More than 200 people joined the 11th Nordic Privacy Arena (NPA), the Nordic region’s largest annual event on data protection, in Stockholm and online.

The theme of NPA 2026 was Innovation and Compliance in the Era of Cloud, AI and Geopolitical Uncertainty – Because Accountability Can’t Be Outsourced.

This article is the first in a three-part series on presentations and discussions from the event.

At the conference, Anna Berlee, Professor of Data Protection and Privacy Law at the Open University in the Netherlands and Chair of the Dutch Privacy Association, Vereniging Privacy Recht, explored a simple question: how should we live together when one person’s device can observe everyone around them?

Her presentation, The bridge on a stranger’s face, did not begin with legislation or legal definitions. Instead, Anna took the audience into two Norwegian children’s stories: In the Forest of Huckybucky and When the Robbers Came to Cardamom Town.

Both stories concern communities whose members have different interests and different levels of power. To live together peacefully, they need rules. They also need someone to uphold those rules.

The law of Huckybucky Forest

The animals of Huckybucky Forest adopt a straightforward rule: they must not eat one another.

For the fox, the rule restricts his behaviour. For the mouse, it offers protection. It allows him to move through the forest with less fear.

Anna used this example to explain how law can change a relationship between parties with unequal power. A rule may impose a burden on one party while creating freedom and security for another.

This is also true of data protection law.  The GDPR gives individuals rights where they might otherwise have little practical influence. It also requires organisations to change how they process personal data.

However, adopting a rule is only the beginning. The rule must work in practice, and each party must fulfil its responsibilities.

Introducing smart glasses

Anna then introduced something that does not appear in the original story: a pair of smart glasses.

Smart glasses can provide clear benefits to the wearer. They can take photographs, provide information, or offer assistance without requiring someone to use a phone. They may also support some persons with disabilities in understanding and navigating their surroundings.

However, the glasses may affect people who never chose to use them. They may record, analyse, or transmit information about anyone within view.

This makes smart glasses different from many other wearable devices. A smart watch mainly affects the person wearing it. Smart glasses can affect everyone nearby.

Their impact also changes as the wearer moves between places. The device may travel from a family celebration to a workplace, a public street, or a demonstration.

The technology remains the same, but the context changes.

Looking beyond data protection

Anna’s central argument was that smart glasses do not raise only data protection questions.

Data protection law provides one important lens. It can help determine whether someone processes personal data and who carries specific legal obligations.

However, other legal frameworks may also apply.

The right to private life remains relevant, including in public spaces. Criminal law may address serious forms of covert recording. The EU Artificial Intelligence Act may apply to particular functions or uses like facial recognition.

Data protection authorities are already examining smart glasses. However, they are doing so specifically through the lens of data protection law. The Hamburg Commissioner for Data Protection and Freedom of Information has published an analysis of smart glasses, including the responsibilities that may arise for different parties involved in the processing. The European Data Protection Board is also working on guidance (see the end of the article). This work can clarify how the GDPR applies, including questions about controllership, legal bases, transparency, and the household exemption.

However, Anna cautioned against treating guidance from data protection authorities as the complete answer to how society should deal with smart glasses. Norway has announced work on stronger regulation of smart glasses and established an expert group to consider possible measures. Anna welcomed the fact that the Norwegian discussion referred not only to data protection, but also to the right to private life. This wider approach matters because data protection guidance cannot, by itself, address every effect that smart glasses may have on public space, private life, freedom of expression, or freedom of assembly.

Smart glasses may create a chilling effect on freedom of expression, assembly, and demonstration. People may speak or behave differently simply because they could be recorded, even when they do not know whether recording is taking place. Anna compared this with Jeremy Bentham’s panopticon: the possibility being observed can be enough to change people’s behavior. The same effect can arise in an ordinary conversation, where trust often depends on the expectation that the moment will pass without becoming a permanent record.

Roles change with the context

Smart glasses move with the wearer, but the same legal analysis does not follow them everywhere.

Taking a private photograph at a celebration differs from an employer recording an employee’s work. Both differ from asking an artificial intelligence assistant for information about someone nearby.

The person wearing the glasses may also occupy different roles.

Someone may use smart glasses for accessibility in one situation. In that context, restrictions on the device could limit that person’s participation.

In another situation, the same wearer may record or analyse other people. The wearer may then affect their rights and freedoms.

A person might use the glasses privately at home, professionally at work, or for journalistic purposes. Each context raises different questions.

The same person can therefore need protection in one encounter and carry responsibility in the next.

This makes simple labels difficult to apply. We cannot decide someone’s role or responsibility by looking only at the device on their face.

Who carries responsibility?

The person wearing the glasses is the person we can see. However, that person may not make all the important decisions.

A manufacturer or service provider may determine which information the system collects. It may also set how long the data is stored or decide how the information trains an artificial intelligence model.

The provider may have the power to change a default setting across millions of devices. An individual wearer cannot normally exercise that kind of influence.

However, providing the device does not automatically make a company the controller for every processing operation. Responsibility still depends on who determines the purposes and means of the specific processing.

The analysis must therefore cover more than the visible wearer. It must also examine the product, the service, its settings, and the organisations behind it.

Anna connected this problem to the police chief in Cardamom Town. The community expects him to investigate its problems, but his position does not give him unlimited powers.

Data protection authorities face a similar limitation. They can interpret and enforce data protection law, but they cannot resolve every issue created by smart glasses.

They cannot make legislative choices or regulate every interference with private life. They also cannot exercise powers that the law assigns to other authorities.

This is why smart glasses require cooperation across different legal and regulatory fields.

Living without solving the legal puzzle

Anna ended by returning to the mouse in Huckybucky Forest.

For the mouse, the value of the forest’s rule was practical. It allowed him to move through the forest with less fear.

Anna argued that we should explain modern regulation in similarly human terms. We should ask what the law enables people to do in their everyday lives.

People should be able to meet someone and have a conversation without first conducting a legal assessment.

They should not need to identify the controller, examine legal exceptions, or establish which authority has jurisdiction before deciding whether they can speak freely.

We cannot expect everyone to become an expert in every technology they encounter.

People can need protection in one encounter and affect the rights of others in the next. Because these roles change, advice to individual users is not enough. We also need enforceable rules for the products, services, and organisations involved.

The test is whether people can go about their lives, meet others, and have conversations without solving that legal and technical puzzle.

Accountability must reach each level. This means holding users responsible for their conduct, placing enforceable duties on providers, and asking legislators to close gaps that guidance cannot address.

Note from the editor

Since NPA took place, a few developments have taken place. The European Data Protection Board has published a statement on smart glasses on 14 Oct 2026. In addition, an independent expert of the EDPB, Bruna Yann has conducted a study for the EDPB: The Connected Gaze. Video Recording, Surveillance and Administering Evidence in the Age of Smart Glasses.