Hacker News Reader

Comment by thyristan | Hacker News Reader

> While recording by these might not always implicate GDPR directly (as it might be exempted under household exemption or the broader allowances given for journalistic purposes)

I'd guess that the glasses first transfer the recordings to Meta who process and store them abroad for various commercial purposes. That way of working can never fall under the household or journalistic exemptions. And per GDPR the owner of the glasses is on the hook for whatever Meta is doing, because the owner is (by GDPR) contracting Meta to do data processing for him/her.

View on HN

I don't think the owner is on the hook if they simply use the service. The individual wasn't the one who truly decided the essential means and purposes beyond personal use, Meta is the one who did that and is thus the controller for that processing.

And I believe in case of European users the contract is between Meta Ireland and user, Meta Ireland is the one who would be the one doing the exporting in that case.

Now if user actually did publish it on Meta's service for broader consumption then they might become controller for that & if initial purpose was that then the initial recording is unlikely to be exempted under household exemption.

> The individual wasn't the one who truly decided the essential means and purposes beyond personal use

The user is supposed to have read Meta's terms and conditions and agreed to them. Of course nobody does that, but that doesn't absolve of the responsibility, it rather means that the user who uploads stuff to Meta does things in full knowledge and willingly or carelessly. It just might make Meta liable as well, because naturally their terms were sneaky, hidden, unclear and probably illegal.

And I'd guess that Meta Ireland has been sued often enough that they have some export clause deep in their conditions as well, which the user should also have read and agreed to.

The full analysis of this would need to take in account:

* Who actually determines the essential means and purposes for each processing purpose (and is truly doing it). Fashion ID case is quite relevant here.

* If terms which grant Meta these rights and user a lot of obligations would fall under unfair terms or unfair commercial practices directives. If they do then those aspects of the terms are invalid. These could, for example, affect requirement that the user must get consent from data subject for Meta's processing operations.

Reply on news.ycombinator.com