The Glassholes of Privacy (Surveillance)

You're listening to the award-winning Serious Privacy podcast sponsored by Trust Arc. Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr. K Royal. Hello, and welcome to another week of Sirius Privacy.

And this week we're going to be talking about who's watching you and who is watching us. The UK. Yeah, Big Brother indeed. Oh, the UK is watching us.

Okay, that's interesting. No, the UK is supposed to be the most surveilled nation in the world. The UK is supposed to be the most surveilled nation in the world. And we've seen a lot of articles recently about the rise of surveillance and the rise of surveillance cameras.

And so today we're going to talk a little bit about who is watching who, along with your regular week in privacy. But until then, my name is Ralph O'Brien. My name is Paul Reitbart. And I'm K Royal, and welcome to Serious Privacy.

Y'all know I'm just going to wait until everybody else is done introducing themselves first. But I have a fabulous question. I've been saving this one. No, I haven't.

I had them all lined up. How many fridge fries, or what do y'all call them in the UK chips? How many French fries is it okay for a friend to take before you tell them to order their own? Joey doesn't share things.

Are they a good friend, a close friend, or just a vague friend? Hey, that makes a difference, right? It does. A lunch friend.

A lunch friend? I don't do fries or chips over lunch. All right, y'all. It's now become how do we sidestep the unexpected question?

No, actually there is a difference between chips and french fries. In the UK, French fries are the really thin, tiny ones. Long, skinny ones. Yeah, whereas chips are a much more chunky kind of thing, right?

You'd not know that. Thank you. How many can I steal before you tell me to get my own? As many as you want.

Oh, I'm the other way. Or you you order your own. Actually, I've got really happy memories about Paul and chips because sitting in the brewdog in in in Brussels ordering bowl upon bowl of fries as people came to join us for a drink, it was quite lovely. It was.

That's two years ago already. Wow. Doesn't seem like that long ago, does it? Because I was thinking me and Ralph and the little pub next to IAPP in London as well.

For me, the Jigmole rule is three to five. We don't need a serious privacy cookbook. We just need to order chips, apparently. Apparently.

Or French fries. Or they're probably getting some from France. But there we go. But no, this is going to be a good week.

This week we're going to talk about surveillance. We have a little bit of news to update if we can squeeze the news in. And then we actually have a special episode coming for y'all. We'll look and see if we're going to publish it at the end of the week right now that we're recording it or wait.

Paul and Ralph, of course, have already done their part. Y'all are just waiting on me to do my part. So that will happen. I think what prompted us to come up with this uh episode title for this week was actually Flock.

So this is a US situation where not Brock, but Flock. What Flock. So this is Dayton Ohio, where a company called Flock with automated ANPR licensed plate reader cameras that have essentially gone wrong. They wanted to turn them off, but there's no real off switch on the end user side.

And because the cameras aren't owned by the city, it had to wait for Flock to come round and get its cameras. However, in the meantime, it's been done by putting black plastic bags over the cameras so they're non-operational. It has suspended and covered all of its Flock Safety automated license plate readers. Flock safety.

So the full name is Flock Safety. That it has suspended and covered them all. And this kind of goes with a number of other stories that we're seeing this week as well. With the rise of ring doorbells, the rise of drone, the rise of Meta is again releasing the glass cameras.

What used to be Google Glass. Meta have got their own partnership with Ray Ban. It was really interesting to look at that rise of surveillance cameras. Yeah.

And a lot of these is technology put into consumer hands. And it's become miniaturized, it's become easier, it's become cheaper. But the rise of ring doorbells alone has become quite an interesting situation. Well, though, don't forget on the ring doorbells, the Super Bowl commercial was all about share your data because we can help find lost dogs.

And then everybody came out with story over story going, no, ring doorbell is not trying to help you find a lost dog. They are selling your data to this other law enforcement. Right, who sells it to law enforcement. Although they were saying we don't sell the law enforcement.

No, they sell to another company who then sells to law enforcement. It's about time the US would also start to make serious work about privacy by design and especially privacy by default. And European regulators should verify these things before they come into the market. Because if all these doorbells were actually developed with privacy by default in mind, they would not have that functionality out of the box, which they do.

