The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) has opened an administrative procedure to prohibit Google from transcribing Google Assistant recordings by employees or third parties for a period of three months. This is intended to protect the privacy rights of those affected for the time being.
Last month, it was reported that Google uses its Google Home language assistant to evaluate people’s voice recordings to enhance Google Assistant’s speech recognition capabilities.
In these evaluations, employees of Google or commissioned companies hear the voice recordings and transcribe them to analyse whether the recorded acoustic information has been processed correctly by the underlying KI system.
Google acknowledged the fact in a statement saying,
As part of our work to develop speech technology for more languages, we partner with language experts around the world who understand the nuances and accents of a specific language. These language experts review and transcribe a small set of queries to help us better understand those languages. This is a critical part of the process of building speech technology, and is necessary to creating products like the Google Assistant.
The recorded conversations – some of them sensitive – were based on personal information from the private and personal sphere of those affected by the staff assigned by Google.
HmbBfDI stated,
Using automated language assistants from vendors such as Google, Apple, and Amazon is proving to be a high risk to the privacy and privacy of those affected. This applies not only to people who run a language assistant, but also to anyone who comes into contact with it, such as when they live in a household that uses devices that have Google Assistant installed, for example.
Acording to the General Data Protection Regulation (DSGVO) in Germany, the so-called lead supervisory authority is initially responsible for the orders. This is the authority in the Member State where the head office of the responsible body is located. For Google, this is the IDPC in Ireland.
Nevertheless, the GDPR provides data protection authorities in other Member States with the possibility to take measures within their territory or area of ​​responsibility for a period of no more than three months if there is an urgent need to protect the rights and freedoms of those concerned.
HmbBfDI say that this is the case here, because an effective protection of those affected from listening to, documenting and evaluating private conversations by third parties can only be achieved by a timely execution.
Johannes Caspar, the Hamburg Commissioner for Data Protection and Freedom of Information, said:
“The use of language assistance systems in the EU must comply with the data protection requirements of the GDPR. In the case of the Google Assistant, there are currently significant doubts. The use of language assistance systems must be done in a transparent way, so that an informed consent of the users is possible.
In particular, this involves providing sufficient information and transparently informing those concerned about the processing of voice commands, but also about the frequency and risks of mal-activation.
Finally, due regard must be given to the need to protect third parties affected by the recordings. First of all, further questions about the functioning of the speech analysis system have to be clarified. The data protection authorities will then have to decide on definitive measures that are necessary for a privacy-compliant operation. “
