German privacy probe orders Google to stop listening in on voice recordings for 3 months

Google bows to power of GDPR

Germany's data protection commissioner in Hamburg has launched an investigation into Google over revelations that contracted workers were listening to recordings made via smart speakers.

Google has been ordered to cease manual reviews of audio snippets generated by its voice AI for three months while the investigation is under way.

In a blog post last month, Google admitted it works with experts to review and transcribe a small set of queries to help better understand certain languages.

That was after a bunch of Belgian investigative journalists discovered staff were listening in on people who use its voice-activated Google Assistant product.

David Monsees, Google's product manager of search, wrote at the time: "We just learned that one of these language reviewers has violated our data security policies by leaking confidential Dutch audio data. Our Security and Privacy Response teams have been activated on this issue, are investigating, and we will take action. We are conducting a full review of our safeguards in this space to prevent misconduct like this from happening again."

Johannes Caspar, the Hamburg Commissioner for Data Protection and Freedom of Information, said (PDF): "The use of speech assistance systems in the EU must comply with the data protection requirements of the GDPR. In the case of the Google Assistant, there are currently considerable doubts about this. The use of speech assistance systems must be transparent so that informed consent can be obtained from users.

"In particular, this involves sufficient and transparent information for those concerned about the processing of voice commands, but also about the frequency and risks of misactivation. Finally, due account must be taken of the need to protect third parties affected by voice recordings. As a first step, further questions about the functioning of the speech analysis system need to be answered. The data protection authorities will then have to decide on the final measures that are necessary for their data protection-compliant operation."

A Google spokesman said: "We are in touch with the Hamburg data protection authority and are assessing how we conduct audio reviews and help our users understand how data is used.

"These reviews help make voice recognition systems more inclusive of different accents and dialects across languages. We don't associate audio clips with user accounts during the review process, and only perform reviews for around 0.2% of all clips. Shortly after we learned about the leaking of confidential Dutch audio data, we paused language reviews of the Assistant to investigate." ®