An Amazon Alexa user from Germany decided to exercise his rights under the EU’s GDPR anddemanded his personal datarecorded by the company. Instead, he received1,700 audio recordingsof someone else he doesn’t know.
The man demanded a copy of all the data Amazon has on him. Two months later hereceived a 100MB filewhich contained some of his own data related to the Amazon searches he made.
But there were hundreds of audio files andAlexa transcriptstoo in the received files — none of which he could recognize. What’s surprising is that hedoesn’t even own any Echodevice.
So hereported this to Amazonand asked for further information, but he didn’t get an answer.Later, he saved the files and shared the story with Germanys’C’t magazine.
The magazine started itsown investigationand listened to the files. It was able to put together an informative picture of who the other user is.
They were also able to figure out hispersonal habits, devices he owns, taste in music, the identity ofhis girlfriend; it even managed listened to him in the shower(creepy, right!?).
Finally, theytracked down the other userwho was unaware that Amazon had shared his personal data with someone else. He also confirmed that all those audio clips belonged to him and that Amazon didn’t inform him about the leak.
Amazon, in its defense, said that this goof-up was a result of aone-time errormadeby a staff member. However, the company still stands liable to fines under EU law.
In short, this story once again confirms our fears about whether virtual assistants can really be trusted. Amazon always insists that Echo devices are not listening constantly unless they are activated. But the given number of such incidents only prove otherwise.
