1. Introduction
The Electronic Product Code (EPC), enabled by Radio Frequency Identification (RFID), has the potential to bring important benefits to individuals, businesses and society as a whole.

EPC systems use wireless technology to transmit or receive product serial numbers between tags to readers. It is regarded as a likely successor to barcode inventory tracking systems. The technology enables businesses to manage logistical operati ons more efficiently, benefits individuals by increasing safety in the food and prescription drug supplies, and increases convenience and product availability at retail. At the same time, business recognizes that attaining these potential benefits is likely to involve significant amounts of data exchanged between EPC readers and related systems. The systems and readers don't track personally identifiable information, but personally identifiable information may be associated with such information in certain retail situations. Because of the potential for personal information to be associated with EPC data at the point of sale, privacy concerns have been raised with respect to EPC systems. Business acknowledges the validity of such concerns, and is committed to complying with applicable laws and frameworks while deploying and operating EPC systems responsibly so that individuals can enjoy the benefits of this technology.

Balancing the values of individual privacy with the drive for an open and competitive economy is not about achieving a fixed and timeless legal solution. It is an ongoing process that needs to be responsive to new technology to enable users to gain the potential benefits of the technology, and to enable business to benefit from more efficient methods and new opportunities.

ICC, as the world's business organization, has adopted these principles on responsible deployment and operation of EPC Systems to ensure that business practices which impact individuals are responsible and consistent with legal requirements, well-established best practices and business ethics.

1.1 EPC Explained
EPCs are the next generation of product identification. Each EPC is divided into numbers that identify the manufacturer, product type and serial number. In this way, an EPC is able to uniquely identify an object in the supply chain. An EPC is carried by a tiny silicon chip with an antenna to reflect product data using radio waves (RFID). By attaching EPC tags to pallets, cases and product packaging, a company can track its products at every point in the supply chain. EPC creates cost-efficient, real-time accurate information about the location of items, the history of items and the number of items in the supply chain. It should be stressed again that EPC tags utilize information about products not people and contain no personally identifiable information.

Since the late twentieth century, RFID has been used in such items as highway toll tags in passenger vehicles and employee security passes. With further miniaturization in the early twenty-first century, EPC tags can now be placed on virtually any object, from a bottle of hand lotion to an automobile part. When within the limited range of an EPC reader, the data generated from an EPC tag can be used by computers to identify precise information on the product to which the EPC tag is attached and its location. Unlike bar codes, however, EPC tags do not require direct line of sight to be read and have the capability to identify not only the brand and model of the product, but the unique item of that brand and product. This is an essential improvement for food traceability that can identify potential health issues from the feedlot to the packaged product. This traceability offered through use of EPCs also permits more effective product recall and targeted consumer health and safety alerts for products such as drugs, small electrical appliances, toys and other household goods.

EPC tags are readable within very limited distances depending on region, frequency, operational environment, antenna size, and whether or not the chip is equipped with a power supply. For example, at this point in time the distance is generally less than 4 meters in Europe and 7 meters in the United States. While line of sight access to an EPC tag enhances readability, it is not required as with a bar code. This aspect of the technology has prompted concerns based on futuristic scenarios of ubiquitous readers in fully aware environments and drive-by scanning of houses. In reality, these scenarios in no way represent the current or likely state of the technology. Because increasing reader power requires significant overhead, such powerful readers would be prohibitive in cost, and inconvenient in size.

Supply chain applications:
RFID and the ability to " read " product information without needing line of sight reading of the EPC tag, enables significant improvements in efficiency for logistics, inventory control, transport and security. Many of the benefits related to supply chain are the results of greater and more detailed information flows on the back end that are not obvious to consumers and do not implicate consumer personal identifiable information.

Business to consumer benefits:
EPC systems are also expected to allow businesses to explore new ways to meet consumer needs, reduce their costs and maintain their inventory. The advent of commercial applications for EPC systems for consumer products creates new opportunities for businesses to improve their operations and for consumers to benefit from the application of the technology. The commercial ramifications of these developments are significant.

Apart from using of EPC tags to improve efficiencies and competition in the supply and distribution chain, there are numerous demonstrable benefits to consumers including identification of counterfeit products, faster product recalls, enhanced product availability, improved warranty service and potentially faster check-outs. It is apparent that for consumers to realize some of these benefits - for example, the ability to be notified about product recalls or warranty service issues - some record linking the consumer to the product he/she has purchased is essential.

