Describes a case study of six enterprises concerning their policies for collecting, retaining, and using personally identifiable records obtained by sensing access cards that contain radio frequency identification tags.