Smart glasses at the municipality: what the EDPB statement of 13 October means

Imagine the inspection and enforcement team of your Dutch municipality wants to give its housing inspectors smart glasses. Hands-free photos of damp and mould, a conversation with a tenant translated on the spot, and the glasses' AI assistant reading out what a fire alarm panel says. The supplier calls them ordinary glasses with a few extra features. You are the data protection officer (DPO). What do you say?

Since 13 October 2026 you can rely on a European text. The European Data Protection Board (EDPB) then adopted Statement 1/2026 on smart glasses. It is not a guideline but a first set of reflections, the EDPB says itself, and further work will follow.

What the EDPB writes

The statement defines smart glasses as wearable devices that often look like ordinary glasses or sunglasses, with cameras, microphones, speakers and software, often with AI for purposes such as translation or object identification. If such glasses process data about identifiable people, the GDPR applies.

According to the EDPB, the problem lies in the form. Smart glasses are hard to tell apart from ordinary eyewear. Recording can therefore be almost invisible, sensitive microphones pick up conversations the wearer is not part of, and combined with facial or voice recognition they pose a high risk in public spaces, the EDPB says. Even when people do recognise the glasses, they may change their behaviour because they feel watched.

Lesson 1: work is never purely personal

Someone who takes a photo for themselves and shares it only with family falls outside the GDPR (Article 2(2)(c) GDPR). According to the EDPB that exemption is narrow and must be assessed case by case, with a reference to the Court of Justice judgment in Ryneš (C-212/13). It does not apply when footage is shared with an indefinite number of people, such as through a public account (for this the EDPB refers to the judgments in Lindqvist and Buivids), nor to use for official, professional, political or other non-personal activities.

A housing inspector working with the glasses is therefore always covered by the GDPR. The municipality decides why and how the processing takes place, which makes it the controller. A staff member's own glasses are covered too as soon as they are used for work.

Lesson 2: the provider of the AI feature is not automatically your processor

The EDPB points out that the producer of the glasses and the provider of a linked service, such as an AI assistant, may themselves be controllers, alone or jointly with others. The statement gives as an example a provider of the AI feature that processes images from the camera to give the wearer an answer about their surroundings, for instance images in which other people appear. Such a controller may not shift its own obligations, such as transparency towards bystanders, onto the wearer.

For the municipality this means: work out per feature who decides what. If the supplier processes images only on your instructions, it is a processor and you conclude a processing agreement. If it also uses them for its own purposes, such as improving or training its AI, it is no longer a processor for that part. With glasses made for consumers, the provider often determines the purposes and means itself; processorship must then be right both in the contract and in practice. Further use for a new purpose must be compatible with the original purpose (Article 6(4) GDPR), and according to the EDPB particular attention should be paid to the fact that bystanders often have no relationship at all with the provider.

Lesson 3: choose the legal basis before the glasses go on

The EDPB discusses two legal bases. Consent can be a legal basis, and where national law on the right to one's image requires consent for publishing someone's image, the EDPB considers it likely the most appropriate one. But for a producer or AI provider with no relationship with bystanders, valid consent is hard to obtain. Consent obtained afterwards, after the recording, is never valid: the legal basis must exist before and during the processing. Legitimate interests require a careful case-by-case balancing exercise, and according to the EDPB are particularly hard to demonstrate for commercial reuse beyond the service the wearer asked for, or for AI training, which bystanders do not expect. Moreover, bystanders must then always be able to object.

For a municipality, one of those two drops out straight away. A public authority cannot rely on legitimate interests when performing its tasks (Article 6(1), last subparagraph, GDPR). Consent is not an obvious choice for a public authority either: Recital 43 GDPR cites the imbalance between citizen and authority as a reason why consent is then rarely freely given. What remains is usually the public task (Article 6(1)(e)), with a basis in the law that assigns the task: for housing inspection the Dutch Environment and Planning Act and Housing Act, with the supervisory powers in Division 5.2 of the General Administrative Law Act. That is not in the statement itself; it follows from the GDPR. Then test whether a camera on someone's head is actually necessary, or whether an ordinary photo with a tablet would do.

Lesson 4: a privacy notice does not reach the tenant

According to the EDPB, transparency is a major challenge with smart glasses. A traditional privacy notice does not seem sufficient to inform bystanders. The EDPB recommends that controllers and producers consider combining several measures, including by default a signal at the moment that processing takes place:

• a light that is visible in many lighting conditions, stays on long enough, and makes recording impossible when it is covered;
• a sound, such as a click when a photo is taken, or a command that has to be spoken out loud;
• a notification on the phones of people nearby, but never as the only means;
• a design that lets people tell smart glasses from ordinary ones.

Such technical measures must be effective, hard to circumvent and kept up to date. The wearer, too, must respect others, and the EDPB says that explicitly telling people you are wearing smart glasses is relevant. For the housing inspector that means: say before recording that the glasses record and what happens with the footage, and give the information required by Article 13 GDPR, for example briefly at the door with a leaflet for the details. The same applies to other residents and visitors who come into view.

Lesson 5: frugal is the default

The EDPB lists additional measures that reduce risks, and some can be used directly as requirements in a tender:

• Limit continuous recording, live streaming and retention periods. According to the EDPB, a general or hypothetical concern for one's own safety alone does not justify continuous recording of others.
• If the glasses are mainly meant for real-time assistance, switch off storage of images and sound by default, unless storage is needed for the function, such as recording defects.
• Blur bystanders' faces, pseudonymise or anonymise before sharing, and process on the device itself where possible.
• Location-based restrictions in places that are sensitive.

