Privacy commissioner opens formal investigation into Chinese smart glasses app maker

Left · 2The Australian privacy commissioner, Carly Kind, has launched a formal investigation into Shenzhen Qingcheng Future Technology Co, the China-based software company behind the HeyCyan app used in cheap smart glasses sold in Australia. 1 2 Left · 2Kind said the company did not respond to her office's multiple attempts to obtain information and did not acknowledge receipt of them; the Guardian reports she also cited concerns from third-party analysis of the technology and the company's privacy policy. 1 2 Left · 2The regulator also made preliminary inquiries with Meta, Google, Kmart and importer BDI Technology, but none of them is subject to a formal investigation. 1 2

Left · 1An ABC investigation last month reported more than a dozen serious security flaws in the HeyCyan app and website; independent testing found users' email addresses, dates of birth, images and videos exposed, devices that could be hijacked over Bluetooth without a password, and data sometimes sent to Chinese servers. 1 Left · 1Kind said the ABC's reporting raised the prospect that reasonable steps had not been taken to secure user information, and that her office had a range of concerns, including possible use of facial recognition technology. 1 Left · 1A formal investigation lets the commissioner compel the company to provide information; if it keeps ignoring her she can seek a court injunction to limit supply of its products, and Kind said the Privacy Act allows penalties of $50 million per contravention, which can be applied per individual, should concerns be borne out. 1

Left · 2Kind has written to the Australian Retail Council and other retailers putting them on notice and urging them to reconsider selling the product, and the Guardian reported the glasses had been removed from Kmart's website as of Wednesday, with Kmart approached for comment. 1 2 Left · 1Attorney-General Michelle Rowland asked the regulator in August to prioritise the issue amid calls for an import ban; the government has decided against an import ban for now but is considering a limited ban in public service workplaces. 1 Left · 1Public concern has been sizeable: a GetUp petition has more than 55,000 signatures, and councils including Canterbury-Bankstown, Sydney City, Brisbane and Yarra have banned the glasses from some venues. 2

Left · 1Kind noted the Privacy Act covers companies and Commonwealth agencies, not individual users, and that retailers or manufacturers may have no obligations if they collect no personal information; the software provider is likely the entity that holds the data. She said proposed reforms, including a 'fair and reasonable' test, would raise the bar for what smartglasses can collect. 2 Left · 1A legal representative for Shenzhen Qingcheng told the ABC that engineers had fixed the flaws, but analysts from NSB Cyber and Abstract Shield found that as of 2 October many fixes had not worked or were incomplete. 1