Google has assured the Data Protection Authority of Hamburg to forego a human evaluation of Google Assistant transcriptions that are recorded on Smartphones or Google Home when requesting Voice Assistants – both from employees of the company and subcontractors.
This Google-accepted concession on behalf of Google was achieved by the Hamburg Data Protection Supervisor in the context of the opening of an administrative procedure that temporarily prohibits the manual evaluation of voice recordings for three months, and now calls on the authorities responsible for Amazon and Apple to do the same with these companies. All voice assistant providers manually evaluate a small percentage of user requests to train the systems and verify that the requests are recognized correctly. These recordings also contain personal and intimate information about users in the event of unintentionally triggered recordings.
The Hamburg Data Protection Authority declares, in view of the opening of the administrative procedure against Google, that “[sich] Using automated language assistants from vendors such as Google, Apple, and Amazon as high-risk to the privacy and privacy of those affected [erweist]“. In addition, the authority sees the proportion of unwanted shots as “not insignificant” at.
DSGVO restricts funds of the DPA
German Data Protection Authorities can not impose a suspension period longer than three months, because under DSGVO the supervisory authority of the Member State in which the company is based has jurisdiction. In the case of Google, this is Ireland. However, the GDPR provides for the possibility for data protection authorities in other Member States to take measures within their territory or area of responsibility for a period of no more than three months if there is an urgent need to protect the rights and freedoms of those concerned. This circumstance sees the Hamburg Data Protection Authority given that “effective protection of those affected from listening to, documenting and evaluating private conversations by third parties“Must be achieved.
The use of language assistance systems in the EU must follow the data protection requirements of the GDPR. In the case of the Google Assistant, there are currently significant doubts. The use of language assistance systems must be done in a transparent way, so that an informed consent of the users is possible. In particular, this involves providing sufficient information and transparently informing those concerned about the processing of voice commands, but also about the frequency and risks of mal-activation. Finally, due regard must be given to the need to protect third parties affected by the recordings. First of all, further questions about the functioning of the speech analysis system have to be clarified. The data protection authorities will then have to decide on definitive measures that are necessary for a privacy compliant operation.
Johannes Caspar, the Hamburg Commissioner for Data Protection and Freedom of Information
Disable storage of recordings at Apple
Only a few days ago it became known that the server-side storage of requests to Siri can be deactivated on Apple's iOS devices. However, the corresponding option is not accessible via the settings in the operating system, but can only be made via a self-created or downloaded configuration profile.