Google’s smart speakers’ GDPR compliance under investigation in Germany

Google’s speech-assistance system's compliance with the EU’s data-protection rules is the subject of an investigation initiated today by Hamburg's data protection authority.

The regulator said it started an administrative procedure to stop the tech giant from carrying out speech evaluations by employees or third parties, as there are doubts about its compliance with the EU's General Data Protection Regulation. Google has said it will stop evaluating the audio during the three-month investigation period starting today, Aug. 1.

The move comes after media reports in July indicated that data were leaked from Google's Home Speech Assistant — smart speakers that enable users to interact with Google Assistant via voice commands.

The tech giant’s employees or contracted companies used audio recordings to optimize the speech recognition process, sometimes without people knowing that the systems were activated. Google said in a statement following the report that it is taking action to update its security policy.

The Hamburg commissioner for data protection said in a statement that the use of these systems in the EU must comply with GDPR.

“In the case of the Google Assistant, there are currently considerable doubts about this. The use of speech assistance systems must be transparent so that informed consent can be obtained from users,” Johannes Caspar said.

Caspar said that some questions about the functioning of the speech analysis system need to be answered now, after which data protection authorities will have to decide on possible follow-up measures.

Google has its headquarters in Ireland, so the Irish supervisory authority, which has been notified about the German investigation, would initially be ruling in the case as the lead supervisory authority under GDPR.

However, GDPR allows data protection authorities in other member states to take measures within their territories for a period of no longer than three months.

“We are currently examining this matter ourselves as part of our supervisory function as Lead Supervisory Authority for Google Ireland and we have been notified by the Hamburg DPA of the procedure that they have initiated,” Graham Doyle, head of communications at the Irish regulator told MLex.

On Aug. 2, Apple also said that it has suspended a program in which it analyzed recordings of people interacting with its Siri assistant system, adding it will carry out a review.

In future Siri software updates, people will be able to choose to be part of a so-called grading process, in which contractors listen to recordings to find out whether Siri is hearing users' audio correctly, Apple said in a statement to MLex.