Smart glasses producers and app providers acting as controllers should not rely on the wearer to meet their GDPR obligations, says the EDPB

On 8 October 2026 Advocate General Laila Medina delivered her opinion in Rahapesu Andmebüroo (C-222/25), a reference from the Estonian Supreme Court. The opinion does not bind the Court of Justice, which will rule later.

A data subject asked Estonia's Financial Intelligence Unit whether information about him had been passed to or requested by credit institutions or authorities. He later also asked whether the unit had opened an investigation file on him. The unit refused both requests, citing the confidentiality of its data. It maintained its refusal after the Estonian data protection authority ordered it, by an interim decision, to provide the information.

The Tallinn administrative court then held that the Estonian rule on restricting access did not specify its grounds or duration, and ordered the unit to decide again. The court of appeal found the rule not clear and precise and dismissed the unit's appeal. The unit then appealed to the Supreme Court.

In the Advocate General's view, financial intelligence units working to prevent money laundering and terrorist financing are competent authorities for the purposes of the Law Enforcement Directive, whatever their organisational structure. The Directive uses that term for authorities that act to prevent, investigate, detect or prosecute criminal offences. Their processing for that work therefore falls under the Law Enforcement Directive (Directive 2016/680), not the GDPR.

She considers that a total restriction of access may be compatible with the units' duty of strict confidentiality. Any restriction must, however, be proportionate, limited in scope and duration, and laid down in clear and precise legal rules. In her view, a total restriction lasting until the data are destroyed is precluded where national law does not lay down such rules. She observes that the Estonian framework does not appear to set clear conditions for restricting access, and leaves that assessment to the national court.

Where access is restricted, she considers that the person's rights must be protected indirectly through the supervisory authority, which must be able to hold confidential discussions with the unit. In her view, a unit may refuse access without giving reasons where disclosure would endanger the public interest, but it must then tell the person that they can turn to the supervisory authority. Indirect access means that the person does not see the data themselves, but the supervisory authority checks on their behalf what data the unit holds and whether it processes them lawfully. Under Article 17 of the Law Enforcement Directive, the authority informs the person at least that all necessary checks have taken place.

Since 2 August 2026, Article 50(2) of the AI Act has required providers of AI systems that generate synthetic audio, image, video or text to ensure that the outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated".

Under Regulation (EU) 2026/1744, the Digital Omnibus on AI, providers whose systems were placed on the market before 2 August 2026 have until 2 December 2026 to take the necessary steps to comply with Article 50(2). On 5 October 2026 OpenAI described how it intends to meet the duty for text.

The Code of Practice on Transparency of AI-generated Content was published on 10 June 2026. On 8 July 2026 the Commission concluded that it adequately covers the obligations in Article 50(2), (4) and (5). The next day the AI Board adopted its own adequacy assessment. Signing the code is voluntary, and the Commission notes that adherence is not conclusive evidence of compliance.

OpenAI says that over the coming weeks it will add an invisible "watermark", which it calls textGrain, to ChatGPT and Codex text output in the EU. The watermark is a statistical trace: the model chooses its words so that the text reads the same to a person, but a detection tool can recognise that it was produced by an OpenAI model. This is OpenAI's response to the AI Act requirement that AI-generated text be detectable.

The watermark will apply across all plans, but only to output OpenAI treats as eligible. The post does not say which output that is. In the API the watermark is off by default; API customers in any region can opt in for selected models.

The detector is not public. OpenAI says that, in line with the code of practice, approved researchers and expert organisations may apply for access case by case. According to OpenAI, the detector reports whether text carries an OpenAI watermark, without identifying users or revealing prompts.

OpenAI also publishes figures on the watermark's limits. Its tests used a target false positive rate of 1%: about 1 in every 100 texts without the watermark would be wrongly flagged. The table shows how often the detector found the watermark in 200-token and 400-token passages:

Detection was substantially lower for mathematics. OpenAI says that the absence of a detected watermark does not prove a person wrote the text.

The post does not cite Article 50 by number; it refers to the AI Act's requirement to make generated text identifiable.

Spain, the AEPD's preventive warnings

On 6 October 2026 the Spanish AEPD announced preventive warnings to two town councils planning video surveillance with automated image analysis. One project included facial detection or recognition. The other included detection of people and vehicles, metadata generation and searches by appearance.

The warnings concern processing that has not yet started and do not find an infringement. They rest on Article 58(2)(a) GDPR and, for processing by the local police, on Spain's Organic Law 7/2021, which transposes the Law Enforcement Directive. In the warnings, the AEPD sets the following conditions:

1. Each function must be shown to be necessary and proportionate for its purpose. Technical availability alone does not justify its use.
2. For local police processing, each additional automated analysis capability must be justified separately, not just the cameras.

The AEPD also requires that the data each function generates, how long they are kept and who may access them be defined. This includes derived data such as biometric templates and match results.

The warnings also state:

1. Where a function processes biometric data to identify a person uniquely, Articles 4(14) and 9 GDPR apply.
2. Where local police processing falls within Organic Law 7/2021, Article 13 of that law applies.
3. Where the processing is likely to be high risk, a data protection impact assessment must be carried out before launch.
4. In the warning on the facial recognition project, the AEPD adds that those functions must stay disabled unless their necessity and proportionality have first been justified.

Italy, the Garante's fine

The Italian Garante, by decision no. 636 of 23 September 2026, published on 8 October 2026, fined the Comune di Arvier 4 000 euro. A resident had complained that a municipal camera filmed the front, balconies and windows of her home.

The municipality added digital masking of the private home, which automatically covers that part of the camera image so that it does not appear in the footage, only after the Garante opened its investigation into the complaint. The Garante found that masking was technically possible and should have been applied from the system's first configuration. Its absence breached data minimisation and data protection by design and by default, which requires safeguards to be built into a system from the start and into its default settings.

The Garante also found that the system served several administrative purposes without a valid legal basis, that the information given to the public was inadequate, and that a 2018 impact assessment did not meet Article 35. It found infringements of Articles 5(1)(a) and (c), 6(1)(c) and (e), 6(2) and (3), 12(1), 13, 25 and 35 GDPR and Article 2-ter of the Italian Privacy Code.

The Garante ordered the municipality to survey all its cameras and identify a valid legal basis for each purpose, ensure that no camera's field of view includes private homes, carry out a complete impact assessment and update its notices. The municipality must report on these measures within 30 days of notification.