• by Sean Hargrave , Staff Writer, July 15, 2019

Industry insiders probably already knew that, contrary to what the public probably believes, Google does indeed listen in to a small proportion of "Hey Google" enquiries so a human ear can listen to what people are asking for and can help train the system how to handle accents and the less formal way that people speak when talking rather than writing.

The tricky part is whether the person in the street knows this -- and whether they have given permission for it to happen.

This will become crucial as the Irish Data Protection Commission begins an investigation after a hugely embarrassing leak of audio data to Belgian news organisation VRT. It has put together a video of its accusations against Google, which include many clips of people speaking into their voice assistant.

This is highly embarrassing for Google, which has issued a statement that it has always used humans to help it perfect its voice assistant, although I suspect most users would be pretty surprised by this because it is certainly not something they make clear.

I certainly don't remember being asked for consent for my voice, or the rest of the family, to be sent to Google's contractors.

The statement spells out how the company keeps voice data secret, as you would expect. However, the worst part is that the VRT investigation shows that even when people do not have their voice linked to a specific account, it is still possible to determine who they are because they give their name and address when ordering products or checking the weather and getting traffic information to and from work.

To prove the point, the reporter at VRT visits people so they can hear themselves, and of course, look visibly shocked and angered for the camera. 

A leak of data like this is bad. Google will claim there is no personally identifiable data involved, but that argument will not stand up when the recordings feature people giving their name and address.

What is even more worrisome for Google is the potential for children to be recorded. They are a special case under GDPR and can only have data held against them under the very strictest consent guidelines. The same goes for any medical, religious or political data that the recordings may feature.

To be honest, Google is probably right when it says its intention is not to eavesdrop but rather to finesse its voice assistant technology. The problem is that it has dropped the ball on privacy here, and the Irish data watchdog will have little alternative other than to investigate.

Given what the VRT video shows, it is hard to imagine Google getting away with this one. The likelihood is that a large fine will follow. 

If you're wondering why Ireland is investigating rather than the Dutch or Belgian authorities whose citizens' information has been compromised, it's because Google has chosen to be based in Ireland and hence be judged on privacy matters in Dublin on behalf of the rest of the EU.

I'm sure Google has some line it can churn out for why it is based in Ireland rather than the UK, which is by far its biggest EU market. However, I would advise looking at the corporation tax rate in Ireland compared to the average in the EU. To save you running the risk of Google finding up you're checking up on it, the rate in Ireland is 12.5%, compared to 19% in the UK.

So yes -- this is going to be bad. It is easy to imagine this is, indeed, Google's Cambridge Analytica moment. It's on a smaller scale with no election linked to it, but as far as eroding trust in a big tech firm, it's likely to prove up there with the biggest case of them all.