A German privacy watchdog in Hamburg, Germany has ordered Google to cease manual reviews of audio snippets generated by its voice AI.
This follows a leak last month of scores of audio snippets from the Google Assistant service. A contractor working as a Dutch language reviewer handed more than 1,000 recordings to the Belgian news site VRT, which was then able to identify some of the people in the clips. It reported being able to hear people’s addresses, discussion of medical conditions, and other private recordings.
The Hamburg data protection authority (DPA) told Google of its intention to use Article 66 powers of the General Data Protection Regulation (GDPR) to begin an “urgency procedure” under Article 66 of GDPR last month.
Article 66 allows a DPA to order data processing to stop if it believes there is “an urgent need to act in order to protect the rights and freedoms of data subjects”.
This appears to be the first use of the power since GDPR came into force across the bloc in May last year.
Google says it responded to the DPA on July 26 to say it had already ceased the practice, taking the decision to manually suspend audio reviews of Google Assistant across the whole of Europe, and doing so on July 10, after learning of the data leak.
Last month it also informed its lead privacy regulator in Europe, the Irish Data Protection Commission (DPC), of the breach, which said it is now “examining” the issue highlighted by Hamburg’s order.
The DPC said Google Ireland filed an Article 33 breach notification for the Google Assistant data a couple of weeks ago.
It’s not clear whether Google will be able to reinstate manual reviews in Europe in compliance with the bloc’s privacy rules. The Hamburg DPA writes in a statement on its website that it has “significant doubts” about whether Google Assistant complies with EU data-protection law.