GS1 Industry & Standards Event March 21-25, 2011 – Brooklyn, NY Creating value together with global standards

1. GS1 Industry & Standards EventMarch 21-25, 2011 – Brooklyn, NYCreating value together with global standards Public Policy Panel March 21, 2011 9 a.m. – 10:45 a.m. Sponsored by

2. Agenda • Introduction Elizabeth Board, GS1 GO • Food Safety: Changes in US Laws and Customs Initiatives • Steve Arens, GS1 US • Using GS1 Standards to Manage Product Safety Requirements • AlGarton, GS1 US • Privacy Impact Assessments Going Forward in EuropeAndreas Füßler, GS1 Germany • US RFID Legislative Initiatives Matt McBride, GS1 GO

3. Anti-Trust Caution • GS1 and the GSMP operate under the GS1 anti-trust caution. Strict compliance with anti-trust laws is and always has been the policy of GS1. • The best way to avoid problems is to remember that the purpose of the committee is to enhance the ability of all industry members to compete more efficiently. • This means: • There shall be no discussion of prices, allocation of customers, or products, etc. • If any participant believes the group is drifting towards an impermissible discussion, the topic shall be tabled until the opinion of counsel can be obtained. • The full anti-trust caution is available in the Community Room if you would like to read it in its entirety.

4. Food Safety: Changes in US Laws and Customs Initiatives Steve Arens – GS1 US

5. U.S. Food Safety Modernization Act • Most expansive changes since 1938 Act • Sweeping new enforcement authority for US Food and Drug Administration (FDA) • Exacting new food import requirements • Major new program activities for FDA • Ambitious schedule for increased inspections • FDA working on specific industry guidance and regulatory documents • FDA required to perform product tracing pilots with produce and processed foods (details to be determined) • Funding to be determined

6. FDA Public Hearings RE Imported Goods • First FDA Public Hearing concerning the Food Safety Modernization Act (FSMA) March 30 and March 31 • Discussion of FDA's efforts to gather information from regulators in other countries regarding the regulatory policies, practices and programs used to ensure the safety of foods and animal feed imported into their countries • Discussion of the implementation of the imports provisions found in the Food Safety Modernization Act • GS1 US will attend hearings and will provide a recap • GS1 US will submit comments to FDA for consideration

7. US Customs Activities US Customs’ International Trade Data System’s (ITDS) Product Information Committee (PIC) concluded in April 2009 that: • Harmonized Tariff System (HTS) codes provide insufficient information about most products for accurate admissibility assessment • Electronic commerce data used by businesses can be leveraged by governments to create a “smarter”cargo admission process

8. Why Use eCommerce Data? • Based on global public voluntary consensus standards • Broadly used by industry sectors • Provides globally unique identification for products in the supply chain • Provides structured, internationally recognized, multilingual product categorization and description • Uses commonly available technology.

9. One Concept Global Catalog (GDSN) Product Supplier Product supplier authoritatively publishes product information 1 Importer GTIN= 123456119121 GPC = 10005143 GPC DESCRIPTORS Importer places the GTIN for the product in the entry record and sends to Customs 3 Government downloads published product information from catalog 2 ENTRY #Line N GTIN= 123456119121 10005143 =Dolls/Soft Toys (Powered); Consumer Lifestage = >3 YEARS & UP; Power Source = BATTERY; Target Gender = FEMALE; Type of Doll/Soft Toy = BABY DOLL Customs Data Government matches GTIN with catalog info and makes admission decision, ideally in advance, using rich global data from catalog 4 5 If catalog data indicate low risk product, government can release without inspection; if high-risk, can better plan for inspection efforts Government Agency Inspection

10. Work Underway • Product Information Committee currently conducting three pilots for high-risk products: • Meat and Poultry Products (Public Health) • Toys (Public Safety) • Cut Floral Products (Environmental Safety) • Pilots will document the business case for using e-commerce data for industry and government • ITDS will report on business case value determined by pilots - final report to be issued in 2011 • World Customs Organization following work closely

11. Contact Details • Steve Arens • sarens@gs1us.org

12. Using GS1 Standards to Manage Product Safety Requirements Al Garton – GS1 US

13. Using GS1 Standards to Manage Product Safety Requirements • Preliminary work has commenced as a result of GS1 US member inquiries with regards to using GS1 Standards to manage data associated with product safety compliance • Retailers asking for data in multiple formats • Suppliers struggling to meet those demands • Inquiries by the International Regulator Group • The need to educate Government Agencies at the international and local level • European Union • Organization for Economic Cooperation & Development • U.S. Government Agencies (CPSC, FDA, USDA, EPA, Dept of Commerce)

14. The U.S. Consumer Product Safety Improvement Act • Legislation includes a broad range of requirements • Strong emphasis on Children’s Products but has expanded to include multiple categories of household products (literally thousands of products) • About the U.S. Consumer Product Safety Commission • Charged with protecting the public from unreasonable risks of injury or death from thousands of types of consumer products under the agency's jurisdiction

15. How to Address the Challenge • Need to understand the key issues and where GS1 Standards can be applied effectively • The Consumer Element • Mobile Commerce Link? • Permanent Tracking Labels at the item level • Presents challenges to industry • Not our typical supply chain initiative

16. Focus of Current Work • Gain an understanding of the U.S. CPSC • Office of Inter-Governmental Relations and International Programs • Consumer Data Base Requirements • Customs • Understanding the new legislation • Potential Transatlantic pilot for baby strollers • Focus is on a tracking label at the item level • Trade Association Collaboration • TA’s have a firm grasp on legislative issues and how they impact the industry • Retailer/Supplier collaboration • How is product data information managed? • Identify where GS1 Standards are most relevant • Use of GDSN • GS1 Standards on General Certificates of Conformity

