Smart glasses equipped with cameras and intelligent features are raising increasing concerns regarding data protection, privacy and image rights. Whilst their purchase and wearing are, in principle, permitted, their use must comply with the applicable legal framework, particularly when images or sound are being recorded.
Purchase and possession of smart glasses
Firstly, the CNPD notes that, under Luxembourg law, there is no specific provision prohibiting the purchase or possession of devices incorporating a camera or a recording system, such as smart glasses. Such equipment may therefore be freely purchased and possessed.
Wearing smart glasses
Wearing such devices, in and of itself and in the absence of any recording, is not prohibited. It should be noted, however, that certain restrictions may arise from internal regulations applicable in private premises (for example: businesses, establishments open to the public, sports facilities), which may prohibit or restrict the use of recording devices.
Competence of the data protection authority
Firstly, we would like to draw your attention to the fact that, under the European mechanism for cooperation and consistency, the competent data protection authority – which may act as the lead authority – is that of the country in which the data controller has its main establishment (in the case of Ray-Ban Meta smart glasses, Meta Platforms). Although all the relevant European authorities cooperate to ensure the uniform application of data protection laws, only the authority of the country in which the data controller is established is competent to act as the official point of contact in the context of monitoring compliance with the GDPR in relation to Meta.
In the case of Meta Platforms, this is the Irish Data Protection Commission.
However, we would like to draw your attention to the following points in response to your enquiry, without prejudice to a more specific assessment by our Irish counterparts regarding the taking of photographs or videos using smart glasses of the aforementioned brand:
Applicability of the GDPR to on-board image capture systems
Generally speaking, images that enable individuals to be identified constitute personal data within the meaning of Article 4 of the GDPR. Consequently, the recording of images of individuals by a CCTV camera – even in the case of a mobile camera fitted to a pair of glasses – is likely to fall within the scope of the GDPR.
The CNPD draws your attention to the fact that, in principle, the GDPR does not apply to CCTV systems set up by private individuals for strictly personal purposes, such as on their own property or within their own homes. However, when a camera is used in a communal or public space, the processing of data in question goes beyond the personal sphere and therefore falls within the scope of the GDPR.
The use of smart glasses in a public space could therefore be treated in the same way as the use of CCTV cameras in a public space, depending on the settings used.
In this regard, we would like to draw your attention to our guidelines on video surveillance, which set out the general principles and obligations under the GDPR.
Among the principles and obligations set out in these guidelines, the CNPD would like to draw your attention in particular to the following points:
Legal requirements applicable to such a device
Firstly, in accordance with the principle of lawfulness set out in Article 6 of the GDPR, any processing of personal data must be based on a valid legal basis. In the case of a member of the public wishing to record images of public spaces using smart glasses, it could prove particularly difficult to establish an appropriate legal basis.
Secondly, the principle of transparency requires that individuals likely to be filmed be informed in a clear, prior and comprehensible manner of the existence of such processing, in accordance with Articles 12 and 13 of the GDPR. In practice, the use of a device integrated into glasses makes it difficult, if not impossible, to adequately fulfil this obligation to provide information. The CNPD also notes that smart glasses are particularly intrusive in that they are difficult for people in the vicinity to distinguish from ordinary glasses; as a result, they may be unaware that images or sound are being recorded. Without such information, data processing therefore takes place without the knowledge of the data subjects, which contravenes the rules of the GDPR.
The CNPD also notes that certain smart glasses incorporate features based on artificial intelligence systems, enabling, amongst other things, the analysis of the wearer’s surroundings, the transcription or translation of conversations, or the automated activation of audio or video recording functions.
Such features are likely to involve the additional processing of personal data relating to third parties in the user’s vicinity, sometimes without those individuals being fully aware of it.
Right to one’s own image
Finally, the CNPD would like to draw your attention to the right to one’s own image. Every person has an exclusive right to their own image and to the use made of it. Consequently, any filming or dissemination of images – for example, via social media – requires the prior consent of every person appearing within the camera’s field of view. It is difficult to ensure compliance with this right when using a video surveillance system such as smart glasses.
For further information, please refer to our thematic dossier on the right to one’s own image (in French).
In this regard, it is therefore also possible for the individuals concerned to bring an action for damages and/or an injunction before the civil courts if they consider that the photographs and recordings in question infringe their right to one’s own image. This right belongs exclusively to the individuals who actually appear in the photographs or videos.
Privacy Protection
Furthermore, Article 2(2) of the Act of 11 August 1982 on the protection of privacy provides that “any person who has wilfully infringed another person’s right to privacy by observing, or causing to be observed, by means of any device, a person in a place not accessible to the public, without that person’s consent’ shall be liable to imprisonment for a term of between eight days and one year and a fine of between 251 euros and 5,000 euros, or to one of these penalties alone.
Guidelines on dashcams
For further information on the use of in-vehicle image-capturing devices, the CNPD has drawn up guidelines on ‘dashcam’-type cameras and on the general principles applicable in this area under the GDPR. As the same principles apply to image capture by smart glasses, the CNPD invites you to consult its specific guidelines for dashcams (in French).