Introduction
Event management systems involve the optimization of the planning and implementation of various events. RFID bands are the most widely used technology for human flow management and automation of a number of site processes. RFID bands help reduce event costs and also provide access to information that can be used in various ways. In particular, the technology allows the introduction of contactless payment and fast authorization, which significantly reduces queues. However, this tool assumes a number of privacy and security concerns, including the possibility of personal data leakage.
Analysis
Chosen Use Case
The use case for the report is chosen adults at trade shows. In recent years, RFID bands have been actively used to improve the quality of event data management, as they provide a number of useful features. First of all, the technology allows optimizing the entrance of participants to such events, significantly reducing the scanning time at the entrance (8 benefits of using RFID, n.d). Observing the traffic and movement patterns of people can also help transform the site to suit their needs. This is important when calculating resources since “the food and beverage counts hosts receive from caterers are often inaccurate” (RFID at trade shows, n.d). By assessing the flow of people at the event, one can fix mistakes as quickly as possible or notice key aspects for future events.
It is also crucial that RFID bands provide a contactless payment option for purchasing goods at the event site. This aspect has a great positive impact on trade since cashless transactions tend ” Additionally, the technology allows attendees to be “involved in clever activation campaigns “to encourage patrons to spend more (up to 30%!)” (The beginner’s guide, 2018). RFID bands provide benefits for event attendees, not only for organizers, including better communication with sponsors and each other (Bowler, 2016). However, this technology provides sponsors and organizers with data collection tools that can be used not only to optimize the event but also in future product development.
Types of Personal Data
With regard to working with personal data, it is important to pay attention to how the classification of its types occurs. In particular, there is a distinction between personally identified and non-identified data (Karygiannis et al., 2007). Personal information includes an “individual’s full name, social security number, passport number, financial account or credit card numbers, and biometric data such as fingerprints” (p. 91). However, such data as gender, religious beliefs, city of residence, and others are not considered as personal, as they are common to many people. Nevertheless, the combination of such personally unidentified data can still characterize a specific person, which makes them private. Thus, when working with RFID, it is necessary to take into account both direct and indirect identification obtained through personal data.
The use of RFID bands in trade shows is to track people’s activity and collect various types of information. First of all, the technology predominantly uses tracking information about the event attendee. This type of information involves tracking the location of a person on the site to generate statistics on the human flow and track patterns of their movements. This type of information can also include contact details such as name, email address, and phone number (Tappit launches new RFID, 2019). Such data is most relevant for children’s events but can also be used on trade shows to locate individuals or groups. External information collected by RFID bands includes identification, behavioral and demographic data. The internal information that the technology collects includes preconceptions, which are especially well tracked through the participation of attendees in activities. RFID bands are also involved in the collection of financial data, as it involves the use of contactless payments. In particular, this type can include information about transactions and a person’s bank account.
Finally, the technology also collects social information about attendees, as it tracks social networking and human communication at the event venue. This type can also include professional information, which also plays a significant role in the formation of statistical reports. Thus, all collected, stored, and transmitted data is solely related to the description of aspects related to the event and the relationship between sponsors and attendees. RFID bands can either be personalized and use the profile of the attendee preloaded on the device, or they can act as a digital key and use the information stored in the database (Bennett, 2013). This aspect raises concerns related to the reliability of the safety of personal data that may be collected and transmitted.
Compliance Issues
For the implementation of the technology in the framework of public events and exhibitions, RFID must be compliant with various regulations. First and foremost, the use of the technology must be consistent with RFID usage policies, which can include a range of different regulations. The most significant issue is compliance with technical specifications, which “address privacy issues associated with the tag identifier formats and the potential disclosure of information based solely on the tag identifier format selected” (Karygiannis et al., 2007, p. 64). Therefore, the use of RFID bands on trade shows must meet technical requirements regulated by various documents.
The second most important compliance issue is the need to ensure IT security in accordance with the protocols. This aspect includes “network, database and application security in the enterprise and inter-enterprise subsystems” (Karygiannis et al., 2007, p. 64). Thus, within the framework of the event, it is necessary not only to use certified technology but also to ensure the privacy of data throughout the site. This requirement implies the availability of a reliable IT security system, which must be provided by the organizers.
Within the framework of trade shows, the collected information can be used not only to optimize the event but also by sponsors, which is the third compliance issue. When using RFID bands, it is necessary to coordinate the types of data collected and their use with external organizations, as well as participants in the event. All parties involved should be informed about what data will be collected and for what purposes. Without the consent of all parties, the use of RFID technology cannot be compliant.
Another significant compliance issue is the need to provide employees with sufficient skills and knowledge to work with RFID technology. In particular, this aspect affects IT security, which needs to be paid special attention to when training specialists. In particular, strategies need to be developed to identify unauthorized use of bands, as well as who to report violations that occur. Thus, consultancy support should be provided in all aspects of operation and technology implementation.
