From IPEN Wiki
Revision as of 18:25, 30 June 2015 by Antoniok (Talk | contribs)

Jump to: navigation, search

This page focuses on activities related to privacy carried out in the European Standardisation Organisations (ESOs)


CEN-CENELEC JWG8 on Privacy Management of Security Products and Related Services


The European commission has issued in early 2015 a mandate to European Standardisation Organisations (or ESOs), CEN, CENELEC, ETSI) to work on a roadmap of standards covering the privacy management of security products and related services

Consequently, CEN/CENELEC has decided to launch a joint working group JWG8, the secretariat of which will be managed by AFNOR (France).

The objective if to define a roadmap and work plan for October 2015


Mandate page: http://ec.europa.eu/growth/tools-databases/mandates/index.cfm?fuseaction=search.detail&id=548

JWG8 page: http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Privacy/Pages/default.aspx

Members of JWG8

Working group structure

  • Chair: Claire Waast-Richards (EDF)

Editing team

  • French delegation: Antonio Kung, Mourad Faher, Denis Pinkas
  • German delegation: Matthias Reinis, Kai Rannenberg
  • UK delegation: Alan Shipman, John Mitchell
  • ANEC: Matthias Pocs
  • CEN-CENELEC: Alina Iatan

[Antonio Kung]

  • During the IPEN workshop it was made clear that the concept of security products should be more clearly defined (in particular on the contradiction between surveillance and privacy)

CEN/TC225 - AIDC technologies

As stated in Wikipedia : Automatic identification and data capture (AIDC) refers to the methods of automatically identifying objects, collecting data about them, and entering that data directly into computer systems (i.e. without human involvement). Technologies typically considered as part of AIDC include bar codes, Radio Frequency Identification (RFID), biometrics, magnetic stripes, Optical Character Recognition (OCR), smart cards, and voice recognition. AIDC is also commonly referred to as “Automatic Identification,” “Auto-ID,” and "Automatic Data Capture."

Data Protection, Privacy and Information Aspects of RFID


In December 2008, the European Commission addressed the Mandate M/436 to CEN, CENELEC and ETSI in the field of ICT as applied to RFID systems. The Mandate M/436 was accepted by the ESOs in the first months of 2009. The Mandate addresses the data protection, privacy and information aspects of RFID, and is being executed in two phases.

Phase 1, completed in May 2011, identified the work needed to produce a complete framework of future RFID standards. The Phase 1 results are contained in the ETSI Technical Report TR 187 020, which was published in May 2011.

Phase 2 is concerned with the execution of the standardisation work programme identified in the first phase. This second phase ended in July 2014 with the publication of different technical reports and the publication of two European standards:

EN 16571: « Information technology - RFID privacy impact assessment process» and

EN 16570: « Information technology - Notification of RFID - The information sign and additional information to be provided by operators of RFID application systems».


Mandate page: M/436

CEN/TC225 page: CEN/TC225

Members of CEN/TC225

A dedicated Project Team has been appointed to draft the EN 16571 on PIA for RFID applications

Editing team