Deleuze replied: The key legal point is that passengers cannot be treated as having agreed to IRIS merely because the driver, operator, or vehicle owner accepted the legal terms. If passengers’ faces, bodies, voices, or behavioural signals are captured, they may become data subjects in their own right. The operator therefore needs a lawful basis for processing their personal data under GDPR Article 6, separate from any agreement with the driver. Consent is not the only possible lawful basis, but if the company relies on consent it must be genuine, informed, freely given, and specific; passive entry into a bus or taxi is unlikely to be enough on its own. The strongest compliance position would be that IRIS is designed so that it does not capture or process passenger data at all, or does so only in a fleeting and technically unavoidable way. For example, the camera should be physically angled and technically configured to focus only on the driver; passenger faces should be excluded from the field of view, blurred, cropped, or discarded immediately; and all processing should preferably occur locally in the vehicle without recording or transmission. This reflects GDPR’s data protection by design and by default requirement, which requires controllers to implement appropriate technical and organisational measures so that only necessary personal data is processed.

Deleuze replied: If IRIS is deployed across a fleet of buses, taxis, or public transport vehicles, a Data Protection Impact Assessment would very likely be required. The use of cameras, AI analysis, possible biometric or health-related inferences, and systematic monitoring in vehicles accessible to the public creates a high-risk processing scenario. GDPR Article 35 specifically identifies systematic monitoring of publicly accessible areas on a large scale as a case where a DPIA is required. The status of the data must also be assessed carefully. A passenger’s face captured by a camera is personal data if the passenger is identifiable. It is not automatically special-category biometric data merely because it is a facial image; GDPR Recital 51 says photographs should not systematically be treated as special-category data unless processed through specific technical means allowing unique identification or authentication. However, if IRIS performs face recognition, passenger identification, biometric categorisation, or emotional/physiological inference on passengers, the legal risk becomes much higher.