In 2019, a major privacy scandal regarding Siri, the voice assistance system from Apple (headquartered in California), came to public attention. At the time, employees of Apple subcontractors reported how Siri audio recordings were analyzed by employees and how data protection was disregarded in the process. It was not uncommon for the recordings to contain very intimate details, personal or even compromising information that made it possible to identify the person.
As a result, a class action was filed with the court, which Apple not only a violation of Californian data protection lawbut also breach of contract in connection with the Federal Wiretap Act, which regulates data protection requirements relating to communications services, as well as unfair competition.
What had happened?
The accusation against Apple is that the voice assistant Siri listened in too much. Normally, the system is prompted via so-called "hot words" like "Hey, Siri" to make audio recordings and evaluate them accordingly.
In this case, however, employees of Apple subcontractors discovered that Siri was recording and evaluating data even in situations in which it was not supposed to be listening in, and was passing on the corresponding information to third parties. The third parties used the data primarily for advertising purposes.
For example, some class action plaintiffs reported that they received advertisements for the treatment discussed after discussions with doctors or advertisements for a restaurant after private discussions about that very restaurant.
In these cases, Apple speaks of an "unintentional activation" of the voice assistant. Immediately after the accusations in 2019, Apple also stopped the evaluation of Siri audio recordings by employees and held out the prospect of data protection improvements. Still at the end of the same year, however, human evaluation was carried out again if the user consented to further processing once. Apple says it no longer evaluates recordings that were made unintentionally, but deletes them immediately. In addition, only the company's own employees are supposed to have access to Siri recordings.
Users still do not get an insight into their own Siri queries. Deleting these queries and the associated data also seems to be possible only to a very limited extent.
Development in court
The competent judge has now largely allowed the class action. Only the allegation of unfair competition had to be deleted. Apple must now answer to the data protection allegations in court.
Similar complaints have already been filed against the voice assistance systems of competing providers such as Google and Amazon, against which similar proceedings are being sought in the USA under the leadership of the same defense lawyers.
Results are still pending.
Investigations also required in the EU
A whistleblower from the Apple company is now also calling for consequences for Apple in the EU under data protection law. In his opinion, uncovering the actions and taking consequences is so important that he broke his confidentiality agreement with the subcontractor to do so.
He formulated a proposal to European data protection authorities and the European open letter addressed to the data protection officer. In it, he calls for an investigation into the Group's previous and current actions and a review of all data collected.
His demands and his concerns are not limited to Apple's Siri, but extends it to all voice assistance systems.
Whether such a (judicial) investigation will also take place in the EU remains to be seen.
English 
Deutsch 
Español 
Français 
Polski