Data Protection Authority
Regulatory Action

German DPA stops Google from harvesting from smart speaker

The Data Protection Authority in Hamburg has told Google to stop harvesting data from the search engine’s personal assistant.

Google Assistant is integrated into many smart speakers in order to help the tech giant develop its speech recognition systems, Google claims.

The clamp down on data collection began on August 1st 2019 and will continue for three months. It comes in the wake of news reports detailing how workers at Google and third-party contractors eavesdropped through smart speakers on conversations had by users in Holland. The practice contravenes user privacy standards as stipulated in the EU’s General Data Protection Regulation.

Hamburg’s Data Protection Authority has now ordered Google to stop data processing in this manner throughout the Eurozone. It has urged other regulators in Europe to look into these kinds of practices which other companies also rely upon to collect their data. Amazon is similarly guilty of this methodology, as evidenced by news reports explaining how the retail giant has used private user conversations to “improve” Amazon’s digital assistant, Alexa.

Hamburg’s commissioner for data protection and freedom of information, Johannes Caspar, said in a statement:

“The use of language assistance systems in the EU must comply with the data protection requirements of the GDPR. In the case of the Google Assistant, there are currently significant doubts.”

Google has since confirmed that it is no longer processing data on European users in this way and has said it is collaborating with agencies in Hamburg to ensure that local data protection standards are adhered to.

A Google spokesperson said:

“These reviews help make voice recognition systems more inclusive of different accents and dialects across languages.”

Under the GDPR, the Hamburg Data Protection Authority can only force Google to stop collecting data in this way for three months maximum. Any further action must be taken by the Data Protection Authority in Ireland.