Your Premises, Someone Else's Camera

Consider a staged scene in a women's clinic in Seoul. A South Korean visitor arrives wearing smart glasses. The receptionist explains that camera-capable eyewear is restricted and points to a storage case. Two women in the waiting room notice the exchange. The person at the counter must protect patients from a device the clinic neither supplied nor controls.

That is the gap a privacy register cannot resolve. The clinic can account for its own records, cameras and patient systems, but it cannot see what a visitor's glasses capture, where the footage goes or whether anyone in the frame has agreed. A rule for the premises therefore needs to address the device at the door, not pretend it is part of the clinic's processing. CPO Magazine has covered the underlying tension in how biometric technology outpaced the frameworks built to govern it, and the gap has widened since.

This belongs in a visitor conduct policy and physical-security brief, because a data-protection register covers processing the organisation controls. Entry signage, a rule for sensitive areas and staff guidance address the setting directly.

A women's clinic can differentiate its reception, waiting room, consultation and treatment areas. Clear signage, a storage option and a calm explanation before entry make the rule easier to follow than a confrontation after other patients notice.

Enforcement lands on the receptionist. In the Seoul clinic, that person has to explain the restriction to a visitor whose device looks like ordinary glasses and may be prescription, while other women in the waiting room can see the exchange.

Available materials provide little evidence that organisations train staff for this situation. A policy without a script can turn a well-intentioned rule into a difficult incident. Training can test the script with the people who will use it.

A script can separate the rule from an accusation. Staff can state that capture is restricted in a defined area, ask whether the device has a camera function, and point to the storage case or an alternative-access procedure where appropriate. That approach reduces the need to infer intent from the appearance of the glasses.

Escalation should be defined before the first disagreement. Frontline staff need to know when to involve a supervisor, how to handle prescription or assistive claims, and what to record about the incident without collecting unnecessary personal information. The policy is incomplete if those decisions are left to the person at the desk.