As applications of the technology move from the back end to the point of retail sale and beyond, and involve the potential association of personal identifiable information, legitimate concerns over the non-obvious nature of the collection and potential for misuse of such information must be addressed, based on the actual and realistic potential use and capability of the technology. To achieve the societal benefits of EPC systems in their numerous beneficial consumer and business applications, public education, understanding and constructive dialogue will be paramount. Business should foster education to ensure greater public understanding about EPC systems, related consumer benefits and the means to address privacy concerns.

1.2 Existing Frameworks:
As stated above, EPC applications can collect detailed information about the product and location, but not information about individuals. However, this product and its location information can be associated with information about individuals in related systems. Where that occurs it does so under existing frameworks related to the collection and use of perso nal information under privacy and consumer law. The process by which EPC/RFID information is associated with personal information is not dissimilar to how personal information may be associated with current logistical support and inventory control data. Product information in today's bar codes can be associated with personal identifiable information at point of sale in credit card and loyalty card transactions. The ability of companies to associate and use that information is controlled by the legal environment in which the company operates, and policies that those companies have adopted related to consumer information. This framework is not meant to replace or modify those laws and their application, but rather to provide practical guidance to companies on responsible principles upon which to base practice and deployments.

These principles have been drafted to be consistent with the 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.

1.3. Self-Regulatory Guidance
ICC, as the world business organization, promotes high standards of business ethics through the development and dissemination of rules, including codes and guidelines on how business should direct its efforts to assure that business practices which impact consumers are responsible. As a global multi-sectoral organization, ICC codes serve as international standards that are used to develop regional and national codes by industry sector groups and by regional and national self-regulatory bodies. World business agrees that effective self-regulation that is compliant with applicable law is the system that, through a combination of best practices and determined enforcement, can best inspire consumer confidence. Government's role is to provide the basic national and international framework of laws and regulations for business operations and that essential role will continue to evolve. Voluntary approaches minimize competitive distortions and transaction costs associated with regulatory compliance, while at the same time inspire many companies to go beyond the regulatory baseline, thus often eliminating the need for further legislation.

Industry has an interest in implementing EPC systems in a way that takes into consideration the interests of all stakeholders.

Successful use of EPC systems depends upon innovation. Working together, commercial sponsors can create a transparent, enabling framework that encourages responsible innovation, both domestically and internationally. As with any emerging industry, the protection of intellectual property rights and progressive trade policies are essential to ensure continued innovation and to stimulate investment in EPC technology. Business is also committed to working together with regulators on the privacy and data protection aspects of EPC.

Through close cooperation, interested parties should do their utmost to prevent the emergence of a patchwork of different obligations with respect to the use of EPC systems. Business will continue to work with policymakers to increase awareness and understanding of the technical and privacy aspects of commercial use of EPC, taking a cooperative approach to better inform policy decisions.

1.4. Responsible EPC Deployment and Operation
To the extent that EPC systems are covered under current laws governing privacy, compliance is of course a requirement. From the broader standpoint of ethics and responsibility, notice to individuals, e ducation and choice, as well as compliance with applicable laws, are essential elements of responsible deployment and operation of EPC systems. Accordingly, ICC has developed the following principles to guide the deployment and operation of such use:

ICC Principles on EPC deployment and operation

Article 1 General
1.1 Use of EPC systems and related technology should be legal, decent, honest and truthful.

1.2 Notice is an essential element of responsible EPC deployment and operation.

1.3 Consumer choice, where possible and appropriate, is an essential element in developing consumer trust and acceptance.

1.4 Education is key to fostering common understanding of EPC systems.

Article 2 Information and Choice
2.1 Consumer products or their packaging that contain EPC tags should be labelled accordingly.

2.2 If an EPC tag on a consumer product is not contained in discardable packaging, information on the location of the tag within the product should be provided to consumers, along with information whether they have an ability to remove or disable EPC tags from the products they acquire.

2.3 Retailers, and where relevant, other consumer facing parties in the supply chain should provide consumers with accurate information concerning the use of any personal identifiable information generated through EPC systems. When collecting data, companies should use, disclose and protect personal identifiable information in compliance with all applicable laws and fair information principles.

2.4 Consumers, where appropriate, should be given the opportunity to refuse the transfer of any personally identifiable data to another organization.

2.5 Consumer preferences related to the disclosure of personally identifiable information should be respected to the greatest extent, except where disclosure is required by law or where it is necessary to accomplish the purpose of the transaction.

2.6 Mechanisms should be explored to allow consumers further control of EPC tags on an economical, efficient and reliable basis.