Just when you thought the most embarrassing leak of confidential information of 2019 had already been made, leading to the UK Ambassador to the USA resigning, along comes one from Google that will
send shockwaves through the tech and marketing industry.
Industry insiders probably already knew that, contrary to what the public probably believes, Google does indeed listen in to a small
proportion of "Hey Google" enquiries so a human ear can listen to what people are asking for and can help train the system how to handle accents and the less formal way that people speak when talking
rather than writing.
The tricky part is whether the person in the street knows this -- and whether they have given permission for it to happen.
This will become crucial as the Irish
Data Protection Commission begins an investigation after a hugely embarrassing leak of audio data to Belgian news organisation VRT. It has put together a video of its accusations against Google, which include many clips of people speaking into their voice
assistant.
This is highly embarrassing for Google, which has issued a statement that it has always used humans to help it perfect its voice assistant, although I suspect most users would be
pretty surprised by this because it is certainly not something they make clear.
I certainly don't remember being asked for consent for my voice, or the rest of the family, to be sent to
Google's contractors.
The statement spells out how the
company keeps voice data secret, as you would expect. However, the worst part is that the VRT investigation shows that even when people do not have their voice linked to a specific account, it is
still possible to determine who they are because they give their name and address when ordering products or checking the weather and getting traffic information to and from work.
To prove the
point, the reporter at VRT visits people so they can hear themselves, and of course, look visibly shocked and angered for the camera.
A leak of data like this is bad. Google will claim
there is no personally identifiable data involved, but that argument will not stand up when the recordings feature people giving their name and address.
What is even more worrisome for Google
is the potential for children to be recorded. They are a special case under GDPR and can only have data held against them under the very strictest consent guidelines. The same goes for any medical,
religious or political data that the recordings may feature.
To be honest, Google is probably right when it says its intention is not to eavesdrop but rather to finesse its voice assistant
technology. The problem is that it has dropped the ball on privacy here, and the Irish data watchdog will have little alternative other than to investigate.
Given what the VRT video shows, it
is hard to imagine Google getting away with this one. The likelihood is that a large fine will follow.
If you're wondering why Ireland is investigating rather than the Dutch or
Belgian authorities whose citizens' information has been compromised, it's because Google has chosen to be based in Ireland and hence be judged on privacy matters in Dublin on behalf of the rest of
the EU.
I'm sure Google has some line it can churn out for why it is based in Ireland rather than the UK, which is by far its biggest EU market. However, I would advise looking at the
corporation tax rate in Ireland compared to the average in the EU. To save you running the risk of Google finding up you're checking up on it, the rate in Ireland is 12.5%, compared to 19% in the
UK.
So yes -- this is going to be bad. It is easy to imagine this is, indeed, Google's Cambridge Analytica moment. It's on a smaller scale with no election linked to it, but as far as eroding
trust in a big tech firm, it's likely to prove up there with the biggest case of them all.