Lorraine Currie

You might pass a house with a video doorbell, a car with a dashcam or someone wearing smart glasses. You could appear in the background of a stranger’s social media video without knowing it had been filmed – let alone where it might end up.

These aren’t unusual scenarios. Cameras and microphones have become such ordinary features of everyday life that we rarely question their presence. But as our expectations of privacy change, questions arise about how data protection law applies to technology we increasingly take for granted.

One of the fundamental principles of UK data protection law is that personal information must be processed lawfully, fairly and transparently. Assessing fairness involves considering, among other things, what individuals might reasonably expect to happen to their information. But what happens when technology itself starts changing those expectations?

I’ve often seen people filming themselves in Glasgow’s George Square as everyone else goes about their day, seemingly unfazed by the possibility of appearing in somebody else’s footage. Ten or 15 years ago, that might have felt rather intrusive. Today, we barely give it a second thought.

Smart glasses take this a step further. Unlike someone holding up a phone, a person wearing them may be recording without anyone around them realising.

In data protection, we sometimes talk about ‘privacy creep’, where information collected for one purpose gradually starts being used for others, without necessarily reconsidering the implications. I think something similar is happening with our expectations of privacy. Each new technology changes what we’re prepared to accept, and the cumulative effect can be significant.

Of course, becoming accustomed to being recorded doesn’t automatically make that recording lawful or fair. But it does raise questions about how we preserve meaningful expectations of privacy when the technology surrounding us is constantly evolving.

There’s another complication worth considering: many people using these recording devices may not realise that data protection law could apply to them personally. The UK GDPR includes a “domestic purposes” exemption for processing personal information obtained for personal or household purposes, but the boundaries of this exemption aren’t always straightforward.

Someone recording their journey on a dashcam for personal use may be covered by the exemption. But what happens if they upload footage showing an identifiable person to a public social media page? Depending on the circumstances, that could fall outside the exemption, bringing data protection responsibilities into play.

Similar questions arise with video doorbells, particularly when cameras capture people beyond the boundaries of someone’s property. In those circumstances, data protection obligations may arise even if the footage is never shared online.

Most people buying a doorbell camera aren’t thinking about data privacy, they’re thinking about seeing who’s at the front door – but that’s part of the difficulty. The legal framework for how to handle this type of recording exists, but there’s a considerable gap between what the law says and how we’re using technology today.

We’re accustomed to reading about companies being held accountable for data protection breaches, but how often do we consider the responsibilities of someone sharing doorbell footage of a neighbour on a local Facebook group?

The responsibilities of individual users are only one part of the picture. There are also questions about the information collected by the connected devices we bring into our homes, and the obligations of the businesses providing them.

Smart TVs are a particularly interesting example. Depending on their features and settings, they can collect information about viewing habits and how we interact with them. Smart speakers and other connected devices introduce further possibilities for collecting data about our daily lives.

Information about what these devices collect and how it is used should be clearly explained in the privacy notices provided when we set them up – but how many people actually read and understand that information? Even as someone working in data protection, I find the prospect of working through lengthy agreements for every connected product exhausting. Sometimes I just want to watch the programme.

Avoiding connected functionality altogether is increasingly challenging. It’s far easier to find a smart TV, phone or even central heating system than to buy one that isn’t connected.

These devices have genuine benefits – but it’s worth asking whether the collection of personal information is a trade-off we understand and truly accept, or one we’ve just come to accept as unavoidable. The growing debate about privacy and smart TVs suggests that some consumers are beginning to question that trade-off.

The Information Commissioner’s Office recently published guidance for businesses providing consumer Internet of Things products and services, reinforcing the importance of transparency, appropriate safeguards and data protection being considered from the outset.

For manufacturers and technology providers, this means building appropriate privacy safeguards into their products and considering how a product might affect people beyond the customer buying it. A video doorbell, for example, might capture delivery drivers or neighbours who have no direct relationship with the manufacturer or service provider. Their privacy still matters.

As connected products become more sophisticated, these questions will only become more relevant.

We don’t necessarily need new laws to address every development in technology; much of the existing data protection framework is capable of dealing with the issues we’re encountering. The greater challenge is making those protections meaningful in practice, helping individuals understand their rights and responsibilities while ensuring businesses meet their own obligations.

Perhaps we also need to become more comfortable questioning the technology we’re offered. Do we really need every feature switched on? Is the information being collected necessary to use the product? Do we understand what happens to our data? Just because we’ve become accustomed to giving up some of our privacy doesn’t mean we should stop questioning how much we’re prepared to give away.

Lorraine Currie is a director at Anderson Strathern