They would have a very narrow field of reference. Although, who doesn't love all the ring doorbell videos that come out with the singing FedEx guys and the doggies that run to the end of the driveway to grab the packages? Is that just an American thing? Yes, it is.

No, I have seen people posting these things up, but the one thing that worries me about it is it's almost a passive data collection thing. It's very much like the concerns we have about cookies in that which happens in the background and you don't really have a choice. You walk down the street, you're caught on camera, and you presume it's going to be used for law enforcement and security. I consulted with a data hoster, I guess a server farm in Canada one time.

And one of the questions they had was how narrow should the field be on their CCTB cameras to not catch the sidewalks or the street, but to catch who's trying to come in through the gates. And that's a very delicate area to play with because they really do want to know who's coming in. So you kind of do have to get part of the sidewalk, right? Because the driveway crosses it, but you don't want to get everything across the street either.

So that was Canada, though. It was owned by a U.S. company, but the only reason they were asking it was because the Canadian government told them they had to.

And you don't want to always record these things. It should only record if somebody presses the doorbell and not just mind. Always on. Exactly.

And we should have a ring doorbell. I should ask Tim if we have the ability to go in and delete videos. Well, and how do you provide notice? How do you provide how does Amazon provide notice of this doorbell or Google?

Because you can try to claim a household exemption, but if they have access to these recordings and can share them with law enforcement, it is not just you who is processing the data. Then there is no exemption, and there also needs to be signage. You are passing a surveillance zone. Tim loves the technology.

Y'all know this. So I have a camera in the driveway that tells me when there's a car detected. I have an alert when someone crosses a line to tell me when grandkids are running over to the house, got the ring doorbell, he's got the Google Home thing, he's got the Amazon thing. He he it's like he doesn't even know I work in privacy.

But what he likes to do is he likes to talk to people through through the ring cameras, usually the grandkids. And we've noticed that it identifies people incorrectly. Quite often we get told K is at the front door and it's like his mom. Or one time he was a UPS driver and it said that I was at the front door.

UPS driver was neither the same gender nor the same race, nor the same height. It is interesting. Nor the same age. Nor the same age.

But there was nothing we had in common other than two arms, two legs, and a head, right? But he had to, of course, go in and tell Ring that they were wrong in their identification. It is frustrating. Which helps them fine-tune that.

It is fascinating indeed, Ralph. And if you just last week the Dutch DPA released their annual report, and they also show a significant increase in complaints about doorbell cameras and security cameras of private individuals. So in 2024, there were 370 complaints. 2025 was 550.

So that's a significant increase. And a few years ago, when we had Helen on here, didn't she say that was like the biggest complaint that she got in Ireland was the cameras recording, CCTV or reach or whatever, was the biggest consumer complaint she got in inquiry. Yeah, that was episode one of season two. So that's a couple of years ago.

Wow. And these things have only grown since, right? And then become more wearable and more mobile with things like drones and glasses. It was Paul who actually shared an article the other day from Politico about lawmakers and regulators looking at the surveillance risks of the sort of the meta-classes.

And we do have an interesting one on social and domestic in the UK. We had a something called Woodard versus Fairhurst, an interesting little court case where two neighbours were disputed because the surveillance cameras looked at the neighbour's property, and it was the individual said, no, social and domestic, I'm not a data controller. And the case actually ended up saying, Yes, you are, because you're not just looking at your own property. But that becomes really interesting when you then apply that to cameras in cars for when you're driving or on cycle helmets.

Or I actually had a conversation with John Baines, the great John Baines in the UK, who actually posted up something about ring doorbells and saying, I don't think the ICO should be getting involved here because it's my own personal ring doorbell and I'm not a data controller. And he actually looked at the fact of the Rhein's judgment in Europe and said, that's a very old judgment, and the approach taken to personal data in there shouldn't really be brought forward now that the UK has Brexited.

I disagree. I disagree. Let's put it that way. But but yeah, this does date all the way back to the Rhein's judgment, and that sort of looking at personal data is quite an expansive interpretation, perhaps.

So I Googled just common stories, current stories on surveillance. The Seattle mayor explained the decision to turn on CCTV cameras for the World Cup. That was two days ago. But there I think, sorry, Kate to interrupt you, but there I do think there is some logic to it.

