What on earth do Ray-Ban Meta Glasses have to do with a Supreme Court ruling on public administration liability for a botched vasectomy?
The Spanish Supreme Court’s decision involves informed consent information (“this medical procedure carries these risks; you must be aware before agreeing to undergo it”) and Meta Glasses involve general data protection information, not necessarily linked to consent.
You should probably read anything else. Reading this post seems to be a pointless waste of time.
Are you still there?
Congratulations. You must have a lot of patience! Let’s get down to business:
This post is a sort of sequel to this other one about the Meta Glasses:
Meta Glasses: Slippery when wet
I read what Peter Craddock writes because he has a very different perspective from mine, and that always helps to (i) train lateral thinking and to (ii) detect slippery arguments.
You are reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.
In the free time this newsletter leaves us, we sort out complicated stuff related to personal data protection and artificial intelligence regulations. If you have one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com
STS 1174/2026: What happened?
Hospital Severo Ochoa performs a vasectomy on “Agapito”, the patient (Bravo, CENDOJ!), without informing him that the vas deferens sometimes reconnect by themselves. This is Agapito’s case, who, like Ben Affleck and Jennifer López occasionally, reconnect.
The couple (“Marina”) gets pregnant. Agapito claims his informed consent was poorly informed. Agapito and Marina jointly claim compensation of 70,000 euros.
The defendant administration grants only 6,000 euros for him and nothing for her, because the right to information is “highly personal” and she was not the patient: lack of standing.
The High Court of Madrid raises the figure to 12,000 without explaining where the number comes from. It also confirms that Marina is irrelevant in the lawsuit.
The question for cassation before the Supreme Court: Can the partner of a poorly informed patient claim patrimonial liability for the pregnancy?
The Supreme Court agrees with the administration on the premise but disagrees on the conclusion:
· Yes, the sole holder of the right to medical information is Agapito, the male (in accordance with Article 5.1 of the Patient Autonomy Law);
· Yes, it is a highly personal right anchored in Article 15 CE (STC 37/2011, reproduced generously).
· However, a vasectomy decided within a stable couple context is a family planning decision, and the consequences of its failure do not only affect who signed the consent without the required information, but also the pregnant woman.
The conceptual plot twist:
The hospital violates Agapito’s fundamental right and, by doing so, causes Marina a proper and autonomous damage, also moral, because the lack of information deprived her of the ability to make an informed decision about her maternity and to resort to another contraceptive.
There is actual and individualized harm, there is standing.
The bottom line: The Supreme Court severs two, erm, different conducts:
One: between the holder of the violated right and the condition of harmed party (which can exist in different subjects, contrary to what the Hospital argued) and
You may not have the right -because it is highly personal- and yet suffer the harm -and have standing to claim compensation for it-.
Two. Between the effect that is not compensable (the birth of the child) and the one that is: the imposed or forced loss of the ability to decide.
The omission of the required information can cause various damages, and the fact that some of them are not -for whatever reason- compensable does not prevent the others from being so.
Wait a minute! We’ve been waiting for you to get to the Meta Glasses
First, an obligatory “caveat”: this ruling deals with medical consent liability, not data protection; the regime for proving harm is different. The CJEU requires actual damage under Article 82 GDPR. In the Supreme Court’s case, the harm is presumed from the violation of the fundamental right, yes, but something tells me that another tune would have been sung if Marina’s (and Agapito’s) injury had not been “so manifest”.
It doesn’t matter: the ham is in the disconnection between the holder of the right and the harmed party and, with it, in the expansion of active standing.
“People has the power”
When someone records someone else with their Ray-Ban Meta Glasses and uploads it to Instagram, the recorded person is the direct data subject, so to speak.
But if recording and broadcasting harms the direct data subjects, it usually also harms others: the partner of the exposed individual, their children, their work environment that identifies them by context.
The KissCam incident
I am quite sure you remember the “KissCam incident” at Coldplay’s concert.
Imagine, as Sofia Petrillo said, that this image had been captured and broadcast live on Instagram by an influencer through their Meta Glasses without informing “in situ” and “just in time” -as the CJEU requires in C-422/24- to the concert attendees around them of the capture and broadcast taking place.
The interested parties do not know nor can they therefore decide to leave the camera’s shot, or separate and let air run between themselves and the nosy influencer with glasses: they cannot opt to request him not to record them.
For these strict purposes, it is not very important to qualify these actions as “not granting consent” or “exercising the right of opposition”: it does not matter: precisely because of that transparency is a “prius”.
The complexity derived from the presence of Meta Glasses in the equation can be summarized in three points:
(i) undetected image capture,
(ii) broadcasting to an indeterminate audience without notice, and
(iii) processing video and audio by Meta’s platform.
