Hamburg DPA Tells Google to Stop Reviewing EU Voice Recordings

The Hamburg Commissioner for Data Protection and Freedom of Information is reviewing speech assistance systems operating in the European Union to determine the steps necessary for GDPR compliance. The press release issued by the Hamburg DPA called automatic speech assistants “highly risky” for data subject privacy.

The case arose based on media reports that employees and third parties of Google evaluated recordings from its Home Speech Assistant to improve the speech recognition. The recordings contained personal information, including sensitive information, about the individuals recorded.

Although Ireland is the lead supervisory authority for Google, the Hamburg DPA initiated an administrative procedure to prohibit employee or third party review of the recordings for three months under its authority to take measures within its territory based on an urgent need to protect the rights of data subjects. Google has agreed to suspend the activity across the EU for at least three months starting on August 1st.

The Hamburg DPA intends to review a number of aspects with regard to the recordings, including whether there was sufficient transparency to obtain informed consent from users. The Hamburg DPA expressed concerns that there was not sufficient information about the processing of voice commands, and the frequency/risks of misactivation. The Hamburg DPA also called on the impact of third parties affected by voice recordings to be taken into account.

The review of user recordings to train speech recognition and artificial intelligence has been a hot topic in the media over the last few months, with reporters covering assistants at Apple and Amazon in addition to Google. Expect the data protection authorities to consult with each other and weigh in with guidance in the future in order to handle data privacy cases such as this one. With GDPR only fifteen months old, there are sure to be many other examples in the next few years as the DPAs tell companies how they should be handling edge cases in order to maximize privacy.

The prospect of fines has not been announced for Google or any other company.