Covert recording and facial recognition by private individuals raise ethical questions that consent-based data protection laws struggle to answer. Discuss.

Smart glasses combine HD cameras, ambient audio recording and AI in ordinary-looking eyewear. With them, a person can covertly record bystanders and possibly identify them in real time. This has led Norway to propose a temporary curb on their use in sensitive places [1]. When private individuals carry surveillance tools, consent-based data laws designed around organisations no longer fit well.

Ethical questions raised

• Consent of bystanders: people filmed in a gym, park or locker room may never know they were recorded, so they cannot agree to it [1].
• Dignity and bodily privacy: Norway's list puts schools, playgrounds, healthcare facilities and locker rooms first [1].
• Loss of anonymity in public: facial recognition turns passive footage into instant identification, which can discourage people from moving freely.
• Informational privacy: Puttaswamy (2017) held privacy, including informational privacy, to be part of Article 21 and required any intrusion to be proportionate [4].

Why consent-based laws struggle

• Built around organisations: DPDP duties, such as a standalone and clear consent notice, fall on Data Fiduciaries, not on individual wearers [2].
• Household exemption: the DPDP Act, 2023 does not apply to processing by an individual for personal or domestic purposes [3], and covert recording by a private person often falls here.
• "Publicly available" carve-out: data a person has made public is excluded [3], so matching faces against selfies they posted online may escape the law.
• Rights hard to exercise: a bystander cannot read a notice, or seek access or erasure, from an unknown stranger [2].
• Patchwork of rules: Europe and North America rely on scattered, venue-specific restrictions [1].

Balancing innovation and privacy (way forward)

• Location-based limits: Norway leaves sales and private use untouched and restricts use only where people expect privacy [1]. This is less restrictive than banning the product.
• Evidence first: an expert committee is to study the technology before final rules are made [1].
• Privacy by design: visible recording lights, processing on the device itself, and no facial recognition switched on by default.
• Specific rules for facial recognition by private individuals, alongside DPDP's phased 18-month rollout [2].

Consent is necessary, but it is not enough when the recorder is a private person and the subject is a stranger. Combining DPDP's duties on organisations with rules on where devices may be used, design requirements and expert review, as Norway is trying, can protect the dignity and proportionality that Puttaswamy promised without stopping innovation.