Bystander privacy for optical implants

1 Scope

1.1 This standard applies to optical implants sold to members of the public, and to the software that processes what they see.

1.2 It does not apply to devices sold for use by police, security or armed forces under a contract that specifies their own rules on recording.

1.3 It does not apply to diagnostic data that an implant keeps for the purpose of maintaining the device and the safety of its wearer, which is governed by the wearer’s agreement with the maker.

Note. Exclusions 1.2 and 1.3 were the subject of 312 of the 1,040 public comments on the draft. Several respondents argued that 1.3 could be used to keep anything, provided it was called diagnostic. The working group kept the exclusion, recorded that two of its members dissented, and asked the Independent Implant Register to report any evidence that it is being misused. None has been reported.

2 Processing

2.1 An implant may process images of people other than its wearer only as needed to provide a function its wearer has turned on.

2.2 An implant shall not identify a person other than its wearer by face, voice, gait or any other biometric feature, except people its wearer has explicitly enrolled with their consent.

2.3 Any explanation an implant shows its wearer of what it has detected shall have passed intervention testing for faithfulness, in the manner described by Frothly’s paper Through a Glass, Darkly.

3 Retention

3.1 An implant shall not retain images that show people other than its wearer for longer than its processing buffer requires, and in any case not longer than two seconds, unless its wearer gives an explicit instruction to record.

3.2 When its wearer records, an implant shall show a visible indicator to people nearby where the device’s design allows, and shall blur the faces of people not enrolled under 2.2 in anything it shares.

Note. The two-second rule follows the Turing Registry’s revocation in 2023 of two engram systems for retaining and extracting what people had seen and remembered without their consent (TR-08333 and TR-08332). An implant that kept everything its wearer saw would be a record of other people’s lives that they never agreed to.

4 Places

4.1 An implant shall not record, and shall not share for research, images captured in schools, hospitals, places of worship, or homes other than its wearer’s, unless its wearer gives an explicit instruction to record in that place.