Privacy Architecture: Privacy by Physics

1. Introduction: The Privacy Problem in Outdoor Robotics

Autonomous outdoor robots that navigate residential environments face an inherent tension: effective navigation requires environmental perception, but environmental perception in residential areas captures personal data. Forward-facing cameras, LiDAR scanners, and radar systems that enable robust navigation also generate data about people, vehicles, and property — creating surveillance capability as a byproduct of mobility.

The industry's typical response is software mitigation: capture everything, then selectively process, blur, or delete sensitive data. This approach has three structural weaknesses:

1. The data exists before filtering — even momentarily, personal data is captured, transmitted, and processed
2. Software is mutable — policies can change, updates can alter behavior, vulnerabilities can expose data
3. Scope creep risk — a forward-facing camera that "doesn't currently" capture faces could be updated to do so

2. Architectural Approach: Physical vs. Software Privacy

Volta's approach inverts the conventional model. Rather than capturing personal data and filtering it out, the architecture prevents personal data from being captured at its source.

The core mechanism is the camera's orientation and field of view. By pointing the camera exclusively downward at the turf surface, the system's visual input is limited to grass blades, soil, organic matter, growth patterns, density variations, stress indicators, ground-level obstacles, and surface texture.

3. Sensor Design and Field of View

The Lawn Companion's primary perception sensor is a downward-facing camera mounted in a recessed housing. The optical axis points approximately perpendicular to the ground plane. The field of view is constrained to a region directly beneath and immediately ahead of the robot.

This design serves dual purpose:

1. Agronomic perception — measuring turf health, growth rate, density at the leaf level
2. Navigation — visual odometry and surface feature tracking for wire-free pathfinding

The camera's position is recessed and angled to protect the lens from rain, debris, and UV exposure (see CLM-DM-002 in durability documentation).

4. What the System Sees and Cannot See

Captured Data (by physical capability)

Data Physically Cannot Be Captured

5. GDPR Article 25 Alignment

GDPR Article 25 establishes two requirements:

1. Data Protection by Design — implement appropriate technical measures to ensure data protection principles are embedded into processing
2. Data Protection by Default — ensure that, by default, only personal data necessary for each specific purpose is processed

Volta's privacy architecture satisfies both requirements at the hardware level:

• By Design: The sensor's physical constraints prevent personal data capture. This is not a processing decision — it is an engineering decision embedded in the hardware.
• By Default: The default state of the system captures zero personal data. No configuration is required to achieve this.

This approach is arguably stronger than software-based GDPR compliance because the guarantee is independent of software version, configuration state, or operational context.

6. Cloud Connectivity Without Surveillance

A significant advantage of the downward-facing architecture is that it eliminates the tension between cloud connectivity and privacy. Connected outdoor robots with forward-facing cameras face a dilemma: cloud features require data transmission, but transmitting environmental imagery creates surveillance risks.

Volta's architecture resolves this: because the camera captures only agronomic data (turf, soil, growth patterns), this data can be freely transmitted to cloud systems without privacy concerns. This enables:

• Real-time fleet intelligence aggregation
• Cloud-based lawn health analytics
• Remote diagnostic capabilities
• Continuous model improvement from fleet data

All without creating a surveillance infrastructure.

7. Comparison with Alternative Architectures

Volta's approach trades some navigation capability (no forward visibility) for complete privacy elimination. The system compensates through GNSS, IMU, and the floating hexoskeleton for contact detection.

8. Limitations and Open Questions

• Near-ground objects: The system CAN see objects at ground level (shoes, small toys). While these are not personal data in the GDPR sense, they are property.
• Indirect identification: Turf patterns theoretically could be matched to specific properties. Whether this constitutes personal data under GDPR is an open legal question.
• Future sensor additions: The privacy guarantee applies only to the current sensor configuration. Any future addition of non-downward sensors would need separate analysis.

9. Evidence Registry