tested. The testing exceeds the use of RFID tags* in the supply chain, as the tags are used directly in the shop at least with a selected number of products. Functions and services that use (or plan to use) RFID are:

  1. Smart shelves within the store for automated positioning of products and automated orders in case a certain number of products of a certain type falls short of the predefined number  

  2. Smart weighing machines which automatically detect the product and calculate the price 

  3. Electronic price tags at the shelves 

  4. Info terminals, similar to those using barcodes 

  5. Advertisement screens showing videos to advertise products 

  6. Intelligent shopping trolleys (integrating the so-called personal shopping assistants; this assistant works together with the customer loyalty card and allows to check the bonus account, displays information about products and advertisements received via WLAN)  

  7. Automated teller systems 

In addition to the improvements of the logistic chain and better services within the shop also customer loyalty cards with hidden RFID tags* were issued to the customers until April 2004. In combination with hidden readers* in the store they were used to do personalised profiling on the customers, using the loyalty card. In addition, adjustment of offers to the wishes and needs of the customers is a defined purpose for which this card is used. While this additional purpose was part of the declaration of consent within the contract of the customer loyalty card, the users were not informed about the use of RFID tags* in the cards and corresponding readers* issued at the “Future Store”.

Other interesting aspects of this pilot project are technical abilities of the shopping assistant, a tablet PC integrated into the shopping trolley manufactured by Wincor Nixdorf International. They enable multi-channel retail, including the following functions: “The shopping assistant tracks the shoppers’ movement using wireless LAN software from Saratoga, Calif.-based Ekahau and displays location-specific personalised shopping lists, favourites and special offers. The system can offer discounts on items related to those put in the cart. It can also trigger in-store signs. So if the shopper puts Pringles in the cart, an ad for Coca-Cola might be displayed. Shoppers who scan all their items can have the information communicated to a cash register wirelessly and checkout quickly.”

While it is documented that hidden RFID tags* in the customer loyalty cards were used to activate advertisement displays showing video clips, it is not clear whether this was used in the way described above. After the RFIDs in the customer loyalty cards were uncovered by the consumer protection organisations CASPIAN and FoeBuD,, the Metro group withdrew these cards and issued traditional ones. Given the ability of the shopping assistant to read traditional customer loyalty cards (via magnetic stripes or barcodes), profiling of customers is still done and adopting advertisements on displays is technically and legally possible.

Comment: Note that it is still possible to do personal profiling without explicit identifiers like loyalty cards. The Art.29 working party gives the following example in : “A further example could be where the use of RFID tags can lead to the processing of personal data, even when RFID technology does not involve the use of other explicit identifiers. Take the hypothesis where person Z walks into Shop C with a bag and the products in it (more likely a jumble of numbers) are revealed. Shop C keeps a record of the numbers. When person Z returns to the shop the next day, he is rescanned. Product Y, that was scanned yesterday, is revealed today – the number is for the watch he always wears. Shop C sets up a file using the number of product Y as a ‘key’. This allows them to track when Person Z enters their shop, using the RFID number of his watch as a reference number for him. This allows shop C to set up a profile of Person Z (whose name they don’t know) and to track what he has in his shopping bag on subsequent visits to Shop C. By doing this, Store C is processing personal data and data protection law will apply”. This example also illuminates that the distinction between personal and non personal data becomes more blurred and that the context is becoming an increasingly more important factor when deciding if data is personal or not.

(S5) Case-study: Usage of RFID Technology in Educational Settings

Denis Royer (JWG) 

Besides the many applications of RFID technology in logistics and other related fields, end-user scenarios for educational settings (e.g. museums and exhibitions) are also possible usage scenarios. By adding RFID tags* and RFID readers* to the exhibits, new possibilities with regard to interactive presentation and augmented experience for the visitors arise. Until today, over a hundred museums worldwide are experimenting with ubiquitous technologies (RFID, WiFi, etc) in their exhibitions .

From the technological perspective, an RFID enhanced educational environment is presented in Figure 1: At the start of his museum visit, the visitor gets an RFID token (e.g. as a card or embedded into a personal information device). Furthermore, he enrols himself, by storing a user profile into the museums RFID infrastructure. This profile can contain personal information, such as personal interests or the user’s age (; ). When passing an exhibit, the user can use the RFID tag* to acquire personalised information about the individual exhibit or trigger the interactive part of an exhibit, when getting into its proximity.

Depending on the individual context of the visitor and the stored profile, personalised information is delivered onto an information kiosk, being attached directly to the exhibit, or onto the user’s personal information device. Additionally, the system can track the visitor by taking photos and delivering additional resources. After the museum visit, these can be accessed on a personalised webpage on the Internet .