Remember that if there is a company suspected of being able to re-identify anyone it is Meta. Additionally, Meta reserves a license for use over the “uploaded” content: nice, huh?
And please, do not come with arguments like “they were in a public place” or “the image was accessory to Coldplay’s concert”.
From the perspective of a rights-guaranteeing European law, a KissCam or, in this case, a zoom made with precision by an influencer who singles out two people destroys any alleged accessoriness.
The acid test: I am quite sure that all of you remember the anecdote of the incident, but it is not so easy to recall the band that was performing at the concert where it occurred.
In fact, I did not choose the KissCam example randomly: although the damage caused was enormous, in 2025 many people shrugged and criminalized the victims shouting “everyone knew there were kisscams broadcasting to the giant screens”.
Transparency is the mother of all wisdom
The Achilles’ heel of Meta Glasses remains (and not by chance, but by design) that of transparency: if neither the camera nor the broadcast are noticed by the interested party, there is no possible excuse.
Meta Glasses, due to omission of information in their design, take away the freedom to decide for the interested parties (I insist: the qualification as “non-provision of consent” or “non-exercise of right of opposition” depends on the prior choice of the data controller, reflected in that privacy policy that everyone ignores).
It is necessary to remember here that (i) if your processing is based on legitimate interest and (ii) as we have seen it applies Article 13 and not 14 GDPR because you capture data directly from the data subject, compliance with the obligation is nothing less than a condition of the legitimacy of the processing. Thus the CJEU in Mousse made it quite clear:
Who are the affected parties?
According to the Supreme Court, more than you imagine: The spouses of our embraced protagonists, children and rest of family are a good example of proper and autonomous damage: no one processed their data with the glasses, but still they had to manage in public a marital crisis that could otherwise have been managed privately.
A separate note deserves the employer company of the lovebirds: it turned what could have been a claim for injury to its honor into a marketing campaign surfing the wave with the celebrated ad starring Gwyneth Paltrow.
With the Supreme Court’s logic, a proper, autonomous and individualized harm is enough. Article 82 GDPR, by the way, speaks of “any person”, not of “data subject”.
No one has yet asked the CJEU what this means. Nor is it necessary. At least in Spain, thanks to the “Agapito ruling”.
In any case, the universe of compensable subjects in collective claims that already plague Meta and similar companies has suddenly multiplied.
Who are the joint controllers?
In the ruling, the culprit is who should have informed and did not; the harm reaches those who acted believing a situation secure when it was not.
Translate this to a device whose recording LED is covered with a piece of insulating tape and that, as discovered in October, stored audio without anyone saying “Hey Meta”. The cracks of privacy by design principles (Article 25 GDPR) and product liability (hat tip to Peter Hense for this one) rhyme.
The domestic exception ends where the user publishes what is recorded beyond their strict circle of family and close friends.
Even under the domestic exception, the platform provider (and glasses) is responsible that such processing does not by default and by design breach GDPR and the rest of the regulations.
The CJEU, in Russmedia and Coyote, has already made it quite clear that the platform that commercially exploits the content (case Russmedia) and amplifies it with its algorithm (case Coyote) is co-responsible and loses the exemption from liability for illegality of content supplied by their users.
The manufacturer of the glasses and the owner of the platform that goes viral with the video are the same company.
Glasses are not required -neither Smart nor analog- to see and draw conclusions.
How could such a flagrant breach be mitigated?
Public and private enforcement of Meta Glasses faces (i) the ease of recording and disseminating content while going unnoticed by those involved (this is the responsibility of the manufacturer and platform, especially when they coincide), and (ii) the difficulty in identifying the user.
The most obvious solution (and, obviously, impractical) is to turn the user into a “walking advertisement”.
The recent document from the European Data Protection Board proposed Bluetooth proximity alerts to nearby devices when the glasses are recording.
Perhaps it is not essential to have a 2x2 meter sign with a complete privacy policy.
Perhaps the minimum required (note: very minimum) is that their glasses display their Instagram handle, or their contact details in a QR code, so that they can at least report them or exercise rights against them if appropriate.
So remember, friends, three takeaways:
· The data subject is not the same as the person entitled to claim damages for infringement of their rights.
· Transparency is a prerequisite for combining legitimate interests with Article 13 GDPR.
· Shared responsibility: never forget.
Always happy to help!
If, for example, you are considering introducing these gadgets into a work environment, it is better to ask before getting into serious trouble.
Jorge García Herrero
Lawyer and DPO
If you think this newsletter might appeal to someone and even be useful to them, forward it to them.
If you miss any doc, comment, or dumb thing that clearly should have been in this week’s Zero Party Data, write to us or leave a comment and we’ll consider it for the next one.