The EDPB also names those sensitive places: medical facilities, schools and places where children are present, changing rooms, swimming pools, beaches and toilets. For a municipality, that includes its own swimming pool, the sports hall and the inside of a home. Children deserve particular attention according to the EDPB, because they are less likely to recognise smart glasses. If footage is processed outside the EU, the transfer rules apply; the EDPB also mentions the ePrivacy rules for information on the device itself.

Lesson 6: expect a DPIA and the works council

The Dutch Data Protection Authority's (AP) list of processing operations that require a DPIA does not mention smart glasses by name. It does list "flexible camera surveillance": large-scale and/or systematic use of cameras on clothing or helmets, with fire and ambulance staff as the example (Stcrt. 2019, 64418, category 10). Glasses that inspectors wear systematically during home visits come close to that. Category 14 (internet of things) may also count, and depending on the use category 9 (camera surveillance of publicly accessible spaces, for enforcement officers on the street), 11 (employee monitoring) and 17 (biometrics). Apart from that, the GDPR expressly mentions new technologies when assessing whether processing is likely to result in a high risk (Article 35(1)). So carry out the DPIA before the pilot.

The glasses also film colleagues, and the AI feature can keep track of what the wearer does. The EDPB names employee monitoring and the confidentiality of business information as workplace concerns. Under Dutch law, rules on facilities suitable for observing staff attendance, behaviour or performance require works council consent (Article 27(1)(l) of the Works Councils Act), as do rules on processing their personal data (point k). That is different where the collective agreement already regulates the matter in substance (Article 27(3)). So submit the proposal in good time.

Lesson 7: no facial recognition, and check what the AI Act says

Facial recognition on smart glasses processes biometric data to identify someone. That is prohibited in principle (Article 9 GDPR). Besides explicit consent, which a municipality rarely obtains freely, Article 29 of the Dutch GDPR Implementation Act only allows it where necessary for authentication or security purposes, and only insofar as a substantial public interest in lawful access to certain places, buildings, services or systems requires it. Recognising a resident on the street or in their home does not fall under that.

The AI Act adds a layer on top:

• Emotion recognition in the workplace has been prohibited since 2 February 2025, except for medical or safety reasons (Article 5(1)(f)). Glasses that read colleagues' moods are therefore not allowed.
• Real-time remote biometric identification in publicly accessible spaces for law enforcement is prohibited, save for a few narrowly defined exceptions (Article 5(1)(h)). That may also affect municipal enforcement officers (boa's) who investigate criminal offences; administrative housing inspection generally does not fall under it.
• Other remote biometric identification systems, and emotion recognition that is not prohibited, are high-risk (Annex III point 1), insofar as Union or national law permits their use. Those obligations apply from 2 December 2027.
• Anyone deploying emotion recognition or biometric categorisation must inform the people exposed to it. That obligation has applied since 2 August 2026 (Article 50(3)).

An AI assistant that only translates text or reads out a rating plate is not a high-risk system. The municipality must, however, take measures under Article 4 AI Act to support the AI literacy of staff who use the glasses. Otherwise the GDPR remains the framework.

And if a resident wears the glasses?

If a resident wears smart glasses at the front desk or in a consultation room, that is usually not processing by the municipality. For purely personal use, the GDPR does not apply to the resident. If they share a recording with an indefinite number of people, such as through a public account, it does. According to the EDPB, the producer and the provider of the AI service are covered by the GDPR insofar as they process personal data themselves, even when the wearer is not. The statement notes that some establishments restrict the use of smart glasses on their premises. Discuss with your legal department whether you want a house rule for sensitive rooms, such as the social team's consultation room, and how you would enforce it.

For a bank and a school

A bank, as a business, can rely on legitimate interests. The EDPB calls that a careful case-by-case assessment, in which bystanders must be able to object. The EDPB also mentions the confidentiality of business information, such as trade secrets. For client data the bank's own duty of confidentiality applies as well.

A school is, according to the EDPB, a place where recording may be inappropriate or prohibited because children are present. Emotion recognition in education is prohibited under the AI Act, as it is in the workplace, except for medical or safety reasons (Article 5(1)(f)). A school that allows or hands out smart glasses should set out in its rules where they must come off.

What to do now

1. Find out whether smart glasses are already in use, including staff members' own glasses.
2. Record per feature who the controller is, and exclude reuse and AI training by the supplier in the contract.
3. Determine the legal basis and test whether a camera on someone's head is actually needed.
4. Require a light that cannot be covered up, storage switched off by default and no continuous recording.
5. Carry out a DPIA before the pilot and submit the rules to the works council.
6. Exclude facial and emotion recognition in the specifications.
7. Agree whether you want a house rule for sensitive rooms.

Want to check which obligations apply to your own processing under the GDPR and the AI Act? Use the free case check. Decisions and guidelines on the GDPR are collected under GDPR guidelines.

What remains open

• A proper guideline. The statement is preliminary. The EDPB is continuing its work on smart glasses and other video devices that raise the same questions.
• The DPIA list. The AP's list of processing that requires a DPIA dates from 2019 and does not mention smart glasses by name.
• Who decides what for glasses with an AI assistant. That differs per product and per setting, and you have to work it out per supplier.