The most significant of the compliance issues is the aspect related to the storage, transfer, and use of personal data of attendees. Data privacy is one of the top concerns associated with RFID wristbands. This is especially relevant for the use of cantata and payment information of people, which is relevant for the use of contactless payments. When making and tracking mobile purchases, buyers leave their personal information and also participate in the tracking process. All these manipulations affect the privacy issues of their personal data, which may be at risk. Thus, this compliance issue is a priority for addressing when working with technology.
Privacy and Security Issues
The main privacy and security issue is the potential for leakage of attendees’ personal information. This aspect is relevant as it is inextricably linked with the principle of operation of RFID bands. In particular, when entering the event site, a person needs to identify himself, which leads to the provision of personal information. The data that the attendee provides can be potentially sensitive, especially when combined with other collected information. Security flaws can lead to data leaking, which is the main problem. Another privacy issue can be tracking the location of a person while at the event site. In particular, although RFID bands work when located close to the immediate source of the signal, there is a risk of copying it. Such manipulations can lead to the fact that strangers can track people’s behavior patterns, which leads to the collection of personal information.
Another significant threat to privacy is the disclosure of information about transactions and accounts of attendees. In the context of contactless payments, cybercriminals, in the presence of imperfections in the security system, may be able to intercept such information. This aspect leads to a significant threat since such data have a special priority within the framework of trade shows. The described privacy issues are associated with security issues that exist when working with RFID technology.
First of all, the most common threat is hacker attacks to intercept the information. One such issue can be denial-of-service (DoS) attacks, which exploit vulnerabilities in the RFID reader and end server. In this case, tags of bands can lose contact with the reader, which will lead to a complete stop of the system. Within the framework of events, such an attack will be critical, as it paralyzes the activities of the entire trade show. Sniffing is also a significant threat to RFID technology, as it allows attackers to use their own reader as their primary reader. This is due to the absence of the reader verification process, which allows you to receive a signal, and therefore information, on an identical device. Thus, the main concern of the organizers, in this case, is to ensure the security of the RFID network from outside interference. Attention not only to IT but also to physical security will ensure the privacy of the data of attendees.
Laws, Regulations, and Standards
Currently, there are several laws and standards governing the use of RFID. First of all, it is FCC Part 15, which defines the technical standards that industrial, medical, and scientific RFID bands must meet (RFID basics – RFID regulations, n.d). The technology implementation is impossible without compliance with the requirements of this document. The Privacy Act of 1974 governs “the collection, use, maintenance, and dissemination of personal information about US citizens or aliens lawfully admitted for permanent residence” (Karygiannis et al., 2007, p. 97-98). This act obliges to ensure the security of attendees data, which could be personally identifiable. There is also the E-Government Act of 2002, which establishes procedures aimed at ensuring the security of personal data (Karygiannis et al., 2007). The act includes the need to assess privacy risks, inform all participants, and also establish a number of technical requirements for IT and Web security. Thus, these documents regulate both the technical aspects of technology implementation and the factors related to data protection. Without meeting the requirements described in them, the use of technology is impossible since it involves the collection of personal information.
Recommendations
To address the privacy and security risks, there are a number of steps that need to be taken before the technology is implemented. First of all, it is necessary to provide relevant training for employees to work correctly with RFID bands and security networks. The planning and implementation process should include the interaction of all participants to ensure the most secure system. With regard to the policies, special attention should be paid to the formation of a strategy in accordance with regulatory requirements. In the technological dimension, it is necessary to ensure the greatest awareness of the shareholders about the principles of RFID bands. Additionally, the company needs to work only with trusted and experienced contractors to avoid difficulties.
Conclusion
The use of RFID bands within trade shows provides significant benefits for event management. In particular, the technology allows you to optimize the flow of people, which speeds up their automation and ensures the collection of relevant statistics. It is also important that access to contactless payment is a positive aspect of the interaction of sponsors and attendees. The IT Governance Board is recommended to pay special attention to regulations related to technical requirements and privacy aspects. Additionally, it is necessary to provide relevant employee training and information to all shareholders.
References
8 benefits of using RFID wristbands for resorts & attractions. (n.d). ID&C.
Bennett, C. (2013). RFID wristbands vs NFC apps: What’s winning the contactless battle? Techradar.
Bowler, J. (2016).RFID wristbands – The good, the bad and the ugly.
Karygiannis, T., Eydt, B., Barber, G., Bunn, L., & Phillips, T. (2007). Guidelines for Securing Radio Frequency Identification (RFID) Systems: Recommendations of the National Institute of Standards and Technology [PDF file]. US Department of Commerce.
RFID at trade shows. (n.d). MetalCraft.
RFID basics – RFID regulations. (n.d). RFID4u.
Tappit launches new RFID wristband safety functionality. (2019). Tappit.
The beginner’s guide to RFID technology for events. (2018). Token.