OAIC probes HeyCyan and warns smart-glasses retailers

Australia’s privacy regulator has opened an investigation into the maker of the HeyCyan smart-glasses app and asked retailers to reconsider selling devices that use it.

For a small retailer, the practical question is what sits behind the product on the shelf: which app it needs, who operates that app and what happens to the information it collects.

The Office of the Australian Information Commissioner’s 7 October announcement names Shenzhen Qingcheng Future Technology as the company under investigation. The OAIC says HeyCyan is used with Kmart’s Anko smart glasses and products sold through Big W Marketplace and Amazon.

What changed today

The OAIC says the developer did not answer preliminary inquiries about recording, access to information and storage. The formal investigation allows compulsory information-gathering powers to be used. It is an investigation, with no finding of a privacy breach announced.

Privacy Commissioner Carly Kind has also written to retailers expressing concern. The release announces no sales ban or deadline.

In her accompanying explanation, Kind says no formal investigation has been commenced into the other businesses approached, while stressing that this does not establish their compliance.

The seller and the software have different roles

Kind explains that supplying hardware does not, by itself, make a business responsible under the Privacy Act for information collected through it. The organisation holding the personal information is the relevant one; for these devices, that is likely to be the software provider.

But she says customers can reasonably expect sellers to examine product privacy risks. That is a due-diligence expectation, not a new blanket obligation imposed on every shop by today’s announcement.

Small-business coverage also needs checking separately. The OAIC’s small-business guidance says most businesses with annual turnover of A$3 million or less are exempt, with exceptions including health service providers. Turnover alone is therefore an incomplete test. Our Privacy Act explainer covers that distinction and the wider reforms.

Ask for answers about the actual product

Our recommendation is a short, documented supplier review. Start with the exact models you stock and the companion apps their instructions require. Record the hardware manufacturer and the app operator separately, rather than assuming the name on the box answers both questions.

Then ask the supplier for the app’s current privacy policy and a plain-English explanation of what information is collected, where it is stored and who can access it. Put unanswered questions in the record. A link to a policy is a starting point; it still needs to answer the questions relevant to the product.

For stock using HeyCyan, request the supplier’s response to the OAIC announcement. Ask who will provide security updates and how retailers will receive information about security problems or changes. These are our suggested purchasing checks, not claims that any particular model has an established flaw.

Give the owner or purchasing manager the answers together, so they can make and record the stocking decision. Avoid turning a supplier’s reassurance into a broad promise to customers that a device is safe or approved. If an answer is missing, record that gap explicitly rather than filling it with an assumption.

Businesses reviewing their own information handling can also use our website privacy-policy guide. Further regulatory coverage is in Rules & costs.

Checklist

These are our recommended stock-review steps.

• List the devices and apps. Have the purchasing manager record each smart-glasses model, manufacturer and required companion app.
• Identify the app operator. Ask the supplier who operates each app and obtain its current privacy policy.
• Request data-handling details. Ask the supplier what the app collects, where information is stored and who can access it; record unanswered questions.
• Request a security contact. Ask who provides updates and how your shop will hear about security problems; for HeyCyan stock, request a response to the OAIC announcement.
• Record the stocking decision. Have the owner review supplier answers and unresolved questions before deciding what the shop will offer.