Evan Schuman's StorefrontBacktalk

To the Members of the California State Assembly: I am returning Assembly Bill 779 without my signature.

Protecting the personal information of every Californian is very important to me and I am committed to strong laws that safeguard every individual’s privacy and prevent identity theft. Clearly, the need to protect personal information is increasingly critical as routine commercial transactions are more and more exclusively accomplished through electronic means.

However, this bill attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers. In addition, the Payment Card Industry has already established minimum data security standards when storing, processing, or transmitting credit or debit cardholder information.

This industry has the contractual ability to mandate the use of these standards, and is in a superior position to ensure that these standards keep up with changes in technology and the marketplace. This measure creates the potential for California law to be in conflict with private sector data security standards.

While I support many of the provisions of this bill, it fails to provide clear definition of which business or agency "owns" or "licenses" data, and when that business or agency relinquishes legal responsibility as the owner or licensee. This issue and the data security requirements found in this bill will drive up the costs of compliance, particularly for small businesses.

I encourage the author and the industry to work together on a more balanced legislative approach that addresses the concerns outlined above.

Sincerely,<br>
Arnold Schwarzenegger …

This is Evan Schuman, editor of StorefrontBacktalk and the retail technology editor for eWEEK. We were a content partner for the Retail Systems Alert Group and had helped them with content for events, panels and the newsletter.
In theory, you were a subscriber to some of their newsletters. Well, in mid-June, RSAG closed its doors. To try and continue the content you had asked for, we’re offering our weekly newsletter that looks at retail technology and E-Commerce issues. There is no sponsorship, no bias and lots of analysis (and bad jokes, from time to time) about what we see happening.
Hope you stick around. It’s our job to try and make sure the content is useful. (If you don’t like it, our unsubscribe link is quite effective.)…

Looks like Checkpoint Systems has a merged EAS tag/RFID product in the pipeline, according to this intriguing story in RFID Journal. When they are formally introducing the merged unit is a bit unclear. The story says it was introduced on Friday, but I am guessing it will be introduced on Monday in Orlando at the RFID Journal Live conference. (Not that it matters to anyone, but I like to get this trivia precise.)

What does matter is that the new merged line–reportedly to be called Evolve–wants to connect the dots between EAS theft deterrent system and an RFID in-store inventory package. On the least-impact side, it could be a convenient way to handle two tasks with one unit. On the most-impact side, it could truly push to the next level the ability to track products throughout a store and beyond.

“To deploy such a system, Checkpoint would need to develop a means by which the EPC encoded to the labels would be generated, managed and shared with supply-chain partners. The required RFID hardware infrastructure would also need to be put in place at manufacturing and retail warehouses and facilities,” the RFID Journal story said. “To leverage the RFID tags for inventory tracking inside retail stores, interrogators would be needed in the back rooms and possibly on store shelves and at point-of-sale terminals as well.”…

072-3119
UNITED STATES OF AMERICA
FEDERAL TRADE COMMISSION
COMMISSIONERS: William E. Kovacic, Chairman
Pamela Jones Harbour
Jon Leibowitz
J. Thomas Rosch
) FILE NO.
In the Matter of )
)
CVS CAREMARK CORPORATION, ) AGREEMENT CONTAINING
a corporation, ) CONSENT ORDER
____________________________________)
The Federal Trade Commission (“Commission”) has conducted an investigation of
certain acts and practices of CVS Caremark Corporation (“proposed respondent”). Proposed
respondent, having been represented by counsel, is willing to enter into an agreement containing
a consent order resolving the allegations contained in the attached draft complaint. Therefore,
IT IS HEREBY AGREED by and between CVS Caremark Corporation, by its duly
authorized officers, and counsel for the Federal Trade Commission that:
1. Proposed respondent CVS Caremark Corporation is a Delaware corporation with its
principal office or place of business at One CVS Drive, Woonsocket, Rhode Island,
02895.
2. Proposed respondent admits all the jurisdictional facts set forth in the draft complaint.
3. Proposed respondent waives:
(a) Any further procedural steps;
(b) The requirement that the Commission’s decision contain a statement of findings
of fact and conclusions of law; and
(c) All rights to seek judicial review or otherwise to challenge or contest the validity
of the order entered pursuant to this agreement.
4. This agreement shall not become part of the public record of the proceeding unless and
until it is accepted by the Commission. If this agreement is accepted by the Commission,
it, together with the draft complaint, will be placed on the public record for a period of
-2-
thirty (30) days and information about it publicly released. The Commission thereafter
may either withdraw its acceptance of this agreement and so notify proposed respondent,
in which event it will take such action as it may consider appropriate, or issue and serve
its complaint (in such form …

Analysis of Proposed Consent Order to Aid Public Comment
In the Matter of CVS Caremark Corporation, File No. 0723119

The Federal Trade Commission has accepted, subject to final approval, a consent agreement from CVS Caremark Corporation (“CVS”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order.