Figure : Possible usage scenario for RFID technology in educational settings


Furthermore, the exhibitors get the opportunity to track the behaviour of their visitors, in order to enhance the exhibition or in order to gather information about the success of the installed exhibits. While this approach can be beneficial for both parties (visitor, exhibitor) by delivering information that could not be gathered by a static exhibition, usability and privacy protection requirements need to be addressed. Especially with regard to the perceived risk of RFID technology, users might not want to use this kind of technology to be tracked when visiting a museum .


(S6) RFID at the CVS Corporation

Martin Meints (ICPP) 

The CVS Corporation, listed at the New York Stock Exchange (NYSE), is the – based on store count – largest pharmacy chain in the United States with 4087 stores. Since May 2002 CVS joined the Auto-ID Center at Massachusetts Institute of Technology (MIT) and began in 2003 with the so-called project “Jump Start” (: 201ff.). Target of this project is a full-scale trial of RFID on 10 selected drugs.


There are a number of reasons that CVS involved in RFID. Main reasons are: 

  1. Pharmaceuticals are different from other consumer products such as, e.g., razor blades:  

    1. They are high value goods. 

    2. They sometimes have a very long shelf time (up to three or four years before they are sold). 

    3. In the United States tamper-proofness of pharmaceuticals in the logistic chain and the shops is an issue since the Tylenol scandal in 1982, where Tylenol was adulterated with cyanide and as a consequence a number of consumers died.  

  2. Up to 2002 the EPC* global has not addressed the specific needs of the pharmaceutical industry including

    1. Integrating the so far separate National Drug Codes (barcodes) into the EPC*; 

    2. The need for privacy in the health care sector and 

    3. The regulatory requirements defined by the U.S. Food and Drug Administration (FDA). 


CVS is testing RFID on a per item basis. Drug bottles are RFID tagged* and transported using standard boxes which are also tagged. There are a number of potential improvements in processes that are tested at CVS. The most important are: 

  1. Improvement of drug management at the manufacturer and in the distribution centres of CVS; errors in the delivery such as wrong types or numbers of drugs can be detected easily; 

  2. Improvement in drug management in the stores; the central systems know how many goods are left in the smart shelves even in cases where they are at the wrong place in the shelf (supply management); 

  3. Improved handling of outdates, recalls, returns and damages; 

  4. EPC* stored on RFID can be used to detect certain types of mistakes or manipulations of drugs for example in cases where already used or cloned RFID tags* are used. 


The project comes along with a number of technical innovations. A number of improvements with respect to reader* technology, such as multiple antennas for one reader*or the swivelling of boxes when they pass the reader*, were applied. But accuracy of the reading process still is a problem. Further testing for example of two-way tags that act as a proxy for tags transmitting EPCs* is needed.  

CVS does not hand out drugs tagged with RFID to consumers for privacy reasons. Tags are removed in the shop. To ease this, special tags with a perforation to remove the tag from the adhesive pad are used. 

(S7) Scenario for social inclusion

Sabine Delaitre (IPTS) 

In the framework of the European accessibility policy, the city of Milan (Italy) did some public investments in a navigation support system based on RFID technology so as to equip some administrative buildings of the city. This system will allow disabled people or people with impairment to become self-sufficient and to have access to the different offices. 

During the first usage period, some problems occurred without damages. However, one day, because of tag-collisions, some people got lost and one person has suffered substantial damages. He broke his leg by missing some steps of a staircase. According to the device he thought that he was on the second floor, but in reality he was on the third one and regrettably, on the second floor there is a staircase with lesser steps then on the third floor. After this incident, it was decided to replace all reader* devices by a new type of reader*, comparable to the “agile reader” in order to solve the collisions problem.

In order to forget this regrettable incident and stimulate the future users, the newspaper “Periodico di Milano” wishes to publish an article on the new system by interviewing people.  

Two friends, one blind and another one with low vision capability are very happy with the new navigation support system. They are able without human assistance to reach any room, any place inside the buildings and relate us their impression: 

“Before, it was very difficult to progress in a building without a good knowledge of it because most of the signalisation is graphical (even for the toilets). And even if the lifts have in general a Braille conversion of the information related to the floors only very few are equipped with a voice-based interface to indicate you where you are, in the fourth floor or another one selected by other person.

Now thanks to the navigation system, we are independent and we can move in complete freedom and safety. It is easy: at the entrance of the building a small device is offered and helps us to progress in the building. This device communicates with all RFID sensors* and indicates you by voice interface the right path to follow.”


(S3) Scenario 3: An Identity Manager for RFID Tags  fidis-wp12-d12.3_Holistic_Privacy_Framework_for_RFID_Applications.sxw  Summary
11 / 38