Smart Glasses and Privacy: What Does the DPL Say?
Selin Çetin Kumkumoğlu
Of Counsel
Yaren Alparslan
Associate
Buse Sığın
Trainee
The Personal Data Protection Authority (the “Authority”) has drawn public attention to the key considerations regarding the protection of personal data and privacy in the use of smart glasses. As smart glasses can process various types of data, including location, date, time and usage data, in addition to audio and visual recordings, their use requires careful consideration from a personal data protection perspective.
Key Considerations Highlighted by the Authority
The Authority states that users of smart glasses should respect the privacy of individuals around them when making audio or visual recordings and ensure that such recordings are limited to what is necessary. Particular attention should be paid to the fact that, due to advanced microphone technology, conversations may be recorded without the individuals concerned being aware of it. The Authority recommends refraining from using recording features in environments where individuals would not reasonably expect to be recorded or where expectations of privacy are heightened. These features should also be disabled in locations where recording is prohibited or where the use of other recording devices is restricted.
The Authority further notes that smart glasses may process additional data, such as location, date, time and usage data, in addition to audio and visual data. Accordingly, users are advised to configure and regularly review the devices’ privacy and security settings to ensure the protection of personal data. Before sharing photographs or videos featuring other individuals, users should consider the potential implications of such sharing and obtain the consent of the individuals concerned where necessary. Recordings should not be retained for longer than necessary and should be deleted once they are no longer needed. Finally, users should bear in mind that making audio or visual recordings, or sharing such recordings, may give rise to legal or criminal liability, depending on the circumstances of the specific case.
Assessment from a Personal Data Protection Perspective
The Authority’s statement does not introduce a new regulatory framework specifically for smart glasses under the Personal Data Protection Law (the “DPL”). Rather, it highlights that the existing principles and obligations relating to personal data protection must also be taken into account in the context of this technology.
In this regard, the recording of images or audio of individuals in the vicinity through smart glasses may constitute the processing of personal data under the DPL, provided that the individuals concerned are identified or identifiable. Accordingly, the use of smart glasses should be assessed in light of the specific circumstances of each case, with due consideration given to matters such as the processing of personal data for specified purposes and in a manner that is limited to and proportionate to those purposes, the legal grounds for processing, data minimisation and data security. Furthermore, where data recorded through smart glasses qualifies as special categories of personal data, the additional data security measures required for the processing of such data must also be implemented.
In addition, given that manufacturers and service providers whose devices or associated applications collect such data are often based abroad, the potential transfer of personal data abroad must also be assessed in accordance with the applicable data protection requirements.
Conclusion
The growing use of smart glasses gives rise to new considerations concerning personal data protection and privacy. In this context, users of smart glasses are advised to review their practices in light of the Authority’s statement.
