The EDPB published VVA guidelines giving context to the use of Virtual Voice Assistants in compliance with the GDPR.
Recently, the EDPB published its guidelines for the use of virtual voice assistants. A virtual voice assistant (VVA) is a system that understands and executes voice commands and works with other IT systems if needed. It acts as an interface between users and their devices or online services like search engines. These services are very popular particularly with the integration of smart devices and smart homes. Due to the popularity of these devices in the home, in vehicles and even being worn by users, they are often given access to quite a bit of information on individuals, often of an intimate nature, which could threaten users’ rights to privacy. As a result VVAs have come under major scrutiny from several data protection authorities. The EDPB, by releasing these guidelines for the use of virtual voice assistants seeks to give guidance on the application of these systems in the context of the GDPR as well as other applicable legal frameworks.
VVAs use machine learning methods which require the collections and interpretation of large amounts of voice data.
Virtual voice assistants rely very heavily on machine learning methods in order to perform their wide range of tasks. For starters, these devices usually have a wake up command, for example either pushing a button or having a command word which wakes the device up, and puts it into active listening mode. VVAs typically depend on large data sets to be collected, selected, and labeled. Both quality and quantity of data in these scenarios are equally important and as a result, the VVA’s typically depend on snippets, which could give context to the use of the devices and service in real conditions. In some circumstances the VVA can capture audio of individuals who did not intend to use the VVA service in error. For example, in an instance where the wake up expression is accidentally detected, or the wake up expression has changed and the user has accidentally woken up the device by using the new wake up expression unbeknownst to them. For this reason, among several others, it is imperative that VVA services function in compliance with the GDPR particularly regarding the storage of data.
The guidelines set out by the EDPB outline the legal framework for VVAs regarding not just the GDPR, but in some cases, the e-Privacy Directive.
Because VVAs will undoubtedly process significant amounts of personal data, the relevant legal framework for VVAs is the GDPR. In addition to the GDPR, for all actors who require storage or access to information stored in the terminal equipment of a subscriber or user, the e-Privacy Directive sets a specific standard. The term “terminal equipment” refers to any smart phones, smart TVs, or any similar IoT devices. VVAs should also be considered as terminal devices when information in the VVA is stored or accessed. In all of those cases, the provisions for the e-Privacy Directive are applicable. The VVA guidelines published by the EDPB provide guidance on the identification of data processors and stakeholders, transparency, processing of children’s data, processing of special categories of data, as well as many other elements of data protection relating to VVAs.
The EDPB published VVA guidelines, specifically outlining mechanisms for exercising Data Subject Rights.
The EDPB has suggested several mechanisms for exercising data subject rights. These include the right to access, right to rectification, right to erasure, and the right to data portability. Data controllers must allow all users, whether registered or not, access to all of those rights. The data controllers must provide information on the data subjects’ rights, at best when a data subject turns on a VVA, or at the very latest when the first user voice request is processed. Since the main interaction intended for VVAs is using voice commands, and a portion of the VVA users are actually persons with disabilities requiring them to use voice assistance, VVA designers should ensure that users can exercise any of their data subject rights using easy to follow voice commands. The EDPB suggests implementing specific tools in the development of VVAs, providing efficient and effective ways to exercise data subjects rights.