The Commission’s proposed complaint alleges that CVS is in the business of selling prescription and non-prescription medicines and supplies, as well as other products. It operates, among other things, approximately 6,300 retail pharmacy stores in the United States (collectively, “CVS pharmacies”) and online and mail order pharmacy businesses. The company allows consumers buying products in CVS pharmacies to pay for their purchases with credit, debit and electronic benefit transfer cards; insurance cards; personal checks; or cash.

The complaint alleges that in conducting its business, CVS routinely obtains information from or about its customers, including, but not limited to, name; telephone number; address; date of birth; bank account number; payment card account number and expiration date; driver’s license number or other government-issued identification; prescription information, such as medication and dosage, prescribing physician name, address, and telephone number, health insurer name, and insurance account number and policy number; and Social Security number. The company also collects and maintains employment information from its employees, which includes, among other things, Social Security numbers.

The complaint further alleges that CVS engaged in a number of practices that, taken together, failed to provide reasonable and appropriate security for sensitive …

…

A new report from industry analyst firm The Aberdeen Group does not bring a lot of optimistic news for RFID proponents, with predicted trouble for finding sufficiently-experienced RFID personnel, migrating to new data-collection methods such as mobile and biometrics as well as predicted major hiccups with efforts to scale RFID to the next level.

One bright note: the survey finds that users no longer see cost as the single most important factor. That’s significant because it’s the first time in the years that Aberdeen has conducted this study where interviewees did not choose cost as the most important issue when making RFID decisions.

Report author John Fontanella, Aberdeen’s Senior VP and service director for supply chain and retail research, said one of the most troubling findings in the survey of RFID users was that most companies were doing the absolute minimum to comply with mandates. In other words, they weren’t leveraging what they are required to do for a major customer and using it to improve their own operations.

“Most are giving no thought beyond just satisfying the immediate need of collecting the data. The slow adopter is trying to meet whatever mandate they’ve been given. Some 99 percent are only adopting because they have to, because someone is telling them to, whether it’s DOD, Wal-Mart, whoever,” Fontanella said. “Now that the information is collected and paid for, it’s time to start turning that RFID data into something much more positive, to get a much better return on their investment.”

Not all companies, though, are passing up the opportunity, he said. After Wal-Mart started forcing various suppliers to deliver, some suppliers decided to “do what I have to do to meet the mandate” and “they were forced to automate the tagging process. But they then that as the opportunity to …

At a time when IT executives are finding users less and less tolerant of network delays, CIO William Morgan has perhaps the least tolerant set of users in the world.

Morgan runs technology operations for the 215-year-old Philadelphia Stock Exchange, the nation’s first stock exchange. But its age doesn’t make its daily load any easier, with networks having to handle 120,000 messages per second and peaks of 200,000 messages per second.

But because it is a financial exchange, any delay?even a half-second?is not acceptable.

“We measure transactions in milliseconds these days. This business can’t tolerate delays: We’re pricing customer orders,” Morgan said. “It’s survival for us.”

In recent years, financial activity has pushed that IT demand much higher. “If you go back five or six years, probably the number [of messages per second] was 10,000 or less,” which is one-twelfth today’s volume, Morgan said.

Morgan delivers that real-time speed with some homegrown applications sitting atop Sun Microsystems Solaris 10 servers, Stratus fault-tolerant servers in a Nortel network.

The CIO argues strongly for using as much standardized software as possible; the exchange’s Web site runs on Windows, and e-mail is using Microsoft Outlook.

“We use the standard Windows environment for all that, but not for our trading. On the trading side, there simply aren’t many packages,” he said.

“There are many for broker dealers, but a select for exchanges. There aren’t that many exchanges and, because of the custom nature of each exchange’s business, it’s very hard to find an off-the-shelf” package.

Having the network deliver all of those messages per second?Morgan’s people stress test their system with 200,000 messages per second?is only part of the battle.

After the messages are delivered, they have to be stored, catalogued and archived. These days, that’s about one-half billion messages every day.

All things …