Remix.run Logo
buzer an hour ago

Look at what how GDPR is interpreted in regards to CCTVs and bodycams. You generally do need to give proper Article 13 notice in regards to those recordings. In particular EDPB Guidelines on video recording (3/2019) state that:

> The first layer concerns the primary way in which the controller first engages with the data subject. At this stage, controllers may use a warning sign showing the relevant information. The displayed information may be provided in combination with an icon in order to give, in an easily visible, intelligible and clearly readable manner, a meaningful overview of the intended processing (Article 12 (7) GDPR). The format of the information should be adjusted to the individual location (WP89 par. 22).

> The information should be positioned in such a way that the data subject can easily recognize the circumstances of the surveillance before entering the monitored area (approximately at eye level). It is not necessary to reveal the position of the camera as long as there is no doubt as to which areas are subject to monitoring and the context of surveillance is clarified unambiguously

> The first layer information (warning sign) should generally convey the most important information, e.g. the details of the purposes of processing, the identity of controller and the existence of the rights of the data subject, together with information on the greatest impacts of the processing

While recording by these might not always implicate GDPR directly (as it might be exempted under household exemption or the broader allowances given for journalistic purposes), it does give good idea on how unambiguous it should be.

thyristan an hour ago | parent [-]

> While recording by these might not always implicate GDPR directly (as it might be exempted under household exemption or the broader allowances given for journalistic purposes)

I'd guess that the glasses first transfer the recordings to Meta who process and store them abroad for various commercial purposes. That way of working can never fall under the household or journalistic exemptions. And per GDPR the owner of the glasses is on the hook for whatever Meta is doing, because the owner is (by GDPR) contracting Meta to do data processing for him/her.

buzer 43 minutes ago | parent [-]

I don't think the owner is on the hook if they simply use the service. The individual wasn't the one who truly decided the essential means and purposes beyond personal use, Meta is the one who did that and is thus the controller for that processing.

And I believe in case of European users the contract is between Meta Ireland and user, Meta Ireland is the one who would be the one doing the exporting in that case.

Now if user actually did publish it on Meta's service for broader consumption then they might become controller for that & if initial purpose was that then the initial recording is unlikely to be exempted under household exemption.

thyristan 37 minutes ago | parent [-]

> The individual wasn't the one who truly decided the essential means and purposes beyond personal use

The user is supposed to have read Meta's terms and conditions and agreed to them. Of course nobody does that, but that doesn't absolve of the responsibility, it rather means that the user who uploads stuff to Meta does things in full knowledge and willingly or carelessly. It just might make Meta liable as well, because naturally their terms were sneaky, hidden, unclear and probably illegal.

And I'd guess that Meta Ireland has been sued often enough that they have some export clause deep in their conditions as well, which the user should also have read and agreed to.