The use of “smart glasses” poses risks to personal data, warns the Hellenic Data Protection Authority, citing the recommendations of the European Data Protection Board (EDPB).
In light of the increasingly widespread use of “smart glasses,” the Hellenic Data Protection Authority draws the public’s attention to the risks their use poses in relation to the protection of personal data, privacy, and the rights and freedoms of citizens.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
As the announcement states, smart glasses often resemble conventional glasses but incorporate cameras, microphones, and other technological features, including artificial intelligence applications. Among other things, they allow users to take photos, record audio and video, stream live video, and recognize objects.
According to the Authority, their inconspicuous appearance makes it difficult for third parties to realize that their personal data may be being recorded or processed without their knowledge.
The announcement notes that the risks are particularly high in places such as hospitals, schools, and workplaces, as well as when the recorded material is shared on social media. Special attention is required to protect children, who may not fully understand the presence or consequences of using such devices.
According to the announcement, the European Data Protection Board (EDPS), in which the Personal Data Protection Authority participates, represented by Personal Data Protection Commissioner Maria Christofidou, has adopted a statement regarding the implications of smart glasses use for the protection of personal data.
As noted, the statement provides preliminary guidance to users, manufacturers, and providers of related artificial intelligence applications or services, who may act as sole or joint data controllers, with the aim of raising awareness and fostering a better understanding of the risks associated with the use of this technology.
It should be noted that it is the users’ responsibility to comply with the General Data Protection Regulation (GDPR).
However, it is clarified that when use is limited to purely personal or domestic activities, such as recording family moments or sharing photos with friends, the GDPR does not apply to the user.
Conversely, when the material is published on public social media accounts or the smart glasses are used in the context of professional, official, or political activities, the user may be considered a data controller and be subject to the obligations of the GDPR.
At the same time, as stated in the communication, individuals in close proximity to smart glasses users must be able to tell when their personal data is being recorded or otherwise processed.
Furthermore, the EDPS recommends the use of technical measures, such as LED lights that activate during recording, audible alerts, or voice prompts, notifications to nearby mobile devices—with appropriate privacy safeguards—and a design that makes it easier to recognize smart glasses.
At the same time, the communication notes that smart glasses manufacturers and providers of connected applications or services, including artificial intelligence systems, must comply with the requirements of the GDPR when acting as data controllers.
In addition, any processing of personal data falling under the GDPR must be based on an appropriate legal basis.
The EDPS makes specific reference to the issue of the legal basis for processing personal data collected through smart glasses, highlighting the difficulties involved in both relying on consent and basing processing on legitimate interests.
The EDPS encourages the incorporation of appropriate personal data protection measures right from the design phase of the devices and by default, such as limiting continuous recording and data retention periods, features to blur faces or prevent the identification of third parties, disabling the permanent storage of video and audio when it is not necessary for the device’s operation, and technical restrictions on the use of specific functions in particularly sensitive areas.
Finally, the EDPB encourages the promotion and adoption of common standards in this area, as well as information and awareness-raising measures, so that citizens can recognize when smart glasses are being used and understand how their personal data may be processed.
Source: CNA
