Deleuze replied: Regarding informed consent: IRIS must have a clear lawful basis for processing. The operator cannot rely only on a privacy policy or broad user agreement. It must identify a lawful basis under GDPR Article 6, and where biometric or health data is involved, it must also identify a valid Article 9 condition. If consent is used, it must be explicit and freely given; this may be difficult in employment, fleet, public transport, or insurance-linked contexts where the driver has limited practical choice.

Deleuze replied: 100%. Because IRIS may affect safety and potentially employment or fleet decisions, there should also be human oversight and contestability. A fatigue alert should not automatically lead to punitive consequences without review. Drivers should be able to challenge inaccurate alerts, request access to relevant data, seek correction or deletion where applicable, and understand how decisions are made. This is especially important where false positives could unfairly label a driver as unsafe or impaired. From an ethical standpoint, IRIS must respect autonomy, dignity, fairness, and proportionality. The safety aim is legitimate, but it does not justify unlimited monitoring. The system should protect drivers from foreseeable harm, avoid discriminatory performance across demographic groups, avoid turning safety monitoring into workplace or passenger surveillance, and ensure that the benefits of fatigue detection are distributed fairly across all drivers.