I am not a solicitor but my main work is in information governance and data ethics in a UK legislative context.
On the basis that the Lock Glimpse software is sharing personal data with a third party in an opaque way, i.e. not made clear to the user in practice, and can’t easily be deactivated (not the on screen features but the background processes that transmit personal data to the third party), I think it is unethical to sell a product to consumers on the promise of one level of privacy, to which they are asked to agree to on purchase and activation of the product, and then make future security software updates to that product conditional on them agreeing to reduce the level of privacy that they agreed to on purchase and activation of the product.
It is also possible that this behaviour breaches legislation and regulations in the UK.
In the meantime, if you open the Lock Glimpse settings page via Settings > Lock Screen > Lock Glimpse and then enter the app settings for this app by swiping up from the bottom of the screen, activating the menu by tapping the app icon at the top of the app card and selecting “App Info” from the pop up menu, and in those settings select “Disable”, I believe this will stop the Lock Glimpse transmitting data to the third party.
However, what Nothing Customers deserve, and I believe are legally entitled to in the UK, is a plain English explanation of exactly what personal data the software shares with any third party and for what explicit purpose(s) (see Article 6 of the UK General Data Protection Regulations and the principle of purpose limitation on the Information Commissioner’s Office Website), and how to withdraw consent and stop the data transfer.
The bundling of this data sharing software with security updates that could be considered necessary for the continuing nominal functioning of the device that has already been purchased and may be within a warranty period is legally troubling, because it bring into question whether customers are giving consent freely, which, one assumes, forms the lawful basis on which personal data is shared with the third party as defined in article 6 of the UK GDPR, and I think Nothing’s legal team should look at this.
https://www.legislation.gov.uk/eur/2016/679/article/6
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/purpose-limitation/
