Guidelines 02/2021 on Virtual Voice Assistants

What it covers

This document analyses the data protection implications of virtual voice assistants (VVAs), describing their technical operation and the roles of designers, developers and users, and examining purpose limitation, legal basis, transparency, special category data, retention, security and data subject rights for voice-processing services. It also addresses the interaction between the GDPR and the ePrivacy Directive for VVA data stored on or accessed from terminal devices.

Why it matters

It gives sector-specific interpretation for an emerging technology where voice data is often processed continuously and may include biometric identifiers, helping product and compliance teams identify the applicable legal basis and design safeguards.

Refer to it when

• designing or auditing a voice assistant product
• determining the legal basis for storing voice recordings
• assessing whether biometric voice identification requires special safeguards
• enabling data subject rights through voice interfaces
• processing children's voice data

Questions this document addresses

• What legal basis applies to executing a user's voice command versus improving the ML model?
• When does voice data constitute special category biometric data?
• How should VVA providers implement data protection by design?
• How can data subject rights be exercised through a voice interface?

Topics

• Consent
• Lawful basis
• Transparency
• Children's data
• Voice assistants