The RAND Corporation, a research think tank, has issued a paper outlining privacy concerns about RFID-enabled access cards in the workplace.

The paper, entitled "9 to 5: Do You Know if Your Boss Knows Where You Are?" focuses on how corporations use access cards, such as the ones we talked about here.

The study is based on a limited sample -- just 6 enterprises. It examined:

"...their policies for collecting, retaining, and using records obtained by sensing RFID-based access cards. We found that the workplace policies we surfaced share a number of common features (data are used for more than access control, access control system records are linked with other enterprise databases, and security and employment practices trump privacy concerns) and
that these policies are not communicated to employees."

This is a very useful report on a subject about which little has been written. One of the most useful aspects is the "Recommendations" section. It recommends that any enterprise adopting RFID-enabled access cards have a policy on usage of the data collected. It gives specific advice for what to cover in the policy.

You can download a free PDF of the report here.

Hat tip to Lois of Metaforix for the link.