1

This is in the UK.

For anyone who might not know, Alexa is an AI voice command application often attached to other devices. It lets people issue demands for things like music, or ask it questions, such as, "Who was the first man on the moon?"

In its default mode, it constantly listens and records. These recordings are apparently only kept when the wake word is used. The voice recording of some time prior to the wake word, plus the command issued, is sent to the cloud so it can be deciphered and turned into something the device can process. Example: "Play [song title]."

Questions:

  • In a childcare setting, is it legal for Alexa to constantly be listening around the children?

  • In a childcare setting, is it legal for voice recordings of commands the children give Alexa to be made in the first place, and then sent to the cloud?

This is under the assumption the parent/guardian has not been made aware of Alexa being in the setting, or that it is being used with the children. No permission has been given.

I know the law on voice recordings is difficult to pin down, and I couldn't find anything pertaining specifically to Alexa, so I wondered if anyone here might know.

3

It is neither legal nor illegal, but would depend on the circumstances. For example, such use of a smart assistant might be perfectly fine if the childcare provider could demonstrate a legitimate interest for using the smart assistant, and gave reasonable notice about audio being recorded. Parental permission is likely not necessary.

In practice, doing this right would be far too much effort. For example:

  • Has the necessary information per GDPR Art 13 been provided, taking into account the EDPB guidelines on transparency?
  • Under what legal basis are conversations sent to Amazon, an US-based provider, taking into account the Schrems II ruling?
  • How will data subject rights be satisfied, in particular the right to access to these recordings, the right to erasure, and the right to object to further processing?

Having discovered such processing of personal data that isn't necessarily kosher, a parent/guardian might start by objecting (GDPR Art 21) to further processing. This could be satisfied by powering off the Alexa devices in all rooms where the child is expected to be. The childcare should respond within one month. If no satisfactory response has been received, one option would be to lodge a complain with the supervisory authority, which would be the ICO in the UK.

1
  • Thank you very much for your answer. It was really useful, and has helped me understand more about this. It was a very comprehensive answer, but very clear. – JustChecking Oct 31 '20 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.