Nobody Files the Assessment for a Camera on a Face

The IAPP's summary of what triggers a DPIA under the GDPR includes large-scale monitoring of public areas among the circumstances requiring a controller to run a data protection impact assessment. Several million camera glasses moving through streets, transit and shops look like a close fit.

Under a conventional compliance analysis, the comparison becomes difficult. An assessment is performed by a controller who determines purposes and means, but consumer glasses present several possible actors. The manufacturer builds the device and sets what it can do, but does not choose when it points at anyone. The wearer chooses that and determines little else. The cloud provider processes data and often has no relationship with the person in the frame.

What keeps the question theoretical is the assumption that a person wearing glasses is engaged in a purely personal activity, which puts them outside the framework entirely.

That assumption may be weaker than it looks. In Ryneš, the Court of Justice held that a home security camera covering a public footpath was not purely personal, and a fixed camera on a wall is a much narrower intrusion than a moving one that crosses a city over the course of a day. The available legal materials do not resolve whether the wearable case would be decided differently.

Manufacturers could publish an assessment covering the deployed fleet, treating aggregate collection as a processing operation instead of asking individual buyers to perform a task they may be unable to do.

The obstacle is structural. No regime attaches controller obligations to a manufacturer for what a distributed population of consumer devices collects. Until one does, the trigger stays on the list and the assessment stays unwritten.

A fleet-level assessment would not establish that the manufacturer controls every recording. It could still describe foreseeable uses, default settings, update mechanisms, data destinations, and the safeguards available to people who never purchased the device. Those are system properties even when the wearer decides when to capture.

The household exemption remains a separate legal question. Its application may vary with the purpose, location, and scale of a particular use. Distinguishing that case-specific issue from the manufacturer's design choices would make the analysis more precise and avoid treating millions of devices as either one controller or millions of identical private activities.