Hamburg data protectors take action against Google Assistant

The use of automated voice assistants from providers such as Google, Apple and Amazon is proving to be highly risky for the privacy and intimacy of those affected. This applies not only to people who operate a voice assistant, but to everyone who comes into contact with it, for example if they live in a household where devices are used on which Google Assistant is installed, for example.

Supported by recordings leaked by whistleblowers, it was recently reported in the media that Google is having acoustic recordings of users analyzed by humans as part of its Google Home voice assistant in order to optimize the Google Assistant’s voice recognition capabilities. In these evaluations, employees of Google or of contracted companies listen to the voice recordings and transcribe them in order to analyze whether the recorded acoustic information was correctly processed by the AI system behind it. As the whistleblowers’ report has shown, the recorded conversations – some of them sensitive – allowed Google’s employees to extract personal information from the private and intimate spheres of the people concerned. Furthermore, a not inconsiderable number of recordings were made due to faulty activation.

Against this background, the Hamburg Commissioner for Data Protection and Freedom of Information has opened administrative proceedings to prohibit Google from carrying out corresponding evaluations by employees or third parties for a period of three months. This is intended to protect the personal rights of those affected for the time being.

According to the General Data Protection Regulation, the so-called lead supervisory authority is initially responsible for issuing orders. This is the authority in the Member State where the main establishment of the responsible entity is located. For Google, this is the IDPC in Ireland. Nevertheless, the GDPR also provides for the possibility for data protection authorities in other Member States to take measures in their territory or jurisdiction for a maximum period of three months if there is an urgent need to act to protect the rights and freedoms of data subjects. This is the case here, because effective protection of data subjects against the interception, documentation and evaluation of private conversations by third parties can only be achieved through timely enforcement.

Google has stated to the HmbBfDI in the context of this administrative procedure that already at present and for a period of at least three months from August 1, 2019 transcriptions of voice recordings will no longer take place. This assurance relates to the EU as a whole. In this respect, the responsible authorities for other providers of voice assistance systems, such as Apple or Amazon, should now also quickly review the implementation of corresponding measures.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.