Because then you have an immediate societal requirement for security in a very specific place, namely where all the soccer fans will be coming together, where you have a limited time period, ideally. We'll see if he switches them off after the World Cup, but there is a limited time period, a limited location, and a limited group of people you are monitoring. It is not everybody all of the time and everywhere. But apparently there are privacy concerns being raised that it is not just a limited number of people.

I guess it's everybody at the World Cup or whatever, but there are privacy concerns coming out above that, which is kind of unusual. We're in the US, but it's also Seattle, where people are a little bit more tech savvy, right? Yeah. I understand the concerns, but here I think it would be defensible because it would be for a specific purpose and also based on very specific experiences outside of the US, probably, but we know that there are quite a lot of football bulletins.

Does it say which countries are playing or in Seattle? Because that might also be relevant context here. You would think I would be a big enough fan to know I'd have to click in it and see exactly who it is. But it is the Secret Service FBI and Seattle police.

It's not just the thing. But another one that came on was is it Colorado? Payonia is a town, maybe, is on the cutting edge of violating citizens' privacy because there's a little robot that runs around the town and gathers information, trundling along sidewalks last summer, gathering data on how accommodating thoroughfares were for people with disabilities. And it took them by complete surprise.

Now they're mounted on poles and wall last fall, and now they're going to businesses. Now they have Western swing moves. Every time that I see a robot cleaning up a supermarket aisles or a robot delivering food, I just think that's somebody out of a job. Right.

It puts me in mind of Paris, actually. And Paul, you'll probably know this more than I will, but there was a whole thing around the Paris Olympics back in 2025 where they were going to deploy AI surveillance systems around the Olympics and Paralympics across Paris. And it was really interesting because again, you just mentioned, Paul, about yes, they were using AI, but yes, they also had safeguards around human review. Yes, they had safeguards around it was going to be very time-limited just to that event.

There was a prior confrontation with the supervisory authority, not to forget, that's also important here, right? That they received some form of sign-off from the CNIL that actually they implemented it in a proper way and with sufficient transparency. I think that's also the robot example you just gave. One of the reasons why people are surprised is because there is no sign, hey, this is being recorded.

You are being recorded. Transparency is becoming a bigger and bigger issue with all these surveillance cameras that are everywhere. And if you look, if you go back, if you go back to that news story that Ralph just referenced on the smart glasses, whether they're from Google or Meta or Apple or whoever, yes, European legislators have said, hey, we need to start legislating this as well. I don't think they need to because we have already GDPR and the UI call for it sufficiently.

But they need enforcing, and you may want to have some specific guidelines. And especially the privacy by design and privacy by default need to be need to be enforced. And that is also easily possible with these kinds of things because they need to be receiving a marking before they can be allowed onto the market. They need to be tested, they need to be registered with electronics registers.

And that means that you can also verify whether these devices meet the requirement for privacy by design and privacy by default and how transparency is regulated. And also include instructions in the user manuals and in the acceptance, the user acceptance screens to avoid people becoming glass holes and just recording everything without people being aware. That also means you need some visual indication if something is being recorded, just like you have on those body cams. Glass holes.

That's the glass from the past. It is, but it's still true. Yep. There is one story that I saw in the nude, which really will get cameras recalled.

320,000 solar cameras were recalled because they're caught catching on fire and they're exploding. Now, if you don't recall them or do anything from a privacy perspective, consider they're gonna overheat and they're going to blow up. Data protection is about protecting harms to people, and I suppose blowing up is just as harmful as recording. Perhaps even more.

The other one that I just picked up is apparently it costs you $60 to disable the little LED light on the Meta Ray Bans. So they're apparently $60. There's somebody out there charging a small fee to disable the little red light that tells people they're being recorded. That's if you spot the little red light in the first place.

Give me a baby gun. I can disable the little red light. With the glass hole company doesn't isn't it worrying that there's actually a market for people to disable the little red light? Yeah.

Figure me surprised, Ralph. This is my surprise face. Yeah, okay, fair enough. I don't know.

It looks like you're standard. Call me cynical. No, that's that's fair enough. Yeah, the problem is you've got this consumerization of surveillance technology.

