EDPB issues statement on smart glasses and GDPR compliance
The EDPB outlines GDPR considerations for smart glasses, including controller identification, transparency, legal basis, and data protection by design. It emphasizes the need for effective transparency measures and risk mitigation for non-users.
- Framework
- GDPR
- Who it concerns
- Producers of smart glasses, providers of linked applications or services (including AI systems), and users of smart glasses in non-household contexts.
What changed?
Each point with the sentence from the source that says it.
Producers of smart glasses or providers of linked applications or services may be considered controllers and must comply with GDPR obligations, including transparency toward non-users.
The producer of the smart glasses or the provider of a linked application or service (including AI systems) may be considered as independent or joint controllers, where they determine, alone or jointly, the purposes and means of the processing.
Controllers should combine a broad range of transparency mechanisms, including visual or LED indicators, audio indicators, smartphone-based proximity notifications, and design features to inform non-users of processing.
Given the current state of the art, controllers and producers should consider combining a broad range of transparency mechanisms when designing and developing smart glasses, including measures that provide by default in-the-moment transparency that processing is taking place.
Consent is difficult to obtain from non-users with whom the controller has no relationship, and consent obtained after collection is not valid.
However, where the controller is the producer of the smart glasses or the provider of a linked application or service (including AI systems), and they process personal data relating to non-users with whom they have no relationship, it would be difficult to obtain their freely given, specific, informed and unambiguous consent as required under Article 7 GDPR.
Reliance on legitimate interests requires a careful case-by-case analysis and is particularly difficult for further processing for commercial purposes or AI training.
Reliance on Article 6(1)(f) legitimate interests as a relevant legal basis would require a careful case by case analysis in light of data subjects’ rights, freedoms, and reasonable expectations.
Controllers should implement data minimisation measures, privacy-friendly settings by default, technical restrictions, and privacy frictions to mitigate risks for data subjects.
The EDPB encourages the use of additional technical measures that could mitigate risks for data subjects, including: Data minimisation measures, such as limiting continuous recording, live streaming, or retention periods.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Privacy Notice
Review the privacy notice to address transparency challenges for non-users of smart glasses, including how to provide in-the-moment transparency and information required under Articles 13 and 14.
- Data Protection Policy
Update the data protection policy to include guidance on identifying controllers for smart glasses processing, legal basis selection, and data protection by design and by default measures.
- Data Protection Impact Assessment
Consider whether a DPIA is required for processing personal data through smart glasses, especially in sensitive contexts or when using AI features.
- Consent Management Policy
Review consent mechanisms for smart glasses processing, noting the difficulty of obtaining valid consent from non-users and the need for consent prior to processing.