Smart glasses: the ICO widens the lens, while European regulators sharpen their focus

As the market for smart glasses continues to grow, regulators across the EU are reflecting on their respective positions, against a backdrop of broader societal questions around monitoring and surveillance. In the UK, courts have banned the use of smart glasses within their premises, as have certain cinemas and pub. Should employers follow suit and if not, what data privacy considerations need to be addressed?  

What is the ICO’s view? 

According to the ICO’s blog, reports of people being recorded without their knowledge, and in some cases harassed, raise "important and serious questions about surveillance, safety, and trust".  Unsurprisingly, their blog focuses on transparency as a key concern. Most devices operating in public spaces rely on visual cues, for example a sign indicating there is CCTV. Such cues come with their own challenges (e.g. excluding visually impaired individuals), but they are less, if at all, effective with devices such as smart glasses that are smaller, ‘on-the-move’ and easier to integrate into everyday life. LED indicators on the frames, which switch on when filming, have been suggested as a potential solution. However, they are unlikely to provide sufficient information to fulfil the transparency requirements of the GDPR. Commentators have also suggested that they risk being misleading, or meaningless, because they would switch on when filming occurs regardless of whether any personal data is in fact being processed. 

Despite this, the ICO cautions against treating smart glasses as either inherently good or bad. As Paul Arnold from the ICO explains, there are also significant beneficial uses of smart glasses, including accessibility for visually impaired people and potentially supporting people living with dementia, as explored within an ICO regulatory sandbox project with Cross Sense. 

What about other regulators and jurisdictions? 

EU data regulators recognise the limits of data protection law, placing significant weight on individuals to adopt the right and decent approach. However, we are also seeing instances of more interventionist approaches. In Norway, the Datatilsynet published guidance for individuals and the Norwegian government is considering introducing stricter regulation, for example around the use of smart glasses in some public places or when biometric or other special category data is processed. In Germany, the Hamburg Commissioner has argued that smart glasses could be fully banned under existing anti-surveillance laws relating to recording devices disguised as everyday objects. Concerns have also been raised in France and in the UK, a Westminster Hall debate was held today on AI enabled smart glasses and the safety of women. At EU level, the European Data Protection Board has published a statement on the data protection challenges of smart glasses and a report and the European Consumer Organisation, BEUC, has urged the EU commission to investigate smart glasses over privacy and covert surveillance risks.

Across the board, and unsurprisingly, privacy by design is emphasised as being key in areas such as these, where data protection compliance and social norms evolve hand in hand. 

What does this mean for the workplace? 

Smart glasses raise a number of data protection considerations for employers: 

• Where an employer deploys smart glasses, or permits their use, for business purposes (for example for field engineers, warehouse staff or remote assistance), it will usually be the controller. The GDPR household exemption will not apply and, alongside all other GDPR obligations, a lawful basis will need to be identified, transparency information provided to staff and to the third parties they meet, and a DPIA will likely be required given the risk of continuous, near-invisible capture of images and audio in public and private spaces. 
• Employers are also increasingly facing the issue of staff who record meetings or shop floors covertly and then post the footage online or use it as leverage. This can occur with both employee-owned devices or unauthorised uses of work provided devices.

Helpfully, guardrails can be easier to implement in the workplace as expected behaviours, legitimate accessibility uses and transparency information can be set out in various policies and brought to employees’ attention, including through training and other communications. Data subject access request (DSAR) and complaints procedures may require updating to take account of smart glasses. Employers should also be aware that manufacturers may use recordings for their own purposes and that the devices may collect and share location data – due diligence and contractual protections will help to mitigate this risk. We will take a closer look at some of the employment considerations smart glasses raise in a forthcoming blog.

Broader context and next steps

The ICO's blog does not set out new compliance requirements, but it is a useful indicator of the regulator's thinking: an emphasis on balancing innovation and privacy, and a clear expectation that privacy by design is built in from the outset. Across Europe, the direction of travel points towards more specific, though not necessarily harmonised, rules. In the meantime, organisations should review their policies, DPIAs and vendor arrangements, so that smart glasses and similar wearables are covered.