Is a trainer recording a course using smart glasses? Find out when this counts as processing personal data under GDPR and what obligations apply.
Imagine a common situation: you attend a hands-on training course, and throughout the session the trainer wears smart glasses equipped with a camera and microphone. The intention is educational – the trainer wants to use the recorded material to create a presentation for their website. To participants, this may seem inconspicuous – after all, they're just glasses, an ordinary (fashionable) accessory. From the perspective of interference with another person's privacy, however, this situation is far more complex than it first appears, for several reasons.
Does This Constitute Processing of Personal Data?
Yes. If the recording captures a participant's face, voice, physical appearance, or other expression by which they are directly or indirectly identifiable, this constitutes personal data within the meaning of Art. 4(1) GDPR. The recording itself, as well as its subsequent processing, editing, and publication on the website, constitutes processing of personal data under Art. 4(2) GDPR – it involves the collection, recording, and disclosure of data.
With smart glasses, the question of biometric and audio data is also relevant. A voice recording, combined with other elements (e.g., voice pattern analysis), can be more sensitive than a standard static image, and smart glasses typically also capture ambient sound around the trainer – meaning not only participants' contributions during the presentation itself, but also their conversations with one another.
Does the Personal-Activity Exemption Apply to the Trainer?
No. Under Art. 2(2)(c) GDPR, the regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity. However, Recital 18 GDPR explicitly states that this exemption applies only to activities with no connection to a professional or commercial activity. The Court of Justice of the EU (e.g., in Case C-212/13, Ryneš) has likewise confirmed that the exemption does not apply to processing that extends beyond a person's purely private sphere and is directed toward publication or professional use.
In the situation described, the trainer records the course with a clear professional purpose – promoting their own activity and creating educational material for a website. For this reason, the personal/household activity exemption does not apply, and the trainer becomes a data controller within the meaning of Art. 4(7) GDPR.
Why Smart Glasses Pose a Particular Risk
Smart glasses with a built-in camera (e.g., Ray-Ban Meta and similar devices) have one crucial difference from a conventional camera or mobile phone: recording is visually almost impossible to detect. The French supervisory authority, CNIL, in its notice from May 2026, emphasized that this very inconspicuousness makes such devices a particular privacy risk, since data subjects often don't even notice they are being recorded and therefore cannot effectively exercise their rights.
A conventional camera or a phone held in hand signals an intent to record – it is a recognizable act. With smart glasses, this signal is absent or extremely weak (e.g., a tiny LED indicator), which several experts – and even the manufacturer itself – have repeatedly criticized in practice as an inadequate warning to bystanders. In practical terms, this means participants in a course have no real way of recognizing exactly when they are being recorded, nor of avoiding it, unless the trainer clearly and explicitly informs them in advance.
This circumstance has a direct impact on the assessment of the lawfulness of the processing – it reduces the predictability of processing for data subjects and increases the transparency requirements that the controller (the trainer) must meet.
What Legal Basis Can the Trainer Use
When choosing a legal basis under Art. 6(1) GDPR, realistically only two options come into consideration:
- Consent of course participants [Art. 6(1)(a)] – must be freely given, specific, informed, and unambiguous; in practice this is the more suitable option, especially if the recording is to be published online.
- Legitimate interest [Art. 6(1)(f)] – requires carrying out a proportionality (balancing) test, by which the controller demonstrates that their interest in creating promotional/educational material does not outweigh participants' right to privacy.
Consent is the preferred legal basis in this case, particularly because the recording is intended to be published to the public on a website. When publishing recordings containing identifiable individuals, explicit consent is the safest and most transparent choice – it reduces the risk of disputes over the adequacy of the trainer's interest and gives participants real control over their image and voice.
Legitimate interest might be a viable option for internal use of the recording (e.g., for improving one's own teaching without publication), but not where the intention is to publish the material to the general public. Public disclosure significantly increases the interference with data subjects' rights, which typically tips the proportionality test in their favor.
What Obligations the Trainer Should Have Fulfilled
As a controller, the trainer has several obligations before and during the recording:
- Duty to inform (Art. 13 GDPR) – participants must be informed in advance, clearly and comprehensibly, that recording is taking place, for what purpose, who the controller is, how long the recording will be retained, and where and how it will be published. It is not sufficient to rely on a participant "noticing" the LED indicator signaling that recording is underway.
- Obtaining consent (if consent is the legal basis) – consent must be demonstrable, for example through written confirmation or another record of it being granted, and it must be possible to withdraw it at any time.
- Data minimization principle (Art. 5(1)(c)) – the trainer should record only to the extent necessary for the purpose (e.g., focusing the recording on themselves and their own presentation, not continuously and needlessly on participants' faces).
- Transparency and fairness principle (Art. 5(1)(a)) – participants should have a real opportunity to opt out of the recorded part of the course or to request exclusion from the recording, for example by changing their position in the room.
- Appropriate retention period (Art. 5(1)(e)) – the recording should not be kept longer than necessary for processing and publishing the final presentation.
- Data security (Art. 32 GDPR) – the raw recording (including any more sensitive moments, such as private conversations among participants) must be protected against unauthorized access.
If the course were organized by a legal entity (e.g., a training agency) and the trainer recorded on its behalf, the controller would primarily be that organization, not the trainer personally; in that case, the trainer would be acting on its behalf and in accordance with its instructions. For the purposes of this article, we assume a model situation in which the trainer acts as an independent controller.
What the Trainer Can and Cannot Do With the Recording
The trainer's obligations do not end once the recording is made. The following applies to further handling of the recording:
- Publishing the recording online is only permitted to the extent and in the manner participants had the opportunity to consent to (or which was covered by legitimate interest and a proportionality test).
- Before publication, the trainer should consider anonymizing or blurring the faces of participants who did not consent to publication, or editing the recording so that non-consenting, identifiable participants do not appear in the footage at all.
- Participants have the right of access to data (Art. 15), the right to erasure (Art. 17), and the right to object (Art. 21) – if a participant, after the course, requests deletion of their part of the recording or its removal from the website, the trainer is in principle obliged to comply, unless there is an overriding legitimate reason for further processing.
- The recording must not be used for any purpose other than the one for which it was originally made and about which participants were informed (purpose limitation principle, Art. 5(1)(b)). Use for an unforeseen purpose – for example, resale to third parties or use for machine learning – would require a new legal basis and a new duty to inform.
- If the recording also contains audio of conversations among participants themselves (not just the trainer's presentation), these parts should be removed before publication, unless participants gave explicit consent to publish that part as well.
Conclusion
Recording a training session using smart glasses is not merely a technical curiosity – it is full-fledged processing of personal data, subject to all GDPR obligations. In such a situation, the trainer becomes a data controller and must inform participants in advance and clearly about the recording, choose an appropriate legal basis (generally consent, especially where publication is planned), observe the minimization principle, and respect data subjects' rights even after the course has ended. Particular attention should be paid to the inconspicuousness of smart glasses – far from reducing the trainer's legal obligations, it in fact increases the transparency requirements, since without a clear warning, participants have no real way of knowing they are being recorded.
