Once Again, GDPR Is A Potential Privacy Nightmare: Amazon Sends 1,700 Voice Recordings To The Wrong User In GDPR Request

from the privacy? dept

Back in September, we wrote about how the GDPR could actually undermine privacy, when Jean Young noted that, when someone hacked into her Spotify account, they were able to download her entire data history. And now there’s another example of the privacy implications: Amazon recently responded to a GDPR data export request by sending 1,700 voice recordings… to the wrong user.

Following the passage of the European Union?s General Data Protection Regulation, or GDPR, any EU resident may demand a company send them the entirety of the data collected about them through both internet services and hardware products like an Alexa-equipped Echo smart speaker. One German user, under the alias ?Martin Schneider,? did just that in August of this year. What he got back from Amazon, however, were thousands of Alexa voice recordings, which was strange considering he didn?t own an Alexa device.

Upon listening to the files, Schneider discovered they were the recordings of another Alexa user. After failing to get in contact with Amazon about the issue, the man brought the files to c?t, where reporters were able to piece together who the Alexa user was. Among the files were commands to control Spotify, the person?s home thermostat, and alarms. There were also recordings that indicated the Alexa user also owned a Fire TV, and that they had a spouse who appeared to live in the home.

There are, of course, many different ways of thinking about this. On the whole, it’s a good thing that companies are giving users more access to data, and allowing them to not just see what’s being held, but to download it as well (it would be nice if things were more standardized, and it would enable easier shifting between services, but… baby steps). But, it also needs to be recognized that this creates new privacy challenges.

This isn’t necessarily good or bad, but is a useful reminder that, contrary to what many GDPR supporters will tell you, the GDPR itself doesn’t actually do much to “protect” your privacy, and could make your data even more vulnerable. Again, there are potentially good reasons for this, but way too many people keep insisting that the GDPR is about protecting privacy, and it is important to understand where and how it fails in that regard, and how it could even make much of your data more vulnerable.

Filed Under: , , , , ,
Companies: amazon

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Once Again, GDPR Is A Potential Privacy Nightmare: Amazon Sends 1,700 Voice Recordings To The Wrong User In GDPR Request”

Subscribe: RSS Leave a comment
12 Comments
Wally Charger says:

Not GDPR. Amazon.

Little detail ya missed makes your take delightfully insane.

Again you wish to throw out the privacy concerns of 300 million over one incompetent corporation.

Stiff fines should ensure against a repeat, and if not then JAIL executives starting with Bezos since he profits the most.

Next mistaken premise, please. I spent more time concocting screen name than you did this.

Anonymous Coward says:

And this sort of idiocy wont stop or change while we’ve got stupid politicians introducing laws at the behest of certain industries (for money, no doubt!) whrn they haven’t got any idea what they’re doing or simply dont care the consequences! Grandstanding and making monumental fuck ups seem to be far more important than using sense and taking notice of experts who DO know!

nohillside (profile) says:

So, basically, Amazon fucked up

Don’t shoot the messenger (aka GDPR)!

In a nutshell Amazon just fucked up. They blame operator error, but can we be sure about that? Or did this GDPR request just show that Amazon stores user-related data much longer than really needed, is still able to link it back to a user but doesn’t have the operational stability in place to ensure that a users sees only their data?

Anonymous Coward says:

Re: So, basically, Amazon fucked up

In a nutshell Amazon just fucked up.

Exactly.

This is a case of multi-billion dollar international corp implementing a new policy due to the legal / political environment around them changing, and doing it wrongly as virtually everyone would expect.

TFS is also a case of click-bait, decrying legislation that makes it harder for companies to silently profit off of unsuspecting consumers, by claiming it does the exact opposite and using poorly cherry picked examples.

Killercool (profile) says:

Re: Re:

Oh, man! People were being spied on?!

Oh, wait, no. The thousands of Alexa commands were all of the requests made after someone activated their device.

While they can be used to identify someone (obviously, since the guy did it), that’s not what I would consider "spying." Not unless you categorize your auto parts dealer having receipts and an order history "spying," too.

Even I would agree that the blame is on Amazon, not GDPR, in this particular instance. However, 24/7 surveillance (or surveillance at all), this is not.

Rekrul says:

Re: Re: Re:

Oh, wait, no. The thousands of Alexa commands were all of the requests made after someone activated their device.

Alexa records more than just your commands. People have accessed Alexa’s recordings and found that they included parts of conversations, phone calls, etc.

In order to respond to your commands, Alexa is always listening to you. Any voice controlled device is always listening for commands, which means it’s listening to everything you say.

Is it being sent back to the company? Maybe, maybe not. Have there been any indepth investigations into this to prove that it isn’t sending everything you say back to the company?

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...