‘Smart glasses’ attract Australian privacy regulator scrutiny

Carly Kind was commenting after a raft of major technology companies announced they had developed, or are in the course of developing, so-called smart glasses – spectacles that can record what their wearers can see and hear. Some retailers have also confirmed plans to sell these devices.

In a blog post, Kind said that while the use of smart glasses and other “surveillance wearables” will most often be “benign”, the technology could be deployed in “harmful ways”. She said a distinction should be drawn between “place-based surveillance, such as that we find in airports and in certain retail spaces which have been able to meet the relevant thresholds to justify its deployment, and surveillance wearables in the hands of every roving individual, designed for discretion (or even concealment)”.

According to Kind, new legislation might be required to address the anticipated proliferation of surveillance wearables since there are gaps in how Australia’s existing privacy framework applies to personal information collected through such devices.

“The coverage of the Privacy Act stops short of personal information collection by individuals themselves,” said Kind. “So, where the data collected through wearables is processed on the device itself or is otherwise not within the control of a regulated entity, for example because the images are stored directly on the device until uploaded to a personal computer, it may not fall within the remit of the Act, necessitating the use of other legal means for redress.”

Kind identified the recently introduced standalone tort of serious invasions of privacy, in Schedule 2 of the Privacy Act, as an avenue that would be available for claims against individuals, where a smart glasses user intentionally or recklessly invaded another person’s privacy through their use, without justification and the person suffered serious harm as a result. Kind also referred to the forthcoming Digital Duty of Care, which the federal government is planning to legislate for. This will require entities – including hardware providers – to take reasonable steps to maintain processes and systems that, among other things, prevent activity that is illegal or harmful to children.

Kind added that her office is “giving serious consideration to the issues raised by surveillance wearables and monitoring their market presence in order to understand if scrutiny and intervention is required or warranted”.

The blog, however, cited how Australia’s Privacy Act will apply to businesses developing surveillance wearables in circumstances where they, not just the individual users, are “receiving and storing personal information collected by” those devices. Kind said “there are real questions” as to whether those businesses will be able to meet their compliance obligations in practice.

“How will they notify individuals that their images or voice has been recorded?” Kind said. “If they’re making facial recognition features available, how will they ensure that they have the consent of the people whose faces the tech is analysing?”

Kind said the second tranche of reforms to the Privacy Act that the Australian government is currently working on “are likely to include expanding the scope of application of privacy law in ways that create additional hurdles for the developers of surveillance wearables”.

“Under the proposed reforms, for example, entities will need to be able to demonstrate that their collection and use of personal information, including to train AI models, is both fair and reasonable,” Kind said. “Higher standards around consent, more protections on geolocation data and an expanded definition of personal information are also likely to strengthen my hand as Australia’s privacy regulator in scrutinising these tools.”

According to the privacy commissioner, however, compliance with privacy obligations “is likely to be only one part of the puzzle”. She said businesses need to win the public’s trust over the deployment of surveillance wearables.

“As long as public trust in technology companies remains extremely low, the bar for establishing a social licence for rolling out new tech will be high,” Kind said.

Last year, when setting out its regulatory priorities, the Office of the Australian Information Commissioner (OAIC) cited “new surveillance technologies” as among the “new and emerging technologies with high impact” that it will “protect and uphold privacy and information access rights” in relation to. It also referenced facial recognition technology (FRT) in this regard too.

In February this year, a tribunal partially overturned the privacy commissioner’s decision on Bunnings’ use of FRT. At the time, Veronica Scott of Pinsent Masons, who specialises in privacy and technology law, said the decision would help shape how FRT is deployed in Australia.

Commenting on Carly Kind’s latest blog, Scott said the deployment of surveillance technologies raises intersecting legal, ethical and practical questions, including around consent to data processing, data security, and AI-related risks.

“The legal and practical challenges associated with AI-enabled smart glasses, among other recording devices that are readily available, are only going to become more prominent as adoption increases, and there is a good opportunity to explore the employment and workplace health and safety implications alongside privacy, employee monitoring, consultation obligations and emerging governance considerations,” Scott said. “The convergence of surveillance, workplace, privacy and criminal laws as well as community attitudes to both business and personal use of these wearables will need to be carefully navigated.”