Far away from having CCTV cameras put in by the local authority or the police is one thing, but when you add it onto every petrol station fork or every parking garage, then people wandering around wearing glasses and everybody has a mobile phone and drones. We have are we in a civ society where while data protection is really important, privacy is dead? That's the question to ask. Let's go back to 1890.

1890 and the development of the Kodak camera. That is what Lewis Brandeis and Samuel Warren warned us for. The camera, the introduction of the personal camera and the ease of printing was what triggered the right to privacy in the first place. And we are living in their nightmare.

Yeah, we are. But here's the thing: if you flood the market with surveillance, aren't you then enforcing privacy because you can't differentiate any particular person from another particular person if there's millions and trillions and billions of surveillance out there? I don't agree. They're both shaking their hand, and I could barely get it out with a stretch base.

So I try. No, because then they just connect to Disney's tier view AI kind of tools, and then everybody is suddenly recognized again, maybe with a 90% or an 80% rate of success. But 20 makes a difference. And then you are still considering outside surveillance cameras, right?

What about inside surveillance cameras in hotels, in Airbnbs? They've even discovered them in saunas. Oh my god, right. Where if there is somewhere where you can consider that there would be no cameras is when you are undressed, but no even in saunas and change your rooms of gyms.

Nowadays, more often than not, there are very badly protected, online connected surveillance cameras. There are. So there is also that, because here in the US, y'all know we go by the concept of harm and damage. Not human rights, whether or not you've been harmed.

And if nobody knows, if those videos aren't made public, if nobody is sharing them, if it if it was not even a video, if it was a peeping tom through your window and you had no idea they were there and you had no idea that you were being watched, are you being harmed? It's still a violation of your dignity, I would suggest, for someone to watch you getting undressed, whether you know about it or not. But you won't know, right? That's the question.

You don't know. That person may be breaking the law, but can you prove a harm if you don't know? But it is exactly why we have fundamental rights to protect people also in situations that they are unaware or don't even care themselves. You have fundamental rights.

I'm quite sure I have fundamental rights as long as I'm on this scale. When I speak about we, I'm talking about us Europeans that includes still the UK. If I come over there, though, I have fundamental rights. Yes, you do.

You are forgetting when the UK left the EU, we are no longer we no longer have a fundamental right to data protection. We do have a right to privacy, but not data protection. Being spied upon would still be covered by the Convention on Human Rights, and you still have a fundamental right to data protection because you're party to Convention 108. Which we are not.

There is a law they passed, the fundamental rights and freedoms removement removal piece of legislation. So they literally wrote through the GDPR and removed everywhere that says fundamental. Interesting, you know? Don't forget the US is the only one that voted against the rights for women at the United Nations.

Don't forget that. Yeah. And it was the US and the UK who could who didn't sign up to the AI safety convention the other day, the Paris Accords. New world, people.

New world. Is there anything fun happening in the world right now, Ralph K? Anything that we are positive about after this sour segment on surveillance cameras? It's been pretty sour, hasn't it?

Vermont, K? Vermont is active, is it not? Yeah, we actually and did was it Louisiana or Arkansas? Saw that passed a privacy law?

I think it was. It was one of the southern states that you wouldn't imagine typically would pass one, but we've had another privacy law pass, which has been dead for a year or two, right? They've been going into action but not being passed. So that's good.

I'm looking for something good. I like the fact that the Vermont's one is called the Data Privacy and Online Surveillance Acts. That's an interesting, interesting terminology to use as well. Here we go.

Two two good ones I've got for you. The law I don't know if this one's good. The law firm Rox Rothschild was hit with a class action over a data breach. I guess that's good.

And then a judge ruled that both sides in a lawsuit misused AI, disqualifies both lawyers on both sides. And this was in Mississippi. I find that to be good news because I think it's hilarious. I think that's hilarious too.

I also had to laugh really hard when I saw the latest press release from the White House a couple of days ago. So there will be a gazillion others by now. But they actually put out a release or made a statement from the podium in the press room in the press room pushing back against UK legislation on protecting minors on social media. So the UK government is heavily debating the introduction of a social media event for under sixteen.

