Anyone who thinks the use of smart glasses in the workplace is purely a technical issue for the IT department is mistaken. For employers, these devices also raise questions that go beyond technology and operational efficiency.

Depending on how they are deployed and the functionality of the device, their use may engage data protection law, workplace monitoring rules, works council co-determination requirements and, in some circumstances, criminal law. Employers must also consider whether data collected through the devices is shared with manufacturers, cloud providers or other third parties.

In this article, we examine the key legal issues that arise when smart glasses are used in the workplace under German law and set out a checklist for employers looking to use the technology. Several of these considerations are likely to be relevant in other jurisdictions.

Smart glasses are wearable devices equipped with cameras, microphones, sensors and a wireless connection. Depending on the model, they can record video, capture speech, transmit location data and share recordings in real time with third parties. This can include manufacturers, cloud services and other employees.

Importantly, several of the current high-end models closely resemble ordinary eyeglasses and can be difficult to distinguish from conventional eyewear. That is precisely where the problem lies. A conventional surveillance camera is visible, marked and easily identifiable. These more discrete types of smart glasses worn by a colleague or supervisor are not. They can record unnoticed at any time.

From a data protection perspective, the position is clear. As soon as smart glasses are used in the workplace and employees’ personal data is recorded, which is practically always the case, their use is subject to the GDPR and the German Federal Data Protection Act (‘BDSG’).

Where the employer initiates their use, the legal basis is the employer’s legitimate interest under Article 6(1)(f) of the GDPR. That interest must outweigh the employees’ data protection interests.

Increasingly common exceptions arise where the glasses are used less for monitoring people and more as a ‘third hand’, for example in assembly, repair work or in the ‘pick and pack’ of goods in logistics.

A data protection impact assessment (‘DPIA’ as per Article 35 GDPR) must always be carried out before any high-risk processing activity is implemented. According to the opinion of data protection authorities, processing employees’ image and audio data through smart glasses is classified as high-risk processing. A DPIA is therefore not only recommended, but generally mandatory.

Employers must also comply with transparency and information obligations towards employees. Under Article 13 of the GDPR, employees must receive clear, comprehensive information about the use and scope of data collection, its purposes and the recipients. In practice, the transfer of recordings to the device manufacturer or external cloud services is often not adequately communicated.

As with video surveillance, different standards apply to open and covert use of smart glasses.

Open use can be permissible under general data protection rules if it is transparently communicated, clearly defined for a specific purpose and limited to what is necessary. It must not disproportionately infringe upon employees’ personal rights.

Employers wishing to use smart glasses for remote maintenance or quality control must communicate this clearly, limit recording to the specific work application, and transparently disclose any possible data sharing with third parties, especially the device manufacturer.

Covert use, meaning recording colleagues or supervisors without their knowledge, is conceivable only under the strictest conditions. This follows the principles developed by the Federal Labour Court on covert video surveillance, most recently in a judgment from October 2016. The following requirements apply:

• there must be concrete initial suspicion of a serious breach of duty;
• all less intrusive means must have been exhausted; and
• the measure must be strictly limited in time and by personnel.

In practice, covert use of smart glasses will rarely meet this threshold.

What is still debated in the US as a question of evidential admissibility has long been settled in German law through criminal law.

Anyone who unlawfully records another person’s private conversation using a technical device commits a criminal offence under s.201 Paragraph 1 No. 1 of the German Criminal Code (‘StGB’). This applies to the wearer of smart glasses and to the person who instructed them to wear the device. This includes an employer who requires their use.

Therefore, an employee who uses smart glasses during a conversation with colleagues in the company cafeteria and records that conversation could be committing a criminal offence. This may sound unusual, but it is not, because some modern smart glasses record by default when activated. All users of these devices must be aware of this. Employers should address it in a clear usage policy.

Smart glasses used in the workplace are technical equipment within the meaning of s.87 Paragraph 1 No. 6 of the German Works Constitution Act (‘BetrVG’) if they record, or can record, employee behaviour or performance. The works council therefore has a right of co-determination. Employers that introduce smart glasses without a works agreement risk injunctions from the works council and invalidity of the measure.

A company agreement should, at a minimum, regulate the:

• purposes and areas of use;
• categories of data recorded (including image, audio and location data);
• storage and deletion periods;
• disclosure to third parties (especially the device manufacturer);
• information obligations towards affected employees; and
• the prohibition of covert use.

Before introducing smart glasses into the workplace, employers should take the following steps:

• Clarify the purpose: what specific application requires smart glasses? Is there a less intrusive alternative, such as a stationary camera or conventional tablet?
• Carry out a data protection impact assessment: this is generally mandatory, not merely recommended.
• Involve the works council in good time: before introduction, not in parallel or afterwards.
• Develop usage guidelines: set clear rules, prohibit recording without prior notice, and refer to s.201 StGB.
• Be transparent with employees: provide information under Article 13 of the GDPR, including any possible data transfer to the device manufacturer.
• Review the contract with the manufacturer: check the data processing agreement under Article 28 of the GDPR and clarify whether the manufacturer uses any data for its own purposes, such as AI training.

Several of these steps will be relevant to employers based in other jurisdictions, particularly where the GDPR or a similar regulation applies.

Smart glasses are no longer niche products. They are already used in logistics, skilled trades and remote maintenance, often without the necessary legal preparation.

Employers introducing these devices without a data protection impact assessment, works council involvement and clear usage guidelines risk unlawful surveillance.

Anyone who instructs employees to use the devices, or secretly records conversations themselves, risks not only fines and claims for damages,  but also criminal charges. Where an employee acts independently, dismissal may also be possible.

Smart glasses are just one example of how workplace technology is evolving. The challenge for employers is to ensure that governance, policies and other safeguards evolve with it.