In a written answer published on 30 July 2026, Commissioner Michael McGrath, on behalf of the European Commission, told MEP Cynthia Ní Mhurchú (Renew) that existing EU law – the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) – already provides the legal framework for addressing non-consensual recording using camera-enabled smart glasses and the publication of such footage. McGrath stressed that any controller or processor of personal data is subject to GDPR obligations, including fairness, transparency and data protection by design and by default, and pointed to the DSA's requirement for online platforms to offer user-friendly notice-and-action mechanisms for reporting illegal content. He did not announce any new legislative or regulatory measures, instead referring to existing enforcement structures: national data protection authorities and courts are responsible for GDPR supervision, while the Commission enforces the DSA only for designated very large online platforms and search engines.
The answer responds to a parliamentary question from Ní Mhurchú, who cited media reports of content creators using smart glasses to film public-facing workers and members of the public without their knowledge, then editing, uploading and sometimes monetising the footage. She had asked whether such processing triggers GDPR obligations, whether the Commission had engaged with the Irish Data Protection Commission or the European Data Protection Board (EDPB), and whether the Commission would consider EU-level guidance or standards on recording indicators, anti-tampering safeguards and platform procedures.
McGrath's reply confirms that GDPR obligations can indeed apply to recorders and uploaders, but he offered no new commitments. He noted that data protection authorities have previously examined smart-glasses compliance and recommended transparency measures, and that the EDPB has considered the impact of such devices. The Commission's position is that existing rules are sufficient, and that any further action would fall to national authorities or the EDPB. The answer reflects a deliberate choice to avoid new EU-level intervention, leaving the current division of competences intact: GDPR enforcement remains with national bodies, and DSA enforcement with the Commission only for the largest platforms.
The response signals that the Commission sees no gap in the legal framework, despite concerns raised by the MEP about hidden cameras and limited ability to object. For individuals filmed without consent, the practical impact depends on national data protection authorities' willingness to act; for content creators and platforms, the answer clarifies that they remain subject to existing obligations, but without new guidance or harmonised standards, compliance may remain uneven across member states. The Commission's stance is likely to be welcomed by industry for avoiding additional regulatory burden, but criticised by privacy advocates who argue that clearer EU-level rules are needed to address the specific challenges of covert smart-glasses recording.