Google Translated from German to English:

GDPR vs. Smart Glasses: Why Ray-Ban Meta Carriers Can Be Held Liable

A new data protection report teaches: Anyone who films uninvolved third parties with smart glasses or allows Metas AI training loses the privilege of the budget exception. reading aloud Print view 53 Read comments Close-up of a black Ray-Ban-Meta-Smart glasses with integrated camera in the eyeglass frame and mirrored lenses on a wooden table. Close-up of a black Ray-Ban-Meta-Smart glasses with integrated camera in the eyeglass frame and mirrored lenses on a wooden table.

(Picture: Tada Images/Shutterstock.com) 13:54 Clock Reading time: 4 min. From Stefan Krempl

The dispute over smart glasses in everyday life continues. After prohibition demands occupied the policy and the Federal Network Agency fit in due to lack of handling, the Hamburg data protection officer Thomas Fuchs has followed up with an investigation by the Ray-Ban Meta AI Glasses. The analysis is clear: For the everyday use of data glasses in public spaces, there is therefore hardly a legally compliant basis, as long as Meta does not improve on construction method and presets.

In the laboratory, the Hamburg data protectionists dismantled the first-generation Meta Wayfarer model and analyzed the traffic. They quickly reached their limits: The 32-gigabyte flash memory had no standardized connections, the data transmission of the app remained encrypted. In the application memory of the smartphone, however, the examiners came across a discovery: In the internal SQLite database, there are table structures with designations such as “face”, “face_group” or “face_low_confidence_pair”.

Although these tables remained empty in the tests and currently no biometric facial recognition takes place, the substructure for automated person matching is already anchored. The authority also refers to security researchers who briefly managed to unlock a facial recognition function. Meta responded with a covert update. The fact that the Group is technically providing for the identification of people in the future by comparison is a bad blow to the inspectors.

Another point of criticism concerns transparency towards third parties. Externally, the data glasses hardly differ from the Wayfarer classic from the 1950s. Passers-by do not realize that they are captured by video camera, five microphone systems and AI assistant. The signal light proves to be largely ineffective: In daylight, the white LED is barely perceptible and sometimes does not signal direct AI interactions at all. When spectacle wearers become data processors

In addition, there is the vulnerability to manipulation. The protective mechanism, which is intended to prevent images when the LED is concealed, can be tricked with foils or caps. Video recordings launched once continue, even when the signal light is subsequently taped off. This means that the glasses miss the European privacy-by-design requirement. According to the report, this allows for secret surveillance that is incompatible with the General Data Protection Regulation (GDPR).

The classification of data protection law is of serious consequences for the buyers themselves. The budget exception protects private individuals from the GDPR obligations when taking up in a private environment. Anyone who films strangers in public spaces or publishes recordings on social media loses this privilege. The authority clarifies that carriers then become fully responsible data processors. Intractable hurdles in everyday use

The situation becomes even trickier if users do not object to the meta default setting and train the AI model with interaction data. If images and audio signals of third parties are transmitted to the USA for AI training, the data leaves the private purpose. Users thus slip into joint responsibility with the US group pursuant to Article 26 GDPR. Since Meta does not offer an agreement to divide the duties, spectacle wearers move on thin ice.

In order to lawfully process images or conversations of third parties, institutions would either have to obtain informed consent or prove an overriding legitimate interest. Both fail because of everyday realities: effective approval requires prior enlightenment, which is in fact impossible in the face of the inconspicuous glasses. It doesn’t look like a common camera. Video recordings in public spaces can exceptionally be based on legitimate interests. With activated AI functions, however, the rights of the filmed almost always outweigh the rights.

Anyone who walks through the city with the glasses would have to inform passers-by in advance orally or even wear safety vests with inscriptions in order to meet the requirements of the European Court of Justice. Particularly sensitive are medical practices, demonstrations, women’s shelters or playgrounds. The use of the Ray-Ban Meta AI Glasses in public space is thus difficult to legally design under data protection law.