22 01732 759725 For the best part of a decade, IT departments worked hard to ensure bring-your-own-device policies delivered a degree of stability and security through mobile device management platforms, clear acceptable use rules and a defined process for enrolling and, when necessary, wiping personal handsets. Now, the increasing popularity and affordability of smart glasses have reawakened the BYOD issue, with national pub chain J D Wetherspoon banning customers from using smart glasses in all 800-plus of its pubs and ATG Theatres asking audiences to remove them during performances. In August, His Majesty’s Courts and Tribunals Service went further, banning Meta’s smart glasses from every court building in England and Wales, confiscating them at security and returning them on exit. Smartphones are still permitted, provided they aren’t used to record, but there is no such exemption for smart glasses, largely because they give little visible sign that recording is taking place. This last point is critical, given that the entire BYOD security model built over the last decade assumes a device is something that looks like a device and is something an employee holds up, unlocks or can be seen using. Smart glasses look like an ordinary pair of glasses, connect to a phone rather than to the corporate network (in most consumer configurations) and can record video and capture audio. Several models can even read and store text from a screen using built-in optical character recognition. Yet, none of this activity appears in an MDM dashboard because there’s typically nothing enrolled to monitor in the first place. Why this sits awkwardly with existing controls The problem for in-house IT teams and managed service providers is that most of the tools built to manage BYOD risk assume some degree of visibility or control over the device, whether through enrolment, a managed profile or network-level policy enforcement. Smart glasses typically pair with a phone rather than joining the corporate network directly, which means they sit outside the perimeter most BYOD frameworks were built to police. A visitor, contractor or employee can walk into an office wearing a fully capable recording device that no firewall rules, conditional access policy or endpoint agent have any way of detecting. The legal exposure comes from UK GDPR and the Data Protection Act 2018, which states that any recording of personal data needs a lawful basis, and the fact that covert recording is likely to breach the fundamental transparency principle. An employee who covertly records colleagues, clients or confidential material on screen may become a data controller for that recording, while the organisation itself may face scrutiny over whether its policies did enough to prevent the recording in the first place. Fines for serious breaches can reach £17.5 million or 4% of global annual turnover, before one even considers potential reputational damage. Policies need to be updated now The fix isn’t a new technical control, since one doesn’t yet exist for a device that has been designed to deliver its recording capability covertly, save for the small LED on the frame. Policy change is required, communicated clearly and applied consistently. Acceptable use and BYOD policies need to name wearable recording technology specifically, rather than relying on definitions written for phones, laptops and tablets. Where wearable devices are permitted at all, staff and visitors should be required to declare them. Organisations handling higher risk information, client data, financial records and R&D, for example, may reasonably decide that specific areas such as meeting rooms, trading floors, data centres etc. warrant an outright restriction. Employment contracts and staff handbooks should set out plainly what recording is and isn’t permitted, and training for managers and HR should cover the reality that covert recordings, however they were obtained, may still surface as evidence in a workplace dispute. Employers should also consider their obligations under the Equality Act 2010. In some circumstances, wearable technology may constitute a reasonable adjustment for a disabled employee, meaning that any restrictions on use should be assessed on a case‑by-case basis. None of this replaces the technical controls IT teams already run, but it closes the gap that those controls were never designed to cover. The broader lesson from the BYOD years still holds, that once a device becomes common in the workplace, policies will always be playing catch-up. Smart glasses are widely available, increasingly normalised and if the pattern from the last decade repeats itself, will be in the building before most organisations have decided what their policy on them actually is. Why it’s time to be clear-sighted about smart glasses. By Claire Scanlan Zero visibility WEARABLES About the Author: Claire Scanlan is an employment solicitor at Buckles Law, with over 20 years’ experience in advising individuals and businesses on every stage of the employment relationship. Known for her approachable style and practical guidance, she has expertise in disputes, redundancies, restructurings, disciplinaries and contract negotiations. Buckles Law is a nationally recognised law firm, headquartered in Peterborough, with offices in Bristol, Cambridge, London, Nottingham and Stamford. It offers a full range of legal services, including corporate law, commercial law, litigation and dispute resolution, employment law, commercial property law, family law, contentious probate and private client matters. Claire Scanlan
RkJQdWJsaXNoZXIy NDUxNDM=