17. Contact Details • Al Garton • agarton@gs1us.org

18. RFID Privacy Impact Assessment Framework Andreas Füßler – GS1 Germany

19. Background • 2007 Communication on RFID in Europe: Steps towards a policy framework • Creation by EC of an RFID Expert Group: intensive dialogue, shared experiences, multi-stakeholders’ process, leading to… • May 2009 Recommendation on data protection for RFID applications: • European Standardisation Organisations to develop a common European sign to indicate the presence of readers • Industry to ‘develop a framework for privacy and data protection impact assessments’ • This ‘PIA Framework’ is of great relevance, not least for retailers vis-a-vis deactivation at point of sale

20. PIA Roadmap May 09 EC Commission releases the RFID Recommendation on Privacy Stakeholders group set up in order to draft PIA Framework. Endorsement of Article 29 WP is required Jul 09 Industry presents draft to the EC. EC (JLS and INFSO) submit the draft to the Article 29 WP Technology Subcommittee. Mar 10 Jul 10 Opinion of Article 29 WP. Industry is asked to make some revisions Inclusion of Article 29 WP comments and submission of final proposal from the Industry Dec 10 Endorsement of the Article 29 WP Feb 11 Signing Ceremony organised on 6 April 2011 for Formal endorsement of the European Commission

21. What is a PIA Framework for RFID Applications? • Designed to help RFID Application Operators uncover the privacy risks associated with an RFID Application • Identifies the objectives of RFID Application PIAs, the components of RFID Applications to be considered during PIAs, the process for conducting a PIA and the common structure and content of RFID Application PIA Reports • Serves a common approach to conducting Privacy Impact Assessments on RFID Applications • Based on a privacy and data protection risk managementapproach

22. Content of PIA Framework • Introduction • Key concepts • Internal procedures • PIA Process • Initial Analysis Phase • Risk Assessment Phase • Annexes • Information needed in the PIA report • Privacy targets • Privacy risks

23. Initial Analysis: Decision Tree on PIA levels

24. Comprehensive Application Description Planned RFID Application Design Step 1: Characterisation of Application Threat Exploitation Likelihood, Impact Magnitude, Control Adequacy List of Risks and Associated Likelihood of Risks Step 2: Identification of Relevant Risks Step 3: Identification of Current and Proposed Controls List of Current and Planned Controls Step 4: Documentation of Resolution and Residual Risks PIA Report Risk Assessment Phase: Characterisation of applications

25. Next Steps • RFID PIA Framework will take effect 6 months after publication of the opinion of the Article 29 WP : October 2011 • Living document: Clarification of the RFID PIA Framework and/or guidance on practices may be required based on the practical experience; the Article 29 WP will continue dialogue with industry. • RFID PIA Framework and the 2009 Recommendation should ensure a common implementation and interpretation of the data protection rules for RFID applications within the 27 EU Member States – Mutual Recognition • Development ofindustry-based template, sector-based, and/or application-based PIA templates (e.g. retail, logistics, pharmaceutical sectors; SME template) • GS1 will develop a template for EPC applications

26. Further information • PIA Framework is accessible at: • http://ec.europa.eu/information_society/policy/rfid/index_en.htm

27. Contact Details • Andreas Fuessler • fuessler@gs1-germany.de

28. US RFID Proposed Legislative Initiatives Matt McBride – GS1 GO

29. States With Proposed RFID Legislation In 2011 • 5states in 2011 have introduced RFID legislation • 11 states in 2009 introduced RFID legislation • States focused on budget issues 2009 2011

30. States With Proposed RFID Legislation In 2011 • Recurring States • New York • New Hampshire • Massachusetts • Mostly reintroductions or variations on past legislation; legislators with an interest in RFID. • New States • Utah • Florida • Bills require deactivation; legislators misinformed on technology.

31. States With Proposed RFID Legislation In 2011 • New York • All are introductions of bills that failed last year. None have been heard in committee. • AB 894 – Requires notice of retail products or packages contain RFID tags; sets injunctions and civil penalties for violations • AB 1032/SB 1821 – Establishes a Privacy Task Force that would report on existing state law, regulations, policies, and practices related to the use of technology, including RFID • AB 1033/SB 1168 - Radio Frequency Right to Know Act, requires retail establishments to label and disclose the use of RFID devices, and deactivation at point of sale.

32. States With Proposed RFID Legislation In 2011 • Massachusetts • SB 1850 – Act further regulating radio frequency devices in the Commonwealth.As of last week, the bill language has not been reintroduced. Expected to be a re-introduction of legislation that failed last year.

33. States With Proposed RFID Legislation In 2011 • New Hampshire • HB 445 – Prohibits tracking individuals through electronic means.After the hearing, the bill has been retained in committee, to be voted on later in the year. • NH 455 – Requires individuals applying for Enhanced Drivers Licenses to sign statement acknowledging that they are understand the RFID technology being used in the license.Retained in committee for action in second year of session.

34. States With Proposed RFID Legislation • Utah • HB 224 – Originally introduced to require deactivation of RFID tags, and prohibit surreptitious reading of the tags.Original version of the bill died in committee by a vote of 10 to 1.Bill revised to prohibit implantation of RFID tags without an individual's consent.

35. States With Proposed RFID Legislation • Florida • S. 1164 – Requires deactivation of RFID tags.Bill was not expected to go anywhere, but sponsor managed to get a hearing. Bill passed first committee and must be heard by a second committee in order to pass.Sponsor has agreed to be informed on RFID prior to second committee hearing. GS1 is working with the Florida Retailers Federation and industry stakeholders to provide this education.

36. Contact Details • Matt McBride • matthew.mcbride@gs1.org

37. Questions?