And the official Waifehouse comment was please don't do that because that hurts our tech companies. We've heard similar things from the US about the about the GDPR. Yeah, and about the Digital Services Act. And it just, by now it just makes me laugh that even in those situations where you try to protect young children from harm, whether you agree or not with the principle that it's possible, but when that is the discussion, the only statement you make is it hurts our businesses without looking at the deeper issue.

It's so sad that I can only laugh about it. Even when you have countries that are very much technology forward from the time that you are young, and we all know we're speaking of people in Asia that they're very much tech savvy from the time that they are young, and they restrict time online and on social media. They were one of the first I think Japan was one of the first ones that did. It's absolutely crazy.

On that note, it's been some really interesting stuff about children recently. It's really the hot topic. The UN put out a statement saying don't ban children from social media. We engage in education and development and encourage data protection by design on the social media companies rather than trying to ban the children.

Produce safe products, don't exclude people from the product, right? Which I think is actually quite good, actually. I actually quite like that UN approach that says produce the product that's safe, don't exclude people from the product. Now, you could argue social media is not inherently safe because it encourages people to send things to each other.

Right. Well purpose of social is Yeah. On that point, going back to the UK, Starmer on the 8th of June, the Prime Minister, put out a request to tech companies, I say to introduce device controls to prevent children from sending and receiving explicit images or face punishment. Britain will be the first country to make tech providers stop children from taking, sharing, or viewing naked pictures on their devices.

So if you're under 18. Why can't we just stop pictures and videos? What wh why do you have to go to the complication of nude videos or inappropriate pictures? I think it's really interesting.

He said, do it within three months, or we will introduce legislation to make you. That's it. That's interesting because that's not that's never going to happen. That legislation probably won't ever pass any parliament.

But a couple of days later, Apple actually did that. Apple listened. So whether Starmer was already aware that Apple would be coming with this, I don't know. But he was preemptively setting himself up for success.

I think so, because he needs the success because otherwise he won't be Prime Minister anymore in two weeks' time. During the latest upgrade of Apple's iOS that was announced on Monday, there was actually a very big segment on child protection and a lot of additional features that are being introduced to protect children from party and to give more parental oversight, including on time usage and schedules for school and all of that. I thought it was pretty well thought through to be honest, what I saw.

I guess a lot of friends with young children would be happy to have those controls in place before handing their child with a mobile device. It is interesting because protections of arms should not just extend to children. And also, what's the difference between people sending photographs of bathing their kids in the bath when they're young if they're a grandparent's onlineography, right? So your on-device scanning is going to make these things.

How do you differentiate between one and the other? You can't. Yeah, compared to people just sending pictures of their kids being bath is a very di very different thing. So how how do you do on-device scanning?

And then my big concern is all it's also function creep and chilling effects of surveillance and censorship, of course. But age verification online, you'll know I have issues with, let's put it that way. So, yeah, all things to think about. So a lot of stuff here about children as usual, and I suppose the only other news article I have here is another little update about our friend the ICO.

The first time we've actually seen an ICO official statement about it today. It was released. The ICO have now said it really focuses on the change of governance to the Deputy Commissioner. But it does say after the Commissioner voluntarily stepped back on the 26th of February, the investigation has taken place.

The investigation has found there is a case to answer. Therefore, the Commissioner will be unable to act in their duties for the remainder of the process. But it's up to D Sit to decide on the removal. Wow.

And that's Parliament, right? First the government and then Parliament who will need to make a decision. Exactly, yes. But I think the key statement I took out of there, sadly, is there is a case to what so there we go.

Yep, the situation rumbles on. And Coe again put out a an interesting story about the fact that, of course, the commissioner is still drawing their salary. Yeah, but I mean that that's only yeah, that's only fair because they have not they are under investigation, there is no conclusion yet. So obviously they would still get a salary.

Innocent until proven guilty. I totally agree with that. Yes. Yes, very much so.

So on that happy note, I need to wrap up. So until then, look out for a special bonus episode as well. And goodbye from us. Bye.

Bye, Al. Now that was serious privacy. Please subscribe on your favorite podcast app and leave us a review. You can find us on LinkedIn, Instagram, and Blue Sky as serious privacy.

Feel free to drop us a question or a comment. We'd love to hear from you.